Using Windows Powershell and Quest's free AD cmclets:
$dcs = get-qadcomputer -computerrole domaincontroller
$group = get-qadgroup "<group name>"
$users = $group.members
$lastlogon_ht = @{}
foreach ($dc in $dcs){
connect-qadservice -service "$dc:389" > $nul
foreach ($user in $users){
$usr_logon = get-qaduser $user -includedproperties
name,lastlogon
if ($usr_logon.lastlogon -gt
$lastlogon_ht[$user]){$lastlogon_ht[$user] = $usr_logon.lastlogon}
}
}
$lastlogon_ht
________________________________
From: Alexander Paritsky [mailto:[EMAIL PROTECTED]
Sent: Monday, September 08, 2008 11:48 AM
To: Active Directory Admin Issues
Subject: RE: Last Logon Date of AD users
________________________________
Date: Mon, 8 Sep 2008 20:25:05 +0530
From: [EMAIL PROTECTED]
To: [email protected]
Subject: Re: Last Logon Date of AD users
One more thing, is there any tool which we can retrive last logon dates
for the users in a particular group ?
Naresh
On Mon, Sep 8, 2008 at 8:23 PM, Naresh Kumar <[EMAIL PROTECTED]>
wrote:
We have around 90 150 DC's across multiple sites. When i the other
script it works find and giving the correct dates. I just want to know
why the lines not working.
Naresh
On Mon, Sep 8, 2008 at 6:29 PM, <[EMAIL PROTECTED]> wrote:
Thank Thomas and George for clarifying the date of 1601. Makes perfect
sense now. :-)
Thomas
From: Thomas Nilsen [mailto:[EMAIL PROTECTED]
Sent: Monday, September 08, 2008 7:53 AM
To: Active Directory Admin Issues
Subject: RE: Last Logon Date of AD users
If you're on a mixed windows 2000/2003 AD domain, lastlogon will only
show logon data if the user has been authenticated against that
particular DC which you got the data from. If you only have one DC then
yes, it would indicate that the user has not logged on at all.
If you're on a Windows 2003 AD functional level, the logon date is
replicated and should show the same for which ever DC you qurey against.
There's some info on this at http://blog.joeware.net/2007/05/01/864/
Regards,
Thomas
________________________________
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]
Sent: Monday, September 08, 2008 2:46 PM
To: Active Directory Admin Issues
Subject: RE: Last Logon Date of AD users
Naresh, I received the same information when I ran a script similar to
what you have. However, I am assuming the output with 1/1/1601 is an
indication that they have not logged on to the network. The accounts
with the date of 1/1/1601 where alias accounts and accounts we created
that have not logged onto the network.
Maybe someone else can provide additional information as to why the date
is populated with 1/1/1601.
Thomas
From: Naresh Kumar [mailto:[EMAIL PROTECTED]
Sent: Monday, September 08, 2008 2:20 AM
To: Active Directory Admin Issues
Subject: Last Logon Date of AD users
Hello Everybody,
I am badly in need of help. I need to retrive the last logon date for
specified members. I googled for that and got the below lines from
microsoft
On Error Resume Next
Set objUser = GetObject("LDAP://cn=Ken Myer, ou=Finance, dc=fabrikam,
dc=com")
Set objLastLogon = objUser.Get("lastLogonTimestamp")
intLastLogonTime = objLastLogon.HighPart * (2^32) + objLastLogon.LowPart
intLastLogonTime = intLastLogonTime / (60 * 10000000)
intLastLogonTime = intLastLogonTime / 1440
Wscript.Echo "Last logon time: " & intLastLogonTime + #1/1/1601#
I had made changes to the second line according to my OU structure and
got the output : Last logon time: 1/1/1601
Can anyone please help me on this.
Thanks in advance
Naresh
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
This email and any attached files are confidential and intended solely
for the intended recipient(s). If you are not the named recipient you
should not read, distribute, copy or alter this email. Any views or
opinions expressed in this email are those of the author and do not
represent those of the Girl Scouts of Southwest Texas. Warning: Although
precautions have been taken to make sure no viruses are present in this
email, Girl Scouts of Southwest Texas cannot accept responsibility for
any loss or damage that arise from the use of this email or attachments.
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
DISCLAIMER:
This message contains information that may be privileged or confidential
and is the property of the Roxar Group. It is intended only for the
person to whom it is addressed. If you are not the intended recipient,
you are not authorised to read, print, retain, copy, disseminate,
distribute, or use this message or any part thereof. If you receive this
message in error, please notify the sender immediately and delete all
copies of this message.
This email and any attached files are confidential and intended solely
for the intended recipient(s). If you are not the named recipient you
should not read, distribute, copy or alter this email. Any views or
opinions expressed in this email are those of the author and do not
represent those of the Girl Scouts of Southwest Texas. Warning: Although
precautions have been taken to make sure no viruses are present in this
email, Girl Scouts of Southwest Texas cannot accept responsibility for
any loss or damage that arise from the use of this email or attachments.
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
________________________________
See how Windows connects the people, information, and fun that are part
of your life. See Now
<http://clk.atdmt.com/MRT/go/msnnkwxp1020093175mrt/direct/01/>
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK
Test! ~
~ ~
**************************************************************************************************
Note:
The information contained in this message may be privileged and confidential
and
protected from disclosure. If the reader of this message is not the intended
recipient, or an employee or agent responsible for delivering this message to
the intended recipient, you are hereby notified that any dissemination,
distribution or copying of this communication is strictly prohibited. If you
have received this communication in error, please notify us immediately by
replying to the message and deleting it from your computer.
**************************************************************************************************
~ NEW: CounterSpy Enterprise: Centralized Antispyware - #1 in eWEEK Test! ~
~ <http://www.sunbelt-software.com/product.cfm?id=400> ~
