Investigate the difference between lastLogon which is unique on each DC and LastLogonTimestamp which is replicated and you will find the answers. Much has been written about it.
In short, if you are OK with a rough approximation of when a user last logged in, check LastLogonTimestamp. If you really have to know exactly you need to check all the DCs. If you don't have that many it's not really a big deal with adfind and a for loop or <insert scripting environment of choice> lastLogon should be interpreted as lastTimeUserWasLoggedInBy_This_DC :-) -----Original Message----- From: Mike Leone [mailto:[email protected]] Sent: Wednesday, September 28, 2011 8:00 AM To: NT System Admin Issues Subject: "lastLogon" time is different on different DCs I am confused about something (the standard state of affairs ...). We're trying to determine the last logon time for a now-disabled user. This user used to logon at the site where he worked, and where we have a DC. Here's the weird thing - if I connect to that DC using an XP machine (which has the "acctinfo.dll" loaded, so I can see last logon/logoff times), I see his last logon/logoff. If I connect to one of the DCs back here at our main location, I see the same info. But if I connect to a different DC (a virtual one, unlike the others), this user shows last logon/logoff as "not set". Now how can that be? I checked replication, and see no errors - everything seems to be replicating properly with everything else. Yet this one DC shows different info than the others. What threw me was that I by default connect to this 3rd DC, and couldn't understand why it showed no logon/logoff info at all, for this user. So I tried connecting to 2 other DCs, and they show the info. I think this is problem; my fellow admin does not. Is it a problem? If so, where should I go to troubleshoot further? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
