Here is a blog post that should explain it. http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
-----Original Message----- From: Mike Leone [mailto:[email protected]] Sent: Wednesday, September 28, 2011 11:00 AM To: NT System Admin Issues Subject: "lastLogon" time is different on different DCs I am confused about something (the standard state of affairs ...). We're trying to determine the last logon time for a now-disabled user. This user used to logon at the site where he worked, and where we have a DC. Here's the weird thing - if I connect to that DC using an XP machine (which has the "acctinfo.dll" loaded, so I can see last logon/logoff times), I see his last logon/logoff. If I connect to one of the DCs back here at our main location, I see the same info. But if I connect to a different DC (a virtual one, unlike the others), this user shows last logon/logoff as "not set". Now how can that be? I checked replication, and see no errors - everything seems to be replicating properly with everything else. Yet this one DC shows different info than the others. What threw me was that I by default connect to this 3rd DC, and couldn't understand why it showed no logon/logoff info at all, for this user. So I tried connecting to 2 other DCs, and they show the info. I think this is problem; my fellow admin does not. Is it a problem? If so, where should I go to troubleshoot further? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
