asked on

Last login date/time for users in Active Directory

Hi Experts,
Is there a way to get a list of the last login date and time for the users of a specific OU. I have made some changes to login script and need to know what users (Ihave about 400) have not get the changes because they have not logout/login their account.

Thank you,

ASKER CERTIFIED SOLUTION

pitchford

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

KenMcF

There are two attributes you can look for. One is lastlogon and the other is lastlogontimestamp. The difference is that lastlogon is not replicated between DCs and the lastlogontimestamp is replicated every 9-14 days. To get these I like to use either powershell with the quest ad cmdlets or ADFind. The reason I like these is becuase it does the conversion for you.

Get-qaduser USERNAME | FL Name, Lastlogontimestamp

adfind -default -f "(samaccountname=USERNAME)" name lastlogontimestamp -tdcs

pitchford

Furthermore, the Dovestones software will query all domain controllers and merge the report into one nice report. It shows the user's name, last logon date, time, expire date/time, and if the account is enabled. YOu can even disable/delete accounts from within the app.

Here is a screen cap:
http://www.google.com/imgres?imgurl=http://www.suggestsoft.com/images/dovestones-software/true-last-logon.gif&imgrefurl=http://www.suggestsoft.com/soft/dovestones-software/true-last-logon/&usg=__ZDpc5nWTTM0PSCT3-gNV7ORPxVA=&h=731&w=736&sz=40&hl=en&start=0&sig2=KCA563NYdogGULt68kfUHA&zoom=1&tbnid=N5zRojyzK3Pw_M:&tbnh=154&tbnw=155&ei=-ANnTfG5DMmjtgfY243oAw&prev=/images%3Fq%3Ddovestone%2Btrue%2Blast%2Blogon%26um%3D1%26hl%3Den%26sa%3DN%26rlz%3D1I7GGLD_en%26biw%3D1085%26bih%3D664%26tbs%3Disch:1&um=1&itbs=1&iact=hc&vpx=131&vpy=92&dur=12&hovh=224&hovw=225&tx=128&ty=157&oei=-ANnTfG5DMmjtgfY243oAw&page=1&ndsp=14&ved=1t:429,r:0,s:0

Felix Leven

What about Active Directory Users and Computers go to the OU -> View -> add/remove column -> add modified

with every domain logon a user is "modified"