Solved

How to tell the last time a user logged in?

Posted on 2008-10-06
3
362 Views
Last Modified: 2008-10-06
I have a user on my domain and I want to see if they logged in today and if so what time and duration.

The security logs are horrible for filtering, if that is the only option do you have any suggestions on how to filter efficiently?
0
Comment
Question by:LrdKanien
3 Comments
 
LVL 1

Accepted Solution

by:
Chris Brock earned 500 total points
Comment Utility
0
 
LVL 15

Expert Comment

by:fishadr
Comment Utility
There is a good reference site here on last logons:
http://www.rlmueller.net/Last%20Logon.htm

Any DC (Domain Controller) in a domain can authenticate a user and this information is not normally replicated to the other domain controllers -  unless you are running Windows Server 2003 and the domain is at Windows Server 2003 functional level in which case there is a new attribute available called lastLogonTimeStamp which is replicated to the other domain controllers. To reduce replication traffic this data is not replicated all the time and is only usually replicated if the time stamp for a users last logon is over 14 days old. This is a quick way of identifying if an account has logged on recently.

The best method I have found is to write a script to query the lastlogon timestamp for each user object in the domain on each server and use the latest value (last logon) for each user and this can be used to produce a report - Sample scripts are available on the above website.

The JoeWare tools is good (as are his other utilities), I am not sure if it queries all the Domain Controllers or just the specified server (in which case you will have to run it against all the servers and then use the newest last logon date for each user from each servers)

Either way will work and as far as I know there are no easier ways of getting this information out.
0
 

Author Comment

by:LrdKanien
Comment Utility
I need the Last Logoff variable to be set as well but it is showing as Not set.  What can I do?
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now