Solved

vb script or powershell script to find out last authentication on windows 2003 network

Posted on 2010-11-16
1
670 Views
Last Modified: 2012-05-10
Hello, when you logon to a windows 2003 domain, you can find very easy last logon time with different scripts for example lastlogontimestamp. But some users are working in a different and accessing servers in the other domain. In that case, lastlogontimestamp is not working. Can someone advise how to find out the last authentication time of that user?
0
Comment
Question by:Davy_VK_72
1 Comment
 
LVL 27

Accepted Solution

by:
KenMcF earned 500 total points
ID: 34150829
The two attributes to look at are lastlogon and lastlogontimestamp. The differnce is that lastlogontimestamp is replicated to all DCs every 9-14 days, lastlogon is not replicated so you will need to query every DC. These are both for interactive logons. If you are looking for other kinds of login you will need to enable auditing and comb through event logs.

I would use adfind or powershell with the quest AD cmdlets to get lastlogontimestamp so there would be no decoding to do

adfind with the -tdc switch - I think that is the correct switch, i would have to verify.
Quest - get-qaduser lastlogontimestamp | ft lastlogontimestamp


For the event logs you could use something like splunk

http://www.splunk.com/
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
rename files 4 25
How to capture software being install on latop. 4 20
Customizing XML with Powershell 2 23
Powershell to search for exact string in a file 2 24
Utilizing an array to gracefully append to a list of EmailAddresses
"Migrate" an SMTP relay receive connector to a new server using info from an old server.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question