Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

vb script or powershell script to find out last authentication on windows 2003 network

Posted on 2010-11-16
1
Medium Priority
?
678 Views
Last Modified: 2012-05-10
Hello, when you logon to a windows 2003 domain, you can find very easy last logon time with different scripts for example lastlogontimestamp. But some users are working in a different and accessing servers in the other domain. In that case, lastlogontimestamp is not working. Can someone advise how to find out the last authentication time of that user?
0
Comment
Question by:Davy_VK_72
1 Comment
 
LVL 27

Accepted Solution

by:
KenMcF earned 2000 total points
ID: 34150829
The two attributes to look at are lastlogon and lastlogontimestamp. The differnce is that lastlogontimestamp is replicated to all DCs every 9-14 days, lastlogon is not replicated so you will need to query every DC. These are both for interactive logons. If you are looking for other kinds of login you will need to enable auditing and comb through event logs.

I would use adfind or powershell with the quest AD cmdlets to get lastlogontimestamp so there would be no decoding to do

adfind with the -tdc switch - I think that is the correct switch, i would have to verify.
Quest - get-qaduser lastlogontimestamp | ft lastlogontimestamp


For the event logs you could use something like splunk

http://www.splunk.com/
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

782 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question