Solved

How to tell the last time a user logged in?

Posted on 2008-10-06
3
367 Views
Last Modified: 2008-10-06
I have a user on my domain and I want to see if they logged in today and if so what time and duration.

The security logs are horrible for filtering, if that is the only option do you have any suggestions on how to filter efficiently?
0
Comment
Question by:LrdKanien
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 1

Accepted Solution

by:
Chris Brock earned 500 total points
ID: 22654173
0
 
LVL 15

Expert Comment

by:fishadr
ID: 22654299
There is a good reference site here on last logons:
http://www.rlmueller.net/Last%20Logon.htm

Any DC (Domain Controller) in a domain can authenticate a user and this information is not normally replicated to the other domain controllers -  unless you are running Windows Server 2003 and the domain is at Windows Server 2003 functional level in which case there is a new attribute available called lastLogonTimeStamp which is replicated to the other domain controllers. To reduce replication traffic this data is not replicated all the time and is only usually replicated if the time stamp for a users last logon is over 14 days old. This is a quick way of identifying if an account has logged on recently.

The best method I have found is to write a script to query the lastlogon timestamp for each user object in the domain on each server and use the latest value (last logon) for each user and this can be used to produce a report - Sample scripts are available on the above website.

The JoeWare tools is good (as are his other utilities), I am not sure if it queries all the Domain Controllers or just the specified server (in which case you will have to run it against all the servers and then use the newest last logon date for each user from each servers)

Either way will work and as far as I know there are no easier ways of getting this information out.
0
 

Author Comment

by:LrdKanien
ID: 22654631
I need the Last Logoff variable to be set as well but it is showing as Not set.  What can I do?
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Determining the an SCCM package name from the Package ID
A small collection of useful tips and tricks for Windows 10 users that I decided to write as a result of recent questions that were asked and answered at Experts Exchange. Two short video tutorials included. Enjoy..
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decadeā€¦

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question