Report on a user account last authenticated with AD

[Guest]

Hi

Please can someone tell me on how i can do a query all user accounts and see when the accounts were last authenticated against AD

many thanks

Tony

[cmccullough]

Re: Report on a user account last authenticated with AD

Is Last Logon what you are looking for? If so, it is best to use Exporter Pro for this because it can check all domain controllers, whereas Hyena will only look at one controller. Last Logon is stored locally on each domain controller and not part of the data that gets replicated between them.

Click on your domain in Hyena to select it, then go to Tools->Exporter Pro->Export Selected Objects. Click the Settings button, then double-click on Detailed Users under Active Directory. Check the box to enable it and enter an output filename. Click the button for Set Options and check the box to export information from all domain controllers. Also make sure Last Logon is listed in the window as one of the fields to export.

Run that export and when finished you can open the output file with Excel.

[Guest]

Re: Report on a user account last authenticated with AD

HI

Its not the last logon but the last time the user account authenticate with AD.

Eg we have ad accounts that are used for starting scripts on servers, they dont logon to the domain but authenticate with AD before running the script. Im after finding out that information.

many thanks

Tony

[cmccullough]

Re: Report on a user account last authenticated with AD

Unfortunately we don't know of a way to get that information. You might be able to see if anything is logged in the event logs on your controllers when they authenticate. If you can identify an event you can filter for that using Hyena's Filter Events feature.

[kstanush]

Re: Report on a user account last authenticated with AD

I'm not sure if this is not counted as a logon. What I would do as a test is to set up an account that is just used in one script, then run that script. Then, use the View Logon Information function in Hyena to show all of the logons for that account to see if it appears. Do not use lastlogontimestamp, as it won't reflect this type of logon traffic.