?
Solved

How to tell the last time a user logged in?

Posted on 2008-10-06
3
Medium Priority
?
369 Views
Last Modified: 2008-10-06
I have a user on my domain and I want to see if they logged in today and if so what time and duration.

The security logs are horrible for filtering, if that is the only option do you have any suggestions on how to filter efficiently?
0
Comment
Question by:LrdKanien
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Accepted Solution

by:
Chris Brock earned 2000 total points
ID: 22654173
0
 
LVL 15

Expert Comment

by:fishadr
ID: 22654299
There is a good reference site here on last logons:
http://www.rlmueller.net/Last%20Logon.htm

Any DC (Domain Controller) in a domain can authenticate a user and this information is not normally replicated to the other domain controllers -  unless you are running Windows Server 2003 and the domain is at Windows Server 2003 functional level in which case there is a new attribute available called lastLogonTimeStamp which is replicated to the other domain controllers. To reduce replication traffic this data is not replicated all the time and is only usually replicated if the time stamp for a users last logon is over 14 days old. This is a quick way of identifying if an account has logged on recently.

The best method I have found is to write a script to query the lastlogon timestamp for each user object in the domain on each server and use the latest value (last logon) for each user and this can be used to produce a report - Sample scripts are available on the above website.

The JoeWare tools is good (as are his other utilities), I am not sure if it queries all the Domain Controllers or just the specified server (in which case you will have to run it against all the servers and then use the newest last logon date for each user from each servers)

Either way will work and as far as I know there are no easier ways of getting this information out.
0
 

Author Comment

by:LrdKanien
ID: 22654631
I need the Last Logoff variable to be set as well but it is showing as Not set.  What can I do?
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
When asking a question in a forum or creating documentation, screenshots are vital tools that can convey a lot more information and save you and your reader a lot of time
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question