FBA with Custom login page.
Users are authenticated through default LDAPMembership provider. In AD "LastLogOn" property is not always updated.
What is the correct way to get actual last LogOn date for the current user?
2 Answers
lastLogon is for interactive logons, not network logons. In addition, lastLogon is only processed against the Domain Controller that the user was authenticated against.
Take a look at http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx for further information about the other attribute commonly used, lastLogonTimestamp, which is replicated between Domain Controllers, but has a randomness introduced for updates.
-
lastLogonTimestamp does not seem to be reliable in order to track the exact time the user has successfully logged in.– MilenCommented Jan 29, 2014 at 10:43
-
But lastLogon isn't either, as the property isn't replicated in the domain.– user6024Commented Jan 29, 2014 at 16:16
-
Indeed none of the OOTB fields provided the information required in such scenario. Therefor the only other option is to create a new AD property to store this information.– MilenCommented Jan 29, 2014 at 16:39
The solution which worked well in this scenario was to create a custom AD attribute and use it to store/retrieve exact login time.