Get Last Logon Date for All Active Directory Users

this video I'm going to show you how to create a last logon report of all your active directory users this report will get the last logon date um for for all users and you can also get them for specific users or users in an OU so when a user logs in and you can view this by opening up an account and go into the attribute editor an account authenticates to the network it will update the last logon attribute it'll also update the last logon timestamp but this last logon timestamp attribute has a delay and it's not meant to be used for creating less logon reports this time this attribute is used for finding old and inactive users it was designed that way by Microsoft like I said it's got a slight delay as you can see here um this last logon is newer than this one but one of the challenges is this last logon attribute is not replicated so to get um an accurate report you would need to get this value from all your domain controllers so let's look at this in Powershell and then I'll show you an easier way to do this with this last logon report GUI tool so in Powershell you can run just run the get 80 user command and then look at all the properties and I'll show you what this looks like at Powershell so there's the last logon attribute but it's not converted into a friendly format and then there's the last log on date which is converted as you can see here but it's a conversion of the last logon timestamp so to do this in Powershell one you'd have to convert the timestamp which isn't a big deal but then you'd have to get all the users from all the domain controllers and then filter that to display the most recent logon so let me show you how to do this with the Ad Pro toolkit you just click on last logo report and you can specify a time I'll do all at all times and then I'll just click run so now I've got a logon report and I've got a bunch of users that have never locked in so the last logon timestamp is empty but you can see now I've got an accurate report of all my accounts their their most recent logon and I'll show we'll show you the most recent DC they authenticated to it also includes the last plug on logon timestamp you can click on columns and you can add other user attributes but you could then export this to a CSV Excel file or PDF and then you've got a report of all users and their last logon time and you can also use this time drop down maybe you just wanted the most recent logons for the last 90 days you can select that and click run and now it's just going to give me the most recent logons from the last 90 days and then if you wanted to you know maybe you just want to run a port for a specific OU you can click the browse button and select you know specific OU or multiple will use to run that report uh but again this tool makes it really easy because it'll do all the calculations in the background to do this in Powershell it's it's a complicated uh script but if you wanted to I'll just give you pull up the command so here's the command that will get all users the last log on date and then it'll convert that last logon attribute into formally to a friendly format so this will get that last logon attribute from a single domain controller and it's also getting the manager attribute so let me remove that I'm just going to take this manager attribute out and run it again so here's that last logon attribute with the time conversion the Powershell but again you'll have to run this on Ultimate controllers and then um figure out which one is the the light the very recent most recent for example you know this this time stamp here is from my DC One domain controller so you'd have to run this on all your domain controllers and then look at this time stamp for each user and determine which one is the most recent but again if you use this last logon report it'll do it all for you you just literally click run and it'll do all that work for you and then you can you know like I said export this to whatever format you want so that's it for this video I will put a link in the notes that you could download this tool and try it out in your own domain that's it thanks for watching

Channel: Active Directory Pro

Views: 6,933

Keywords: active directory, windows server, windows, powershell, security audit, active directory compliance

Id: cJByVLRZJLw

Length: 5min 34sec (334 seconds)

Published: Thu Jul 13 2023