How it works?

To create a last logon report you need to inspect Active Directory user objects. User objects have attribute ‘lastLogon’ – the last time the user logged on. Its value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). For example, ‘lastLogon’ attribute value is 131358722699872122 which converts to 4/5/2017 6:24:29 AM PDT.

Attribute ‘lastLogon’ is not replicated to other domain controllers. So you need to get this attribute value from all domain controllers, compare them and choose the latest value.

There is attribute ‘lastLogonTimestamp’ which is replicated, but it does not contain the precise value of actual last logon time. ‘lastLogonTimestamp’ gets updated only if its current value is approximately 14 days older than current logon time. You can find actual algorithm and more information in this article.

How to create a precise last logon report?

For all users in domain

1. Open AD FastReporter.
2. From Users tab, select ‘All users’ report form.
3. From the available fields list, select field ‘Last Logon Time’ and add it to the selected fields list.

   

4. If needed, remove unnecessary fields from the selected fields list.
5. Press generate and wait for results.
6. If some domain controller is unreachable, then there will be a warning message.

   

7. Press ‘Show report in table view’. You can examine the report and if needed export to CSV, XLSX, HTML format file.

   

For specific user

1. Open AD FastReporter.
2. Select ‘Reports’ -> ‘New Report Form’.

   

3. Enter report form name and select Type – ‘Users’.

   

4. Press ‘Edit’ to create a custom filter. Choose the field which you want to filter and filter operation, filter value. In this example, we will use the field ‘First Name’, filter operation – ‘equals’, and filter value – ‘Adam’.

   

5. Save changes in filter manager and save this report form. Now you can use this report form to create the last logon report for the specific user.
6. Follow instructions starting from the 3. point in ‘For all users in domain’ instruction.

For specific organizational unit

1. Open AD FastReporter.
2. Open Connection manager, select your current connection and press ‘Edit’.

   

3. At the bottom, you will see ‘OU’ there you can specify which container always use in this connection. You can press the browse button and choose needed container or enter the full distinguished name of your needed container.
4. Press save when you are done and now all reports will be created for using data from this container only.
5. Follow instructions starting from the 2. point in ‘For all users in domain’ instruction.

If you need to create multiple reports from one domain, but from different containers, then you can create multiple connections.