How to Detect Every Active Directory User’s Last Logon Time
How to find user’s last logon time
In Windows Server 2003 Microsoft introduced the lastLogontimeStamp attribute. Administrators can use the lastLogontimeStamp attribute to determine if a user or computer account has recently logged onto the domain. Using this information administrators can then review the accounts identified and determine if they are still needed and take appropriate action.
AD stores a user’s last logon time in the Last-Logon user object attribute. Like the logging of account logon events, The last logon time is updated only in the AD instance of the domain controller (DC) that actually authenticated the user and is not replicated.The authentication process is totally depend upon on your AD design. How we can redirect the users to particular domain controller for authentication.
Information about user’s last logon date in Active Directory may be very helpful in detecting inactive accounts. Knowing that IT admins can prevent unauthorized attempts to log in to IT systems thus minimizing risk of a security breach by disabling accounts not used.
Every time a user logs on, the logon time is stamped into the “Last-Logon-Timestamp” attribute by the domain controller.
Last logon time reports are essential to understanding what your users are doing
Detecting Last Logon Time with PowerShell
Start Windows PowerShell through the Start Menu or by using “Run”. You can also type “PowerShell” in the Start Menu search and press “Enter”.
Copy and run the following script to generate last logon reports on the command screen:
$Path = 'C:\Temp\LastLogon.csv'
Get-ADUser -Filter {enabled -eq $true} -Properties LastLogonTimeStamp |
Select-Object Name,@{Name="Stamp"; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('yyyy-MM-dd_hh:mm:ss')}} | Export-Csv -Path $Path –notypeinformation
Once script executed output file will store in Temp folder under C drive or you can also change the output file as per your requirement.
Go to C\Temp folder and Open the CSV file-
You can also check the last logon time for particular user as well by attribute editor.
This is how we can get the last logon time stamp for all enabled users in csv format as well checked for particular user via attribute editor.
So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!
Recommended contents
How to Check the Active Directory Database Integrity
Disabling and Enabling the Outbound Replication
DFS Replication Service Stopped Replication
What is Strict Replication Consistency
The replication operation failed because of a schema mismatch between the servers involved
Troubleshooting ad replication error 8418 the replication operation failed because of a schema mismatch between the servers
How to export replication information in txt file
Repadmin Replsummary
Enabling the outbound replication
Disabling and enabling replication on schema master domain controller
How to enable strict replication consistency
How to prevent lingering objects replication in active directory
AD replication process overview
How to force active directory replication
Change notification in replication process
How to check replication partner for a specific domain controller
dcdiag test replications
Guys please don’t forget to like and share the post. You can also share the feedback on below windows techno email id.
If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.
