Get-ADUser lastLogonTimestamp is reporting blank

Question

Hey guys,
I'm simply looking to get a list of users and their last login, in it's simplest form I'm trying this:
Get-ADUser -filter * -searchbase 'CN=Users,DC=domain,DC=com,DC=au' -Properties name,lastLogonTimestamp | select name,lastLogonTimestamp | out-gridview
Which works in a way, the problem is that most of the 'lastLoginTimestamp' properties are empty. If I go through AD Explorer (from SysInternals) there is definitely a value in that property.  Even if I test with my own user name that logs in every day
it returns blank.
If they were all blank I would look at a problem in the script, but some of them DO return the correct value.
Is there something I'm missing?

Answer 1

Hi,
Please take a look at following links about lastlogon and lastlogontimestamp attributes.
http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx
http://social.technet.microsoft.com/Forums/windowsserver/en-US/1ae08081-dcfe-44cd-bc3b-f5ac26d53f76/difference-between-lastlogon-and-lastlogontimestamp
Please also try with following examples:
To collect user's lastlogon attribute across ALL DCs in domain: (Some user may have different last logon value on different DCs)
foreach ($dc in (Get-ADDomainController -Filter "domain -eq '$((Get-ADDomain).DnsRoot)'" | % { $_.HostName} ) ) { Get-ADUser -Filter '*' -searchbase 'CN=Users,DC=domain,DC=com,DC=au' -Server $dc -Properties LastLogon | Select SamAccountName, LastLogon, @{n='LastLogonDC'; e={ $dc }} }
To collect users' latest lastlogon attribute:
$( foreach ($dc in (Get-ADDomainController -Filter "domain -eq '$((Get-ADDomain).DnsRoot)'" | % { $_.HostName} ) ) { Get-ADUser -Filter '*' -searchbase 'CN=Users,DC=domain,DC=com,DC=au' -Server $dc -Properties LastLogon | Select SamAccountName, LastLogon, @{n='LastLogonDC'; e={ $dc }} } ) | Group SamAccountName | % { ($_.Group | sort lastLogon -Descending)[0] } | select SamAccountName, lastlogon,@{n='LastLogon1'; e={ (Get-Date $_.LastLogon).ToLocalTime() }}, LastLogonDC
You can pipe the above code with Export-CSV or grid view.
Without using AD module:
$adSearcher = [adsisearcher]""
$adSearcher.Filter = '(&(objectClass=user)(objectCategory=person))'
$adSearcher.PageSize = 1000
$adSearcher.PropertiesToLoad.Add('LastLogon')
$adSearcher.PropertiesToLoad.Add('SamAccountName')
$( foreach ( $dc in ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).DomainControllers ) { $adSearcher.SearchRoot = 'LDAP://'+$dc.name; $adSearcher.FindAll() | select @{n='SamAccountName'; e={ $_.properties.samaccountname}}, @{n='LastLogonDC'; e= { $dc.name}}, @{n='LastLogon'; e={ $_.properties.lastlogon}} } ) | Group SamAccountName | % { ($_.Group | sort lastLogon -Descending)[0] } | select SamAccountName, LastLogon, @{n='LastLogon1'; e={ (Get-Date $_.LastLogon).ToLocalTime() }}, LastLogonDC
rgds,
AZ