Last Logon / Logoff date wrong

[Guest]

Hi,

I have to produce a detailed UserDetails
report for management.

We have noticed that the last logon / logoff
details in the report are wrong.

I know for a fact that one account did login
to the domain today, but according to the
report that account last logon time is about
2 months ago.
(This account logs into the domain on a
daily basis.)

How can I get the correct details in the
reports.
How do I know that the other details in the
reports are correct?

Thanx in advance.
Johan Roode

PS. I'm using Hyena ver 6.3 (Just downloaded and installed the update)

[cmccullough]

Re: Last Logon / Logoff date wrong

Last Logon times are stored locally on the domain controller that authenticates a logon request, and is not synchronized with the other controllers. When you view this data in the Hyena GUI you are pulling the user data from one controller only.

What you need to do is use the Exporter Pro for this because it can query all domain controllers and give you the latest date/time found for each user.

To run it by selecting your domain in Hyena, then go to Tools->Exporter Pro->Export Selected Objects. Click the Settings button, then double-click on either Windows NT/Local Users (if you are in an NT domain), or Detailed User under Active Directory. Both of those have a button that when you click it will allow you to select that you want to Enable exporting user information from all domain controllers.

After you configure this, run the export and the output file created by this process can be opened with Excel for sorting and printing.

[Guest]

Re: Last Logon / Logoff date wrong

How can you do this with computer accounts? I want it to quary all 3 DC's we have

[cmccullough]

Re: Last Logon / Logoff date wrong

There's no way to do this for computer accounts, but from what we understand, computer accounts don't have this same issue. So, the information you get from one controller would be all you need.

[Guest]

Re: Last Logon / Logoff date wrong

Ok thanks. I think you are right. The issue that brought the question up was we had computers showing up as not logged on over 90 days. We could still ping them and show the hostname as correct. We found the problem though to be in the DNS records.