You know, I just had a feeling I had to double check something and go figure learned something new. So the LastLogonTimeStamp is updated in real time, it will be within a range of 9-14 day behind the current date.
It would still be more accurate than the last pwd change date as that could be a range of up to 30 days typically. Check out this blog post http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx From: [email protected] [mailto:[email protected]] On Behalf Of Krueger, Jeff Sent: Wednesday, January 14, 2015 12:27 PM To: [email protected] Subject: [mssms] RE: Create SCCM 2012 collection based on a SQL query Actually it is the last time the machine itself authenticated to AD as captured during the AD system discovery, so depending on the discovery schedule it may be out by a week if your discovery only runs weekly, but the same would apply to the any attribute collected by the discovery. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Iacaruso, Mike Sent: Wednesday, January 14, 2015 12:13 PM To: [email protected]<mailto:[email protected]> Subject: [mssms] RE: Create SCCM 2012 collection based on a SQL query Jeff this attribute is equivalent to the password last set? Mike Iacaruso Enterprise Desktop Engineer Office of Technology Services Towson University 410-704-3965 [email protected]<mailto:[email protected]> From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Krueger, Jeff Sent: Wednesday, January 14, 2015 11:16 AM To: [email protected]<mailto:[email protected]> Subject: [mssms] RE: Create SCCM 2012 collection based on a SQL query I've created several collections based on the last logon time attribute, that would probably be better than last password set. Try this: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.LastLogonTimestamp >= DateAdd(dd,-7,GetDate()) From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of Iacaruso, Mike Sent: Wednesday, January 14, 2015 11:10 AM To: [email protected]<mailto:[email protected]> Subject: [mssms] Create SCCM 2012 collection based on a SQL query I need to use the AD attribute pwdLastSet in SCCM to filter out stale systems. I added the attribute to the AD system discovery, but I need to convert pwdlastset to a date readable format. I need to find systems that are older than 45 days. I have found that I cannot convert this using WQL and have used SQL to convert this but I need to create a collection with these results. I need this collection as part of a report for management. Is there a way to create a collection using this SQL query? Is there a better way to accomplish this? Thanks Mike Iacaruso Enterprise Desktop Engineer Office of Technology Services Towson University 410-704-3965 [email protected]<mailto:[email protected]> ________________________________ CONFIDENTIALITY NOTICE: This email contains information from the sender that may be CONFIDENTIAL, LEGALLY PRIVILEGED, PROPRIETARY or otherwise protected from disclosure. This email is intended for use only by the person or entity to whom it is addressed. If you are not the intended recipient, any use, disclosure, copying, distribution, printing, or any action taken in reliance on the contents of this email, is strictly prohibited. If you received this email in error, please contact the sending party by reply email, delete the email from your computer system and shred any paper copies. Note to Patients: There are a number of risks you should consider before using e-mail to communicate with us. See our Privacy & Security page on www.henryford.com<http://www.henryford.com> for more detailed information as well as information concerning MyChart, our new patient portal. If you do not believe that our policy gives you the privacy and security protection you need, do not send e-mail or Internet communications to us.
