How do I get the "Last Logoff" field to populate?

[Guest]

In my detailed user view, I can not get the "Last Logoff" field to populate. Is there an audit setting that I need to set for the domain to make this happen?

[cmccullough]

Re: How do I get the "Last Logoff" field to populate?

It is not very clear in Microsoft documentation as to whether or not Last Logoff is accurately maintained and reported.

The only idea on how you could get this kind of information would be to turn on auditing (logon/logoff), which would capture those messages to the event log. You can then use an event reporting tool to filter for those events.

[Guest]

Re: How do I get the "Last Logoff" field to populate?

Thanks for the quick response. I have turned on success/failure of logon/logoff for the DCs audit policies. We previously had only failures turned on. I will monitor over the next few days and see what happens.

[Guest]

Re: How do I get the "Last Logoff" field to populate?

It seems to not have made any difference. Not sure how to populate this field. If anyone figures it out, please post a reply here. Thanks.

[cmccullough]

Re: How do I get the "Last Logoff" field to populate?

I'm sorry, I guess I didn't make that last post clear enough. What I meant was that by enabling auditing you will get entries in your event logs that you can then search for.

This will not populate that field in the user record. The reason being as I mentioned above.

Now that you've been running this for awhile with these audit settings, go to the event logs of your server and search for logon/logoff events.

[Guest]

Re: How do I get the "Last Logoff" field to populate?

Thanks, but I am not interested in finding that information via event logs. I was hoping that Microsoft had finally made it easy, like Novell does, for admins to find the information near where one would manage it...at the user object. I detest the fact that I have to install many, many third party applications to get Microsoft's NOS to do what Novell's does out of the box. Not blaming you guys of course, you didn't make the schema, but Microsoft is failing to populate it.