Last Logon Time Stamp = NEVER

[Guest]

Hi Administrator,

I've Hyena's license, but I'm using DumpSec v2.8.6 to export lastlogon user information from all my DCs.
The checkbox "true lastlogon time" is checked but some users shows NEVER in the last logon time field, and through Hyena v7.1 also shows this information, and is not true because in AD shows the information up to date.

Thanks in advance.

Andre Martins

[cmccullough]

Re: Last Logon Time Stamp = NEVER

Can you send screenshots and more information on this to [email protected]?

[Guest]

Re: Last Logon Time Stamp = NEVER

As requested I've sent the e-mail.

[cmccullough]

Re: Last Logon Time Stamp = NEVER

For some reason my email to you bounced, so I'll paste it here.

Last Logon Time Stamp is a different field from Last Logon. It doesn't have the problem that the Last Logon field has in that since it's in AD you don't have to check all domain controllers.

In Hyena you can view this too by adding Last Logon Time Stamp to a user query. Go to File->Manage Object View->AD Queries, click on Users(Summary), then in the lower right find and add LastLogonTimeStamp. Close that dialog, the double-click on the All Users object in Hyena for your domain. This will display all users for the domain and you should see a new column with the LastLogonTimeStamp data.

[Guest]

Re: Last Logon Time Stamp = NEVER

I understood, but why some users shows the information 'NEVER' in Hyena and DumpSec and the AD not?

[cmccullough]

Re: Last Logon Time Stamp = NEVER

That is the data that is in that field in AD. You need to compare apples to apples. When you look at ADU&C, you are looking at the LastLogonTimeStamp field. Add that field to Hyena and compare the data. What you are seeing in ADU&C is not the Last Logon field.

[cmccullough]

Re: Last Logon Time Stamp = NEVER

One other thing to try is to right-click on this same user and choose Query Active Directory->View All Directory Attributes. Find Last Logon in in the fields returned and let us know the value there.