Last Logon Script Not Showing Correct Time

phonysoprano · 2022-03-25T15:57:24.000Z

I created a Powershell script to get the last logon information for domain users. The script works and produces the CSV output, however, it is showing the incorrect time for all users, and it is the same time for all users.

My script:

Get-ADUser -Filter {enabled -eq $true} -Properties LastLogonTimeStamp |
Select-Object Name, @{Name="Stamp"; Expression=
{[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString('yyyy-MM-dd_hh:mm:ss')}} | export-csv -Path .\.Users-Last-Logon.csv

My timestamp for every user, including my admin account:

1600-12-31_07:00:00

Does anyone have any answers?

@Microsoft

Neally · 2022-03-25T15:59:10.000Z

If you post code, please use the ‘Insert Code’ button. Please and thank you!

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

192033ab-bb8f-4032-88a5-8e2313af0344-codebutton_small.png

Neally Bot

big-green-man · 2022-03-25T16:07:02.000Z

Do you have multiple DCs? This attribute doesn’t sync between DCs, so you’ll need to query them all and parse the data to find the actual time.

1600-12-31_07:00:00 would signify that the account hasn’t authenticated against whichever DC you’re querying, as it is “null” in timestamp format.

phonysoprano · 2022-03-25T16:07:58.000Z

There is one DC.

Neally · 2022-03-25T16:09:19.000Z

Big Green Man:

Do you have multiple DCs? This attribute doesn’t sync between DCs, so you’ll need to query them all and parse the data to find the actual time.

1600-12-31_07:00:00 would signify that the account hasn’t authenticated against whichever DC you’re querying, as it is “null” in timestamp format.

lastLogonTimestamp DOES sync. ‘LastLogon’ does not.

learn.microsoft.com

Understanding the AD Account attributes - LastLogon, LastLogonTimeStamp and...

big-green-man · 2022-03-25T16:10:25.000Z

Neally:

Big Green Man:

Do you have multiple DCs? This attribute doesn’t sync between DCs, so you’ll need to query them all and parse the data to find the actual time.

1600-12-31_07:00:00 would signify that the account hasn’t authenticated against whichever DC you’re querying, as it is “null” in timestamp format.

lastLogonTimestamp DOES sync. ‘LastLogon’ does not.

Understanding the AD Account attributes - LastLogon, LastLogonTimeStamp and LastLogonDate | Microsoft Learn

Oops. Thanks for the correction!

Neally · 2022-03-25T16:11:07.000Z

Big Green Man:

1600-12-31_07:00:00 would signify that the account hasn’t authenticated against whichever DC you’re querying, as it is “null” in timestamp format.

Correct!

That means the lastLogonTimestamp attribute is null (empty) for those accounts.
The “zero” date for LargeInteger datetime values is 12:00 am Jan. 1 1601, in UTC (Coordinated Universal Time).

So those users never logged in.

Neally · 2022-03-25T16:38:42.000Z

Also different events update different times stamps.

I usually check lastlogon AND LastLogonTimeStamp

Not ALL event cause lastlogon to update and not ALL events cause LastLogonTimeStamp to replicate (with a up to 14 days delay anyways)

Get-ADUser -Filter "enabled -eq 'true'" -Properties LastLogonTimeStamp,lastlogon |
Select-Object Name,
@{n="LastLogonTimeStamp"; e={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},
@{n="lastlogon"; e={[DateTime]::FromFileTime($_.lastlogon)}}

cd2485f1-22ae-4d1f-a54d-fb8bd63a1661-2022-03-25_10-37-33.png

big-green-man · 2022-03-25T16:41:42.000Z

Neally:

Also different events update different times stamps.

I usually check lastlogon AND LastLogonTimeStamp

Not ALL event cause lastlogon to update and not ALL events cause LastLogonTimeStamp to replicate (with a up to 14 days delay anyways)
Get-ADUser -Filter "enabled -eq 'true'" -Properties LastLogonTimeStamp,lastlogon |
Select-Object Name,
@{n="LastLogonTimeStamp"; e={[DateTime]::FromFileTime($_.lastLogonTimestamp)}},
@{n="lastlogon"; e={[DateTime]::FromFileTime($_.lastlogon)}}

Is Seymour part of your AD?

Neally · 2022-03-25T16:46:00.000Z

Big Green Man:

Is Seymour part of your AD?

Maybe…

c0f0ef54-2bc2-4b7e-ad10-778a4722f51e-2022-03-25_10-45-16.png

phonysoprano · 2022-03-25T17:41:56.000Z

I updated the script to include lastlogon. Service accounts show me the correct value, but other AD accounts still show the same. I look at the attributes individually and the attribute shows a recent logon. Why isn’t Powershell pulling these attributes correctly?

Neally · 2022-03-25T17:48:45.000Z

PhonySoprano:

I updated the script to include lastlogon. Service accounts show me the correct value, but other AD accounts still show the same. I look at the attributes individually and the attribute shows a recent logon. Why isn’t Powershell pulling these attributes correctly?

Which attributes show a recent date? Do you have a screenshot? Do you run powershell as admin?

phonysoprano · 2022-03-25T17:55:43.000Z

I have been beating my head over this. I thought I had set the script to run as admin, apparently I didn’t. That’s all it took. Thank you.