Windows 2003 Determining when an account last logged in

  • Thread starter Thread starter M.Siler
  • Start date Start date
M

M.Siler

Windows Server 2003 - I'm trying to find a way to determine when an account
last logged in. I would have through I could have selected the account in
question and selected properties and viewed that info there... perhaps on
the Object tab, but no luck. Can I view this info or do I have to look
through the event logs?
 
This property exists for the first time in Windows 2003 server, you can
retrive using a Windows Script, but I don't think there is a GUI for it.

You can try this (It is not anything I have written or tested though)

http://forums.techarena.in/showthread.php?t=187330
Mike.

"M.Siler" <John.Doe@NoSpam.com> wrote in message
news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...
> Windows Server 2003 - I'm trying to find a way to determine when an
> account last logged in. I would have through I could have selected the
> account in question and selected properties and viewed that info there...
> perhaps on the Object tab, but no luck. Can I view this info or do I have
> to look through the event logs?
>
 
If you domain is at Windows 2003 functional level, the lastLogonTimeStamp
attribute can be used. It is updated during logon if the old value is more
than 14 days (by default) in the past. This is accurate within 14 days, but
is replicated to all Domain Controllers, so is easy to retrieve. Otherwise,
you must use the lastLogon attribute, which is updated on every logon, but
is not replicated, so you must query every Domain Controller in the domain.
Both attributes are Integer8 (64-bit numbers), so must be converted to
dates.

You can use Joe Richards' free oldcmp utility:

http://www.joeware.net/win/free/tools/oldcmp.htm

Or, you may be able to use one of the other command line utilities (if they
convert Integer8 to dates).

I have example VBScript programs to retrieve lastLogon or lastLogonTimeStamp
for all users at this link:

http://www.rlmueller.net/Last Logon.htm

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"Michael M." <nospam@mike.com> wrote in message
news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...
> This property exists for the first time in Windows 2003 server, you can
> retrive using a Windows Script, but I don't think there is a GUI for it.
>
> You can try this (It is not anything I have written or tested though)
>
> http://forums.techarena.in/showthread.php?t=187330
> Mike.
>
> "M.Siler" <John.Doe@NoSpam.com> wrote in message
> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...
>> Windows Server 2003 - I'm trying to find a way to determine when an
>> account last logged in. I would have through I could have selected the
>> account in question and selected properties and viewed that info there...
>> perhaps on the Object tab, but no luck. Can I view this info or do I have
>> to look through the event logs?
>>
>
>
 
Is it just me, but doesn't is seem like this would be a bit of info you
might want to have when you are on that users account. You know like right
click and it would be there or perhaps it would be a column you could add
when you do View > Add/Remove Columns...

Thanks for the info... I'll check out the scripts.

"Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in
message news:OxpQ62wwHHA.3560@TK2MSFTNGP02.phx.gbl...
> If you domain is at Windows 2003 functional level, the lastLogonTimeStamp
> attribute can be used. It is updated during logon if the old value is more
> than 14 days (by default) in the past. This is accurate within 14 days,
> but is replicated to all Domain Controllers, so is easy to retrieve.
> Otherwise, you must use the lastLogon attribute, which is updated on every
> logon, but is not replicated, so you must query every Domain Controller in
> the domain. Both attributes are Integer8 (64-bit numbers), so must be
> converted to dates.
>
> You can use Joe Richards' free oldcmp utility:
>
> http://www.joeware.net/win/free/tools/oldcmp.htm
>
> Or, you may be able to use one of the other command line utilities (if
> they convert Integer8 to dates).
>
> I have example VBScript programs to retrieve lastLogon or
> lastLogonTimeStamp for all users at this link:
>
> http://www.rlmueller.net/Last Logon.htm
>
> --
> Richard Mueller
> Microsoft MVP Scripting and ADSI
> Hilltop Lab - http://www.rlmueller.net
> --
>
> "Michael M." <nospam@mike.com> wrote in message
> news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...
>> This property exists for the first time in Windows 2003 server, you can
>> retrive using a Windows Script, but I don't think there is a GUI for it.
>>
>> You can try this (It is not anything I have written or tested though)
>>
>> http://forums.techarena.in/showthread.php?t=187330
>> Mike.
>>
>> "M.Siler" <John.Doe@NoSpam.com> wrote in message
>> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...
>>> Windows Server 2003 - I'm trying to find a way to determine when an
>>> account last logged in. I would have through I could have selected the
>>> account in question and selected properties and viewed that info
>>> there... perhaps on the Object tab, but no luck. Can I view this info or
>>> do I have to look through the event logs?
>>>
>>
>>
>
>
 
You might look into the AcctInfo.dll tool, described in this link:

http://technet2.microsoft.com/windo...c4aa-4e0d-b5bc-cb14c7ff69cd1033.mspx?mfr=true

I think it retrieves the lastLogon attribute value on only one DC. Download
here:

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"M.Siler" <John.Doe@NoSpam.com> wrote in message
news:OThfjsxwHHA.4592@TK2MSFTNGP05.phx.gbl...
> Is it just me, but doesn't is seem like this would be a bit of info you
> might want to have when you are on that users account. You know like right
> click and it would be there or perhaps it would be a column you could add
> when you do View > Add/Remove Columns...
>
> Thanks for the info... I'll check out the scripts.
>
> "Richard Mueller [MVP]" <rlmueller-nospam@ameritech.nospam.net> wrote in
> message news:OxpQ62wwHHA.3560@TK2MSFTNGP02.phx.gbl...
>> If you domain is at Windows 2003 functional level, the lastLogonTimeStamp
>> attribute can be used. It is updated during logon if the old value is
>> more than 14 days (by default) in the past. This is accurate within 14
>> days, but is replicated to all Domain Controllers, so is easy to
>> retrieve. Otherwise, you must use the lastLogon attribute, which is
>> updated on every logon, but is not replicated, so you must query every
>> Domain Controller in the domain. Both attributes are Integer8 (64-bit
>> numbers), so must be converted to dates.
>>
>> You can use Joe Richards' free oldcmp utility:
>>
>> http://www.joeware.net/win/free/tools/oldcmp.htm
>>
>> Or, you may be able to use one of the other command line utilities (if
>> they convert Integer8 to dates).
>>
>> I have example VBScript programs to retrieve lastLogon or
>> lastLogonTimeStamp for all users at this link:
>>
>> http://www.rlmueller.net/Last Logon.htm
>>
>> --
>> Richard Mueller
>> Microsoft MVP Scripting and ADSI
>> Hilltop Lab - http://www.rlmueller.net
>> --
>>
>> "Michael M." <nospam@mike.com> wrote in message
>> news:eu%2371fwwHHA.3560@TK2MSFTNGP02.phx.gbl...
>>> This property exists for the first time in Windows 2003 server, you can
>>> retrive using a Windows Script, but I don't think there is a GUI for it.
>>>
>>> You can try this (It is not anything I have written or tested though)
>>>
>>> http://forums.techarena.in/showthread.php?t=187330
>>> Mike.
>>>
>>> "M.Siler" <John.Doe@NoSpam.com> wrote in message
>>> news:%23T1qcXwwHHA.1852@TK2MSFTNGP04.phx.gbl...
>>>> Windows Server 2003 - I'm trying to find a way to determine when an
>>>> account last logged in. I would have through I could have selected the
>>>> account in question and selected properties and viewed that info
>>>> there... perhaps on the Object tab, but no luck. Can I view this info
>>>> or do I have to look through the event logs?
>>>>
>>>
>>>
>>
>>
>
>
 
Back
Top