Last logged in for user accounts

[Jason Hurley]

Trying to find out last time user logged in to the system.

NOS: Windows 2000 Active Directory

I'm a born and raised Novell guy from the past and
features I'm used to having availible to me though Netware
I wish I had in Windows. Nonetheless, I do believe the MS
does have the same type of features as Novell just in
different places and under different names. What I'm
looking for is how to tell the last time a user logged in
the domain and what was the last computer that user
accessed. If I just use the security log it may be over-
written prior the the users last login. Can anyone help
me here?

Thanks,
Novell Trader

 

[Joe Richards [MVP]]

As for the machine, you will need to look at the security log assuming you have
auditing enabled for logon events.

As for when the last logon occurred, the concept of logons is a bit different in
Windows, such that you will have to query every DC for the lastlogon attribute
and then sort them out.

In K3, there is a new attribute available called lastLogonTimeStamp that has the
a time stamp that is up to 10 days old. It is simply to help find out what IDs
are still being used. You can adjust the latency but it isn't good to crank it
up to say daily as that adds considerable replication if you have a large
environment of a couple of hundred thousand users or people over slow wan links.

joe

 

[Jason]

Thanks for the info. It's nice to have help in this
fasion. By the way, what is K3?

jh

-----Original Message-----
As for the machine, you will need to look at the security log assuming you have
auditing enabled for logon events.

As for when the last logon occurred, the concept of logons is a bit different in
Windows, such that you will have to query every DC for the lastlogon attribute
and then sort them out.

In K3, there is a new attribute available called

lastLogonTimeStamp that has the

 

[Joe Richards [MVP]]

K3 is my short terminology for Windows Server 2003. Honestly it should be named
Windows 5.2 but you know marketing...

2k = Windows 2000
k3 = Windows Server 2003