How to Find Users Last Logon Time in Active Directory

You might think ‘LastLogonTimestamp’ is a better choice than ‘LastLogon’ since it replicates! But is it really? Let’s break it down.

The ‘LastLogonTimestamp’ value is not updated immediately and can take up to 14 days to replicate across the domain controllers. This delay occurs because the ‘ms-DS-Logon-Time-Sync-Interval’ attribute, located in the domain's default naming context, controls its update frequency. By default, this setting is 'NOT SET,' which effectively means 14 days.

How is the replication interval calculated for LastLogonTimestamp?

Why does Active Directory delay the replication of LastLogonTimestamp?

Identifying a user's last logon computer in Active Directory is essential for IT administration, security, and troubleshooting. However, Active Directory does not store this information as a single attribute tied to a user account, so finding the specific computer requires additional effort. This involves querying the event logs in all the computers, filtering & sorting the results, and more.

Find a user’s last logon computer in Active Directory using PowerShell

You can run the following script in Active Directory to find out which computer a user is last logged into using PowerShell. To execute it, you need at least the Event Log Reader role.

$User = Read-Host "Enter the user's SAM Account Name" 
try { 
    $ADUser = Get-ADUser -Identity $User -ErrorAction Stop 
} catch { 
    Write-Host "Error: Get-ADUser : $($_.Exception.Message)" -ForegroundColor Red 
    return 
} 
$Computers = Get-ADComputer -Filter {Enabled -eq $true} -Properties OperatingSystem | Where-Object { $_.OperatingSystem -ne $null } | Select-Object -ExpandProperty Name 
$LogonEvents = @() 
foreach ($Computer in $Computers) {Computer 
    try { 
        $LogonEvent = Get-WinEvent -LogName "Security" -FilterXPath "*[System[EventID=4624] and EventData[Data[@Name='TargetUserName']='$User']]" -MaxEvents 1 -ComputerName $Computer -ErrorAction SilentlyContinue | Select-Object TimeCreated, @{Name="ComputerName"; Expression={$Computer}} 
        if ($LogonEvent) { 
            Write-Host "Successfully retrieved logon events from the computer '$Computer'" -ForegroundColor Green 
            $LogonEvents += $LogonEvent 
        } else { 
            Write-Host "No logon events were found on $Computer for the user '$User'" -ForegroundColor Yellow 
        } 
    } 
    catch { 
        Write-Warning "Failed to retrieve the logon events from the computer '$Computer' - $($_.Exception.Message)" 
    } 
} 
Write-Host "--------------------------------------" -ForegroundColor DarkGray 
$LatestLogon = $LogonEvents | Sort-Object TimeCreated -Descending | Select-Object -First 1 
if ($LatestLogon) { 
    Write-Host "The user '$User' was last logged in the computer '$($LatestLogon.ComputerName)' at $($LatestLogon.TimeCreated)" -ForegroundColor Cyan 
} else { 
    Write-Host "No logon events were found for the user '$User' on any enabled computer." -ForegroundColor Red 
}

Important considerations before running the user’s last logon computer script

Just like finding the last logon time of users helps monitor account activity during forensic investigations, checking a computer's last logon helps identify potential issues. It may indicate hardware failures, a user switching to another machine, a device failing to reach the domain, or a replacement not updated in Active Directory, among other concerns.

Check computer last logon time in active directory using ADUC

• In the Active Directory Users and Computers console, navigate to the respective containers or OUs, and locate the desired computer.
• Next, right-click on the respective computer, and choose Properties.
• Switch to the Attribute Editor tab and scroll down to find the last logon time of the computer.

Find all computers last logon date using PowerShell in Active Directory

While the ADUC console allows you to identify the last logon time of a computer in Active Directory, finding the last logon time for all computers is time-consuming as it requires navigating through each object manually. To overcome this, the PowerShell script below provides an efficient approach to listing the last logon time of all computers in AD.

Get-ADComputer -Filter * -Properties LastLogonTimestamp, LastLogon, OperatingSystem | 
Select-Object Name, OperatingSystem, DistinguishedName, Enabled, @{Name="LastLogonTimestamp"; Expression={ 
    if ($_.LastLogonTimestamp -eq $null -or $_.LastLogonTimestamp -eq 0){ 
        "Never Logged In" 
    } 
    else{ 
       [datetime]::FromFileTime($_.LastLogonTimestamp) 
    } 
}}, @{Name="LastLogon"; Expression={ 
    if ($_.LastLogon -eq $null -or $_.LastLogon -eq 0){ 
        "Never Logged In" 
    } 
    else{ 
       [datetime]::FromFileTime($_.LastLogon) 
    } 
}} | Format-Table -AutoSize 

The script retrieves multiple details for each computer, including its name, operating system, AD path, status, and last logon information such as LastLogonTimestamp & LastLogon from Active Directory.