AD 2008 - R2 User Logon Count = 0, but lastlogontimestamp is recent

We have 3 DC's in a single domain.

Using Dovestone's True Last Logon application, I searched all DC's for "stale" accounts.

Almost every account displays a Last Authenticated DC entry of one of the DC's,

Of these, there are  accounts that have a logonCount = 0, or blank, and a recent lastLogonTimestamp

A few of those have lastlogon dates up to a year prior.

I'm trying to understand how an account can have a Last Authenticated DC entry, a 0 (or blank) logon count, but have a recent lastLogonTimestamp?
BellevueAdminAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Chris DentConnect With a Mentor PowerShell DeveloperCommented:
Replication is one possible answer. lastLogonTimeStamp is replicated between DCs, but logonCount is not (it's specific to each DC).

Chris
0
All Courses

From novice to tech pro — start learning today.