Solved

vb script or powershell script to find out last authentication on windows 2003 network

Posted on 2010-11-16
1
668 Views
Last Modified: 2012-05-10
Hello, when you logon to a windows 2003 domain, you can find very easy last logon time with different scripts for example lastlogontimestamp. But some users are working in a different and accessing servers in the other domain. In that case, lastlogontimestamp is not working. Can someone advise how to find out the last authentication time of that user?
0
Comment
Question by:Davy_VK_72
1 Comment
 
LVL 27

Accepted Solution

by:
KenMcF earned 500 total points
ID: 34150829
The two attributes to look at are lastlogon and lastlogontimestamp. The differnce is that lastlogontimestamp is replicated to all DCs every 9-14 days, lastlogon is not replicated so you will need to query every DC. These are both for interactive logons. If you are looking for other kinds of login you will need to enable auditing and comb through event logs.

I would use adfind or powershell with the quest AD cmdlets to get lastlogontimestamp so there would be no decoding to do

adfind with the -tdc switch - I think that is the correct switch, i would have to verify.
Quest - get-qaduser lastlogontimestamp | ft lastlogontimestamp


For the event logs you could use something like splunk

http://www.splunk.com/
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this previous article (https://oddytee.wordpress.com/2016/05/05/provision-new-office-365-user-and-mailbox-from-exchange-hybrid-via-powershell/), we made basic license assignments to users in O365. When I say basic, the method is the simplest way …
The following article is intended as a guide to using PowerShell as a more versatile and reliable form of application detection in SCCM.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question