vb script or powershell script to find out last authentication on windows 2003 network

Hello, when you logon to a windows 2003 domain, you can find very easy last logon time with different scripts for example lastlogontimestamp. But some users are working in a different and accessing servers in the other domain. In that case, lastlogontimestamp is not working. Can someone advise how to find out the last authentication time of that user?
Davy_VK_72Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
KenMcFConnect With a Mentor Commented:
The two attributes to look at are lastlogon and lastlogontimestamp. The differnce is that lastlogontimestamp is replicated to all DCs every 9-14 days, lastlogon is not replicated so you will need to query every DC. These are both for interactive logons. If you are looking for other kinds of login you will need to enable auditing and comb through event logs.

I would use adfind or powershell with the quest AD cmdlets to get lastlogontimestamp so there would be no decoding to do

adfind with the -tdc switch - I think that is the correct switch, i would have to verify.
Quest - get-qaduser lastlogontimestamp | ft lastlogontimestamp


For the event logs you could use something like splunk

http://www.splunk.com/
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.