Announcement

Collapse
No announcement yet.

LastLogonTimeStamp

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • LastLogonTimeStamp

    Hi friends,

    We have to run a report every month for all domain users with their 2 attributes that are : LastLogon and lastlogontimestamp.

    But this time I have noticed all lastlogontimestamp is not same all DCs users. Moreover users I have checked are those which have not logged in past 3 months.

    Also difference in lastlogontimestamp is more tham 2 months in some cases which ideally shd not be more than 14 days (as per microsoft).

    Kindly lookinto the above issue and help resolving this issue.

    Note: except above issue rest is seems to be fine as far as replication is concerned. Specailly I checked schema partition replication among DC and it is fine.

    Yours
    Yogesh Malhotra

  • #2
    Re: LastLogonTimeStamp

    Are you saying that LastLogonTimestamp is not the same for a specific user depending on the domain controller you query?

    Or are you saying its the same whichever domain controllers you query but doesnt appear to be recording all logons?

    If you are getting a LastLogonTimestamp over 2 months old on users that you know are logging on.. then maybe their PCs/Laptops are using cached logon credentials and cannot query a domain controller?

    As you stated, you obviously know about 14 day thing so I won't bother explaining that.

    Comment


    • #3
      Re: LastLogonTimeStamp

      Originally posted by Andrew View Post
      Are you saying that LastLogonTimestamp is not the same for a specific user depending on the domain controller you query?

      Or are you saying its the same whichever domain controllers you query but doesnt appear to be recording all logons?

      If you are getting a LastLogonTimestamp over 2 months old on users that you know are logging on.. then maybe their PCs/Laptops are using cached logon credentials and cannot query a domain controller?

      As you stated, you obviously know about 14 day thing so I won't bother explaining that.
      Dear Andrew,

      An Example - Suppose u have not logged in domain for last 2 months and then I checked ur Login ID's LastLogonTimestamp attribute (from addition info tab in ADUC) . there are total 10 domain controllers and on each DC ur LastLogonTimestamp appears different. Ideally it must be same. thats the whole issue.

      Comment


      • #4
        Re: LastLogonTimeStamp

        The 'Additional Account Info' tab in ADUC does show a field Last-logon-Timestamp, but the value doesn't have to show the LastlogonTimestamp attribute. It depence on the Domain Functional Level.

        The LastlogonTimestamp attribute is only available at Windows 2003 native DFL! And Not if the domain Functional Level is still at Windows 2000 Native.

        When the DFL is 2003, then most likely there are replication problems in your network.


        \Rems
        Last edited by Rems; 10th September 2008, 15:18.

        This posting is provided "AS IS" with no warranties, and confers no rights.

        __________________

        ** Remember to give credit where credit's due **
        and leave Reputation Points for meaningful posts

        Comment


        • #5
          Re: LastLogonTimeStamp

          Originally posted by Rems View Post
          The 'Additional Account Info' tab in ADUC does show a field Last-logon-Timestamp, but the value doesn't have to show the LastlogonTimestamp attribute. It depence on the Domain Functional Level.

          The LastlogonTimestamp attribute is only available at Windows 2003 native DFL! And Not if the domain Functional Level is still at Windows 2000 Native.

          When the DFL is 2003, then most likely there are replication problems in your network.


          \Rems

          We have win 2003 DFL but I have checked with repadmin, also no rep issue in evnt vwr then whats the issue???

          Comment


          • #6
            Re: LastLogonTimeStamp

            I never found LastLogonTimeStamp reliable and a accurate there fore I would use the "LastLogon" which is very accurate , but the only draw back is that the "LastLogon" has to be collected from all DCs (it does not replicate).

            Comment


            • #7
              Re: LastLogonTimeStamp

              If the user has not logged-on yet after you raise the domain functional level, the user attribute might still be not inuse. (?)

              The LastLogonTimeStamp is only updated when the user logs on if the old value is more than 14 days in the past.
              The default replication is 14 days minus a random percentage of 5 days. But this can be changed.

              It could be that the 'Additional Account Info' is not showing the LastLogonTimeStamp. Is the datevalue different from the value at the field Last Logon on the same tab?

              Compare the Last-Logon-TimeStamp datevalue from the tab with the dates this vbscript returns.
              http://www.rlmueller.net/Programs/La...nTimeStamp.txt
              (If you would like to stop the script before it is finished, open taskmanager and end the process wscript.exe)

              \Rems
              Last edited by Rems; 11th September 2008, 22:22.

              This posting is provided "AS IS" with no warranties, and confers no rights.

              __________________

              ** Remember to give credit where credit's due **
              and leave Reputation Points for meaningful posts

              Comment


              • #8
                Re: LastLogonTimeStamp

                Hi Rems,

                Interestingly , Lastlogongtimestamp field in Acctinfo tab is showing the same value which is in the lastlogon field.

                But I when tried script it shows a different value for LastlogintimeStsmp from the lastlogin and value for LastlogintimeStsmp is same on all the domain controller when I checked it by vbscript.

                Is it mean that Acctinof tab is not showing genuine value for LLTSP ?? how we can correct it ???

                Originally posted by Rems View Post
                If the user has not logged-on yet after you raise the domain functional level, the user attribute might still be not inuse. (?)

                The LastLogonTimeStamp is only updated when the user logs on if the old value is more than 14 days in the past.
                The default replication is 14 days minus a random percentage of 5 days. But this can be changed.

                It could be that the 'Additional Account Info' is not showing the LastLogonTimeStamp. Is the datevalue different from the value at the field Last Logon on the same tab?

                Compare the Last-Logon-TimeStamp datevalue from the tab with the dates this vbscript returns.
                http://www.rlmueller.net/Programs/La...nTimeStamp.txt
                (If you would like to stop the script before it is finished, open taskmanager and end the process wscript.exe)

                \Rems

                Comment


                • #9
                  Re: LastLogonTimeStamp

                  It looks like there is an error in Acctinfo.dll version 1.0.0.1111
                  - http://blog.dikmenoglu.de/PermaLink,...432a34cad.aspx - Yusuf Dikmenoglu is also writing in the article about an unreleased version 2 of the dll. (translated by google)
                  - http://blog.dikmenoglu.de/PermaLink,...259ca559c.aspx

                  Try one time to
                  unregister the Acctinfo.dll,
                  copy the file to %windir% (if it is not already there)
                  Then re-register it.
                  Else... forget the deceptive field called Last-logon-timestamp in ADUC, and use a query to obtain the correct LastlogonTimestamp information.

                  \Rems
                  Last edited by Rems; 12th September 2008, 17:59.

                  This posting is provided "AS IS" with no warranties, and confers no rights.

                  __________________

                  ** Remember to give credit where credit's due **
                  and leave Reputation Points for meaningful posts

                  Comment


                  • #10
                    Re: LastLogonTimeStamp

                    Hi Rem,

                    I will check it ... Thanks for your help so far ......

                    Comment

                    Working...
                    X