1

We have a user whose account has been disabled in AD. But we see that the lastlogontimestamp attribute is still getting updated in Active Directory for that user. It is not known where this is happening so SharePoint is catch-all "culprit" when things go wrong in the organisation.

Does SharePoint update or modify the lastlogontimestamp in Active Directory?

1

SharePoint doesn't update that value consistently (it does when IE is used but not with other browsers). Have a look at this thread:

https://social.technet.microsoft.com/Forums/en-US/b44b1292-2047-4e43-8b29-2acf0d2169ef/active-directory-lastlogondate-not-updating-when-accessing-sharepoint-via-firefox-or-chrome?forum=sharepointgeneral

REF: https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/

https://social.technet.microsoft.com/wiki/contents/articles/22461.understanding-the-ad-account-attributes-lastlogon-lastlogontimestamp-and-lastlogondate.aspx

  • would it update if the account was being used for an existing alert or subscription in SharePoint that is still firing after their account is disabled? (i.e. the account still exists in SharePoint user profile database) – motionpotion Oct 8 at 8:20
  • I don' think so but I am not sure. Best to check if the logon is occurring on that machine would be to review the security log in event viewer (probably using logParser as manual check would be very tedious ) – Marek Sarad Oct 8 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.