Sunday, January 22, 2006

Calculate the Last Logon Time in Windows 2003

There is a nice article in technet website about calculating the Last Logon Time in Windows 2003 Active Directory.
Here the script:

Set objUser = GetObject("LDAP://cn=Ken Myer, ou=Finance, dc=fabrikam, dc=com")
Set objLastLogon = objUser.Get("lastLogonTimestamp")
intLastLogonTime = objLastLogon.HighPart * (2^32) + objLastLogon.LowPart

intLastLogonTime = intLastLogonTime / (60 * 10000000)
intLastLogonTime = intLastLogonTime / 1440
Wscript.Echo "Last logon time: " & intLastLogonTime + #1/1/1601#


We must know few catches around it:
- lastLogonTimestamp attribute in Win 2003 keeps track of the last time a user logged on to the domain, and also replicated from one domain controller to another.
- lastLogonTimestamp is replicated only once every 14 days. This helps limit replication traffic, although it also means that the lastLogonTimestamp for any given user could be off by as much as 14 days.

More information at http://www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx

No comments: