2

Users accessing SharePoint 2010 from outside of our domain do not have the "last login" property of their Active Directory account updated. This is problematic as we are supposed to disable accounts after a certain amount of time has lapsed since the last login.

Is there a way to change this behavior? Somewhere in central admin or elsewhere?

2

People often ask about how to check the last date when a user logged on into a domain, and they very often try to get that information basing on lastLogon attribute. BUT...the lastLogon active directory attribute is not the best attribute to query for this information (IMO); you should use the lastLogontimeStamp. Microsoft's intended purpose of the lastLogontimeStamp attribute is to help identify inactive computer and user accounts; which is exactly what you're trying to do. The lastLogon attribute is not designed to provide real time logon information; and it was used in Windows Server 2003 (and earlier) environments. In 2k3 and prior, administrators had to query the lastLogon attribute on each DC to determine the most recent logon of user or computer account. This is because the lastLogon attribute is updated only on the DC that validates the logon request. The reason I suggest querying the lastLogontimeStamp attribute is because it is replicated every 9-14 days, which ensures all DC's will have the same value for the attribute (after replication obviously). This means that you can query any single DC and find all the users that have not logged in within a certain time. When quering the lastLogontimeStamp attribute, I suggest you add an additional 14 days to the date you're looking for, this ensures that the DC's will have synchronized.

This is an excelent article which should help you understand a little better what lastLogontimeStamp does.

  • lastlogon or lastlogondate is also updated when account is unlocked or password reset, so it is not completely accurate either - Microsoft needs to clean this up. this may be true of lastlogontimestamp, but I do not use it due to syncing delay across dc's. lastlogon also does not match SP activity in our environment, and I am checking all activity and all login fields on all our DC's, so reports never seem to be fully accurate. – user51000 Feb 4 '16 at 16:56
  • timestamp also has a 14 day delay in cross DC syncing (not updated if last date is 14 days or older on another dc than the one currently authenticated against – user51000 Feb 4 '16 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.