AD 2008 - R2 User Logon Count = 0, but lastlogontimestamp is recent
Posted on 2014-09-25
We have 3 DC's in a single domain.
Using Dovestone's True Last Logon application, I searched all DC's for "stale" accounts.
Almost every account displays a Last Authenticated DC entry of one of the DC's,
Of these, there are accounts that have a logonCount = 0, or blank, and a recent lastLogonTimestamp
A few of those have lastlogon dates up to a year prior.
I'm trying to understand how an account can have a Last Authenticated DC entry, a 0 (or blank) logon count, but have a recent lastLogonTimestamp?