AD: lastLogon versus lastlogontimestamp

Active Directory has always contained the lastLogon attribute on every user object which denotes the last logon date/time in the nice integer8 format. To realistically report the last logon for every user, you need to convert this format into a readable date/time string. But that’s not it, as the lastLogon attribute is not replicated among domain controllers.

Windows 2003 Active Directory introduced the lastLogonTimestamp attribute, which is in the same format, but is now replicated by default. Before you get excited, this attribute is only replicated once every 2 weeks. In most situations this is not a problem, as you probably use last logon reports to clean your AD, and usually the cleaning period is about 3 months. Since 3 months easily covers the 2 week margin you are safe.

If you use a tool capable of bulk quering and processing AD such as UMRA, you can get exact last logon reports:

1. Query all domain controllers (bit 8192 on userAccountControl)
2. Per domain controller, get all user DN’s and their lastLogon attribute (conversion in UMRA on-the-fly to readable date/time
3. Add all results to 1 big table
4. Have UMRA process the big table and filter out all duplicates based on latest lastLogon per DN

If you are worried about performance and/or domain controller impact, don’t be. UMRA only does 1 table query per domain controller and all other processing is handled internally.