FBA with Custom login page.

Users are authenticated through default LDAPMembership provider. In AD "LastLogOn" property is not always updated.

What is the correct way to get actual last LogOn date for the current user?

2 Answers 2


lastLogon is for interactive logons, not network logons. In addition, lastLogon is only processed against the Domain Controller that the user was authenticated against.

Take a look at http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx for further information about the other attribute commonly used, lastLogonTimestamp, which is replicated between Domain Controllers, but has a randomness introduced for updates.

  • lastLogonTimestamp does not seem to be reliable in order to track the exact time the user has successfully logged in.
    – Milen
    Jan 29, 2014 at 10:43
  • But lastLogon isn't either, as the property isn't replicated in the domain.
    – user6024
    Jan 29, 2014 at 16:16
  • Indeed none of the OOTB fields provided the information required in such scenario. Therefor the only other option is to create a new AD property to store this information.
    – Milen
    Jan 29, 2014 at 16:39

The solution which worked well in this scenario was to create a custom AD attribute and use it to store/retrieve exact login time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.