FBA with Custom login page.

Users are authenticated through default LDAPMembership provider. In AD "LastLogOn" property is not always updated.

What is the correct way to get actual last LogOn date for the current user?


lastLogon is for interactive logons, not network logons. In addition, lastLogon is only processed against the Domain Controller that the user was authenticated against.

Take a look at http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx for further information about the other attribute commonly used, lastLogonTimestamp, which is replicated between Domain Controllers, but has a randomness introduced for updates.

| improve this answer | |
  • lastLogonTimestamp does not seem to be reliable in order to track the exact time the user has successfully logged in. – Milen Jan 29 '14 at 10:43
  • But lastLogon isn't either, as the property isn't replicated in the domain. – Trevor Seward Jan 29 '14 at 16:16
  • Indeed none of the OOTB fields provided the information required in such scenario. Therefor the only other option is to create a new AD property to store this information. – Milen Jan 29 '14 at 16:39

The solution which worked well in this scenario was to create a custom AD attribute and use it to store/retrieve exact login time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.