Checking the last time an account was used

[Rich]

Hi,

Is there a tool or some other way to determine when the
last time a user logged on to a Windows 2000 domain? I am
in the middle of migrating from one AD forest to another,
and I have to buy licenses based on the number of users
being migrated. I have a feeling that there are a lot of
accounts that were created for testing or old service
account that I want to get rid of so I don't have to pay
for them, but I don't want to kill any accounts that are
still being used.

Thanks,

Rich

 

[Matjaz Ladava [MVP]]

I have created a simple tool for querying lastLogon attribute in AD for User
and Computer accounts. The purpose of this tool it, to get a list of
User/Computer objects which are inactive for specific number of days. The
tool queries all DC's on in the domain for object lastLogon attribute and
displays it in the list with lastLogon date/time, days of inactivity, dn of
the attribute and the server on which the object was last authenticated.

The tool is written with C# in .NET framework 1.1, so you need .NET
framework 1.1 to run this tool (you can get it from Windows Update).

Download Link (executables only) :
http://ladava.com/faq/uploads/ADInactiveObjects.zip
Download Link (source code):
http://ladava.com/faq/uploads/ADInactiveObjects_src.zip

--
Regards

Matjaz Ladava, MCSE (NT4 & 2000), MVP
(e-mail address removed)
http://ladava.com

 

[Jeff Jones [MSFT]]

In Windows Server 2003 domains there is a new attribute called
lastLogonTimestamp. Active Directory Users and Computer can be used to
generate a query for all users who have not logged on in X days. It uses
the lastLogonTimestamp attribute.