Information from all Domain Controllers

[Guest]

I created a custom query to gather the last login activity for users.

However, we have 3 domain controllers. The query is gathering specific information from the single DC.

How do I modify this or create a report that will query all 3 DC's and report back?

[cmccullough]

Re: Information from all Domain Controllers

To get last logon information from your users, it is best to use Exporter Pro for this because it can check all domain controllers, whereas Hyena will only look at one controller.

Click on your domain in Hyena to select it, then go to Tools->Exporter Pro->Export Selected Objects. Click the Settings button, then double-click on Detailed Users under Active Directory. Check the box to enable it and enter an output filename. Click the button for Set Options and check the box to export information from all domain controllers. Also make sure Last Logon is listed in the window as one of the fields to export.

Run that export and when finished you can open the output file with Excel.

[Guest]

Re: Information from all Domain Controllers

That works. Thanks.

[pprasad]

Lost Logon from All domain Controllers: Time Stamp

What is the difference of Last Logon , and last Logon time stamp
We have a user for which the last logon in the exporter output, and the manual check of all domain controllers states as 10/20/2011 11:45:48 AM
But the UI from Hyena states lastlogon time stamp as 2/12/2012 2:43:10 AM
How can i get the lastlogon time stamp in the exporter.
Thanks
Pradeep

[cmccullough]

LastLogonTimeStamp is a part of Active Directory whereas LastLogon is local to each domain controller. With Last Logon you have to query each domain controller to find the most recent logon time. You don't have to do that with LastLogonTimeStamp.

You can add LastLogonTimeStamp to Exporter Pro's user queries, such as Detailed User. It might not be one of the default attributes, so you can enter that in the Other field to add it.

[missioncritical]

For a good article on LastLogonTimestamp, visit:

http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

This explains how it works better than I can.

[pprasad]

Thanks a lot for the information on lastlogon with exporter pro, can i run this as a scheduled job daily

[cmccullough]

Yes, you can execute Exporter Pro from the command line by using the following syntax:
stexport.exe /CONFIG=Path\Configuration_File_Name.INI

Once that is working the way you want, you can then schedule it with Task Scheduler.

[pprasad]

How do I provide the information on which domain to access
i.e prepare the .dat file
I can modify the .ini file but i am unable to generate the .dat file
ObjectFile=

[cmccullough]

The easiest way is to add the domain to the Object List in Exporter Pro. Run Exporter Pro, open the configuration you are using for this and then click Edit->New Object. Add a Windows 2000/2003/2008 Domain object.

[Trammel]

Isn't this a moot point now that Microsoft added the new lastlogontimestamp attribute in AD which IS replicated to all domain controllers? I suppose if you were still running a Windows 2000 forest this would be valid.

http://msdn.microsoft.com/en-us/library/windows/desktop/ms676824(v=vs.85).aspx