Query all DCs for last PC Logon work?

[Guest]

Not sure where I'm going wrong - if I try to query all DCs, the export returns blank

I selected the computers in Hyena, then go to Export Pro for the dump

I go to Export Properties, check 'Computers', change Object Type Filter to 'User' so I can set the 'Enable User information from all Domain Computers'

I have the default query attributes, plus the Last Logon field from 'User' Attribute category.

Anyone know if its even necessary to query all DCs for accurate computer logon?

[cmccullough]

Re: Query all DCs for last PC Logon work?

Are you trying to get the last time the computer account authenticated? If so, it sounds like you have it set correctly except that you need to change the Object Type Filter back to Computers.

[Guest]

Re: Query all DCs for last PC Logon work?

Thanks for your reply!

Yes that is exactly what I'm trying to get, last time an authenticated user logged onto the domain with that PC.

When I change the filter back to 'Computers', the report runs but it does not query all DCs - is this necessary for accuracy or only for users?

[cmccullough]

Re: Query all DCs for last PC Logon work?

Where you made the last change you should have a Set Options button. Click that and check the box to Enable exporting computer information from all domain controllers, and run the export again.

Keep in mind that this is not telling you the last time a user logged on from that computer. It is telling you the last time the computer account itself authenticated with the domain. It is one of the better indicators of what computers are no longer in use.

[Guest]

Re: Query all DCs for last PC Logon work?

Thanks!

I must have had an older version - the option for to check all DCs was not there. Just upgraded to 7.0 and all is well. Awesome!

[Guest]

Re: Query all DCs for last PC Logon work?

some computers returned 'NEVER' as result - does that mean there's no record in our DCs of them being logged in?

[cmccullough]

Re: Query all DCs for last PC Logon work?

Yes, I believe that is what it is indicating. The next step would be to ping those computers, and whatever else to make sure they don't exist.