Determining when an account last logged in

[Guest M.Siler]

Windows Server 2003 - I'm trying to find a way to determine when an account

last logged in. I would have through I could have selected the account in

question and selected properties and viewed that info there... perhaps on

the Object tab, but no luck. Can I view this info or do I have to look

through the event logs?

[Guest Michael M.]

Re: Determining when an account last logged in

 

This property exists for the first time in Windows 2003 server, you can

retrive using a Windows Script, but I don't think there is a GUI for it.

 

You can try this (It is not anything I have written or tested though)

 

http://forums.techarena.in/showthread.php?t=187330

Mike.

 

"M.Siler" <John.Doe@NoSpam.com> wrote in message

news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...

> Windows Server 2003 - I'm trying to find a way to determine when an

> account last logged in. I would have through I could have selected the

> account in question and selected properties and viewed that info there...

> perhaps on the Object tab, but no luck. Can I view this info or do I have

> to look through the event logs?

>

[Guest Richard Mueller [MVP]]

Re: Determining when an account last logged in

 

If you domain is at Windows 2003 functional level, the lastLogonTimeStamp

attribute can be used. It is updated during logon if the old value is more

than 14 days (by default) in the past. This is accurate within 14 days, but

is replicated to all Domain Controllers, so is easy to retrieve. Otherwise,

you must use the lastLogon attribute, which is updated on every logon, but

is not replicated, so you must query every Domain Controller in the domain.

Both attributes are Integer8 (64-bit numbers), so must be converted to

dates.

 

You can use Joe Richards' free oldcmp utility:

 

http://www.joeware.net/win/free/tools/oldcmp.htm

 

Or, you may be able to use one of the other command line utilities (if they

convert Integer8 to dates).

 

I have example VBScript programs to retrieve lastLogon or lastLogonTimeStamp

for all users at this link:

 

http://www.rlmueller.net/Last%20Logon.htm

 

--

Richard Mueller

Microsoft MVP Scripting and ADSI

Hilltop Lab - http://www.rlmueller.net

--

 

"Michael M." <nospam@mike.com> wrote in message

news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...

> This property exists for the first time in Windows 2003 server, you can

> retrive using a Windows Script, but I don't think there is a GUI for it.

>

> You can try this (It is not anything I have written or tested though)

>

> http://forums.techarena.in/showthread.php?t=187330

> Mike.

>

> "M.Siler" <John.Doe@NoSpam.com> wrote in message

> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...

>> Windows Server 2003 - I'm trying to find a way to determine when an

>> account last logged in. I would have through I could have selected the

>> account in question and selected properties and viewed that info there...

>> perhaps on the Object tab, but no luck. Can I view this info or do I have

>> to look through the event logs?

>>

>

>

[Guest M.Siler]

Re: Determining when an account last logged in

 

Is it just me, but doesn't is seem like this would be a bit of info you

might want to have when you are on that users account. You know like right

click and it would be there or perhaps it would be a column you could add

when you do View > Add/Remove Columns...

 

Thanks for the info... I'll check out the scripts.

 

"Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in

message news:OxpQ62wwHHA.3560@TK2MSFTNGP02.phx.gbl...

> If you domain is at Windows 2003 functional level, the lastLogonTimeStamp

> attribute can be used. It is updated during logon if the old value is more

> than 14 days (by default) in the past. This is accurate within 14 days,

> but is replicated to all Domain Controllers, so is easy to retrieve.

> Otherwise, you must use the lastLogon attribute, which is updated on every

> logon, but is not replicated, so you must query every Domain Controller in

> the domain. Both attributes are Integer8 (64-bit numbers), so must be

> converted to dates.

>

> You can use Joe Richards' free oldcmp utility:

>

> http://www.joeware.net/win/free/tools/oldcmp.htm

>

> Or, you may be able to use one of the other command line utilities (if

> they convert Integer8 to dates).

>

> I have example VBScript programs to retrieve lastLogon or

> lastLogonTimeStamp for all users at this link:

>

> http://www.rlmueller.net/Last%20Logon.htm

>

> --

> Richard Mueller

> Microsoft MVP Scripting and ADSI

> Hilltop Lab - http://www.rlmueller.net

> --

>

> "Michael M." <nospam@mike.com> wrote in message

> news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...

>> This property exists for the first time in Windows 2003 server, you can

>> retrive using a Windows Script, but I don't think there is a GUI for it.

>>

>> You can try this (It is not anything I have written or tested though)

>>

>> http://forums.techarena.in/showthread.php?t=187330

>> Mike.

>>

>> "M.Siler" <John.Doe@NoSpam.com> wrote in message

>> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...

>>> Windows Server 2003 - I'm trying to find a way to determine when an

>>> account last logged in. I would have through I could have selected the

>>> account in question and selected properties and viewed that info

>>> there... perhaps on the Object tab, but no luck. Can I view this info or

>>> do I have to look through the event logs?

>>>

>>

>>

>

>

[Guest Richard Mueller [MVP]]

Re: Determining when an account last logged in

 

You might look into the AcctInfo.dll tool, described in this link:

 

http://technet2.microsoft.com/windowsserver/en/library/b4145d9a-c4aa-4e0d-b5bc-cb14c7ff69cd1033.mspx?mfr=true

 

I think it retrieves the lastLogon attribute value on only one DC. Download

here:

 

http://www.microsoft.com/downloads/details.aspx?FamilyID=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

 

--

Richard Mueller

Microsoft MVP Scripting and ADSI

Hilltop Lab - http://www.rlmueller.net

--

 

"M.Siler" <John.Doe@NoSpam.com> wrote in message

news:OThfjsxwHHA.4592@TK2MSFTNGP05.phx.gbl...

> Is it just me, but doesn't is seem like this would be a bit of info you

> might want to have when you are on that users account. You know like right

> click and it would be there or perhaps it would be a column you could add

> when you do View > Add/Remove Columns...

>

> Thanks for the info... I'll check out the scripts.

>

> "Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in

> message news:OxpQ62wwHHA.3560@TK2MSFTNGP02.phx.gbl...

>> If you domain is at Windows 2003 functional level, the lastLogonTimeStamp

>> attribute can be used. It is updated during logon if the old value is

>> more than 14 days (by default) in the past. This is accurate within 14

>> days, but is replicated to all Domain Controllers, so is easy to

>> retrieve. Otherwise, you must use the lastLogon attribute, which is

>> updated on every logon, but is not replicated, so you must query every

>> Domain Controller in the domain. Both attributes are Integer8 (64-bit

>> numbers), so must be converted to dates.

>>

>> You can use Joe Richards' free oldcmp utility:

>>

>> http://www.joeware.net/win/free/tools/oldcmp.htm

>>

>> Or, you may be able to use one of the other command line utilities (if

>> they convert Integer8 to dates).

>>

>> I have example VBScript programs to retrieve lastLogon or

>> lastLogonTimeStamp for all users at this link:

>>

>> http://www.rlmueller.net/Last%20Logon.htm

>>

>> --

>> Richard Mueller

>> Microsoft MVP Scripting and ADSI

>> Hilltop Lab - http://www.rlmueller.net

>> --

>>

>> "Michael M." <nospam@mike.com> wrote in message

>> news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...

>>> This property exists for the first time in Windows 2003 server, you can

>>> retrive using a Windows Script, but I don't think there is a GUI for it.

>>>

>>> You can try this (It is not anything I have written or tested though)

>>>

>>> http://forums.techarena.in/showthread.php?t=187330

>>> Mike.

>>>

>>> "M.Siler" <John.Doe@NoSpam.com> wrote in message

>>> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...

>>>> Windows Server 2003 - I'm trying to find a way to determine when an

>>>> account last logged in. I would have through I could have selected the

>>>> account in question and selected properties and viewed that info

>>>> there... perhaps on the Object tab, but no luck. Can I view this info

>>>> or do I have to look through the event logs?

>>>>

>>>

>>>

>>

>>

>

>