Computer last logon date

[Guest]

From Computer Properties and the object tab there is a field for last logon. I would like to pull a report or filter this info for a select range of computer names. I am wanting to find out when the last time some of my computers loged on so I can clean the bad accounts

[cmccullough]

Re: Computer last logon date

If you right-click on Computers and choose Tabular Views->Computer(Detailed) you can run a query that gives more details. For finding dead computer accounts we typically recommend the Pwd Last Set field.

You can add Last Logon to this query if you like so you can view that data as well. If you need instructions for this let us know.

[Guest]

Re: Computer last logon date

Yes, please post instructions, TIA!

[cmccullough]

Re: Computer last logon date

Go to File->Manage Object View->AD Queries, change the Query Type to Computers, then click on Computer(Detailed). Change the Attribute Category to User Attributes, then in the window below find Last Logon. Click on it then click the button to add it to the left window.

Click OK to save this change and run the query again.

[Guest]

Re: Computer last logon date

What is the difference between Pwd Last Set and Last Logon?

[Guest]

Re: Computer last logon date

The PwdLastSet is the last time the computer object itself contacted a domain controller and reset it's own password.

The LastLogon is the last time the computer was restarted and contacted the domain to inform the domain controller it's online.

Dead computers can be identified by PwdLastSet dates older than 90 days (30 if in a full, native AD environment).

Hope this helps!

Joel

[Guest]

Re: Computer last logon date

I have a question on this.

When a user logs in the lastlogon timestamp only changes on the DC authenticating the user, and this information is not replicated. What about the password change date for a comnputer account? To simplify, if I run a report on the last password change date for a computer object, is it going to be accurate, or will it only tell me the last date that the computer changed it's password on that particular domain controller? Thanks!

[This message has been edited by jnisme (edited 08-17-2005).]