AD: How to Determine the Last Logon time of users

I don't think there's a really good short answer to this one, as your ability to determine last logon times really depends on the AD level that you're at.

For information on the below attributes (and more), check here.

Pre-2003 AD: You can't do it.
2003 AD: Look at the lastlogon attribute on all DCs.
2003 AD functional level: Look at the last-logon-timestamp
2008: Check the msDS-LastSuccessfulInteractiveLogonTime

If you're not at 2008, or 2003 domain functional level, and you want to determine the last logon time, you can use AD-FIND to query each DC, get the time stamp in the nt time epoch format (the time measured in seconds since 1/1/1601) and then use w32tm /ntte to convert the stamp into a readable format... Date, Hour:min:second.

adfind -h DC1:389 -b dc=domain, dc=local -f "objectcategory=person" lastlogon >DC1.txt

adfind -h DC2:389 -b dc=domain, dc=local -f "objectcategory=person" lastlogon >DC2.txt

... and so on for each DC.

To convert lastlogon time, take the time stamps for the user's that you're interested in and convert them...

w32tm /ntte value1
w32tm /ntte value2

... and so on.

Then you can compare each. At 2003 functional level the attribute lastlogontimestamp is replicated to each DC - so it's a single source of truth. In 2008 it gets even better with last logons, last failed logons, and more. With some diligence, you can probably take the above steps do some further learning around them to improve things a bit, and then script the the logic. But for one-offs, and small networks this works.

KB: Introduction to Windows Time

"Explain time synchronization on a Windows Server 2003 network."

Time synchronization is an essential component to Kerberos authentication, and by extension Active Directory authentication. The Windows Time Service (W32Time) is responsible for ensuring that all Windows 2000 or later computers share a common time. W32Time runs on UDP port 123.

Time synchronization occurs based on domain hierarchy, such that all desktop computers and member servers nominate their authenticating DC as their in-bound partner. All DCs in turn rely on the PDC operations master, which in turn follows the hierarchy of domains, with the PDC operations master at the root of the forest being authoritative for the organization. Either the system clock, or a specified external source (such as a GPS receiver, or an internet-based time source) can provide a highly accurate seed for the authoritative time source.

The Windows Time Service relies on the NTP protocol to arbitrate time synchronization between partners. NTP packets contain time stamps that include a time sample from both the client and the server involved in synchronization. NTP protocol algorithms then determine and elect the best time sample, and adjust the system clock.

The Windows Time Service relies on standard domain security features. When a computer requests the time from a DC, W32Time requires that the time be authenticated with the session key from the netlogon service. If the packet is not signed correctly, the time is rejected and the authentication failure logged to the event viewer.

In general, XP and 2003 clients automatically obtain accurate time from their authenticating DCs in the same domain.

Click here for a more comprehensive technical reference.

WMI: Timezone and daylight savings check

I recently had a customer ask about checking time zone information on client workstations. After digging around Group Policy to see if there way any direct way to force the requested behavior on an OU, I came to the conclusion that a script might be the easiest way to find out if any workstations have the wrong time zone settings.

Specifically, I’m talking about the “Automatically adjust clock for daylight saving changes” box under “Date and Time Properties”, and determining if it’s unchecked. This type of issue tends to start out with individuals reporting something to the effect of... “Outlook calendars are an hour off”, or “when I view someone else’s Calendar, scheduled items run into the next day”.

Now, let me preface this post by saying that I’m not really a WMI expert like the guys over at the Microsoft’s script center. But I can hack together enough code to get the job done. In this case, the script will run against all computers in Active Directory, but you can easily modify it to work against an OU, or from a list of workstations. You’ll also want to make sure to specify the organization appropriate LDAP path in the select statement if you want to use what I already have .

And hey, this is the first time I've posted any code on this blog, so it might come out looking a little funny - when I copied and pasted from one of my scripts, I had to mess with formatting on just about every line.

On Error Resume Next
Const ADS_SCOPE_SUBTREE = 2
Const MegabyteConversion = 1048576
Const Warning_Threshold = 1000
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADSDSOObject"
ObjConnection.Open "Active Directory Provider"

Set objCommand.ActiveConnection = objConnectionobjCommand.Commandtext = _
"Select Name from 'LDAP://dc=organization, dc=local' " _
& "Where objectClass='computer'"
objCommand.Properties("Page Size") = 1000obj
Command.Properties("Searchscope") = ADS_SCOPE_SUBTREE
Set objRecordSet = objCommand.ExecuteobjRecordSet.MoveFirst

Do until objRecordSet.EOF
Computer = objRecordSet.Fields("Name").Value
Set objWMIService = GetObject("winmgmts:\\" & Computer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48) If Err.number <> 0
then 'Wscript.Echo Computer & ", " & Err.Description

'Err.clear Resets the error code
'UnavailableSystems = UnavailableSystems &amp; "," & " " & Computer
UnavailableSystems = Computer & ", " & UnavailableSystems
Err.Clear
else

For Each objItem in colItems wscript.Echo "IP Address: " & Computer
Wscript.Echo "Caption: " & objItem.Caption
'CurrentTimeZone: Amount of time the comptuer is offset from UTC
Wscript.Echo "CurrentTimeZone: " & objItem.CurrentTimeZone
'DaylightInEffect: Boolean, if true then daylight savings mode is on.
Wscript.Echo "DaylightInEffect: " & objItem.DaylightInEffect
If objItem.DaylightInEffect = True Then
dltrue = dltrue + Computer & " "
Else
End If

Wscript.Echo "DomainRole: " & objItem.DomainRole
Wscript.Echo "UserName: " & objItem.UserName
Wscript.Echo " "
Next
End If
Err.Clear
objRecordSet.MoveNext
Loop
Wscript.Echo "Unavailable Systems: " & UnavailableSystems
Wscript.Echo "Daylight savings=True: " & dltrue
Wscript.Echo "Finished..."