Tweet
I have run an export on an NT4 domain and noticed that in a lot of cases the lastlogoff is earlier than the last logon. Can you explain why this might be?
-
-
Re: Lastlogoff
LastLogoff doesn't appear to be tracked very well, and in most cases not at all, in Windows.
In your case, since you are seeing data later than your last logon dates, I would assume you aren't getting a "true" last logon.
You can verify this on a single user by right-clicking and choosing View Logon Information, then clicking the Check All Domain Controllers button. You should see that each of your domain controllers has different information, and if you look at the most recent entry, it should be earlier than what you are seeing in your LastLogoff field.
To run this for all users, you can use Exporter Pro. The Windows NT/Local User export has an option to check all domain controllers.
Comment