AD: lastLogon versus lastlogontimestamp

AD: lastLogon versus lastlogontimestamp

Door: Arnout van der Vorst

Active Directory has always contained the lastLogon attribute on every user object which denotes the last logon date/time in the nice integer8 format. To realistically report the last logon for every user, you need to convert this format into a readable date/time string. But that’s not it, as the lastLogon attribute is not replicated among domain controllers.

Windows 2003 Active Directory introduced the lastLogonTimestamp attribute, which is in the same format, but is now replicated by default. Before you get excited, this attribute is only replicated once every 2 weeks. In most situations this is not a problem, as you probably use last logon reports to clean your AD, and usually the cleaning period is about 3 months. Since 3 months easily covers the 2 week margin you are safe.

If you use a tool capable of bulk quering and processing AD such as UMRA, you can get exact last logon reports:

  1. Query all domain controllers (bit 8192 on userAccountControl)
  2. Per domain controller, get all user DN’s and their lastLogon attribute (conversion in UMRA on-the-fly to readable date/time
  3. Add all results to 1 big table
  4. Have UMRA process the big table and filter out all duplicates based on latest lastLogon per DN

If you are worried about performance and/or domain controller impact, don’t be. UMRA only does 1 table query per domain controller and all other processing is handled internally.

Geschreven door:
Arnout van der Vorst

Arnout van der Vorst is Identity Management Architect bij Tools4ever en al ruim 10 jaar in dienst. Arnout legt zich als Architect toe op het bedenken en ontwikkelen van nieuwe features, oplossingen en diensten van Tools4ever die aansluiten op de vraag uit de markt. Arnout studeerde Hogere Informatica aan de Hogeschool van Utrecht.

Anderen bekeken ook

De vooroordelen van Single Sign On

29 november 2011

RBAC: sleutelrol, beheer en evolutie

15 maart 2011

SAP koppeling met Active Directory

06 september 2012

User- en toegangsbeheer in cloud applicaties: een uitdaging

04 september 2012

Single Sign On met terminal emulatie (VAX64, AS/400, Linux, SSH)

14 oktober 2010