Sunday, May 11, 2008

Date of user's last logon

Here is a little script which will give you the date of a user last logon. But first, I will thell you some things which will introduce you in the background of this problem.
Windows 2000 domain controllers save last logon date in the "lastlogon" attribute. This attribute is NOT replicated among all domain controllers in the domain and is listed in a wired format such as 12327435289, which means the number of 100 nanosecond intervals which have elapsed since 1/1/1601. So, if you have a domain level of Windows 2000, the following script is the way to do it. The script interogates a specific DC and return the value from this.
Windows 2003 domain controllers save last logon date in the "lastlogonTimestamp" attribute. This attribute IS replicated among all domain controllers in the domain.

Option Explicit
Dim objOU, objUser, objRootDSE, objLastLogon
Dim Container, Domain
Dim intLastLogonTime
Dim location
Container = "OU=Sales, " //Put here the desired OU
Domain = "DC=test,DC=com" //Put here your domain
location= Container & Domain
wscript.echo location
location = Container & Domain
set objOU =GetObject("LDAP://Desired DC to interogate/ " & Container & Domain)
For Each objUser In objOUSet
objLastLogon = objUser.Get("lastLogon")
intLastLogonTime = objLastLogon.HighPart * (2^32) + objLastLogon.LowPart
intLastLogonTime = intLastLogonTime / (60 * 10000000)
intLastLogonTime = intLastLogonTime / 1440
Wscript.Echo objUser.Name & " last logon time: " _
& intLastLogonTime + #1/1/1601#
Next
WScript.Quit

No comments: