When does the computer LastLogonTimestamp update

Question

I've read the existing questions regarding the computer LastLogonTimestamp, and cannot seem to find an exact answer to this question. Possibly it was answered and I didn't understand the answer or overlooked it.
I understand the relationship to the ms-DS-Logon-Time-Sync-Interval and that it is only going to update at minimum, when this condition (14 days plus or minus 5% by default) has been met. What I still don't understand is, once this condition has
been met, what other events will specifically update the computer LastLogonTimestamp, and/or are these events the same as the ones that will update this attribute for the
user LastLogonTimestamp?
I am not a domain admin (and no genius), but I'm being asked to pull information from AD to track down obsolete/unused computers, which I understand is exactly what this attribute is for. But I have to fully understand and explain the attribute before I
go to my boss with a report that is based on it. I've been using the PwdLastSet attribute, but he wants to report on a shorter interval so I'm trying to understand this attribute.
For instance, if a computer sits on, connected to the domain, but no user ever logs on, will it update this attribute only when the PwdLastSet attribute updates every 30 days? Or if a user is logged on and never logs off, what authentication events,
performed by the user, will update the computer LastLogonTimestamp attribute? Does a simple user logon update the computer LastLogonTimestamp? Any help you can provide would be appreciated.
It might be worth noting that we have some 8,700 computers whose PwdLastSet attribute has changed in the last 60 days, but over 14,000 computer names in AD. These computers are spread out across North America. A visual inventory is not an option.
Thanks
MikeHess2112

Answer 1

Hi,
> Are the
computer LastLogonTimestamp attribute and the
user LastLogonTimestamp attribute always
> updated at the same time by the same events and conditions?
No. The lastLogontimeStamp attribute is not updated every time a user or computer logs on to the domain. User logon may update user lastLogontimeStamp attribute, computer logon may logon computer lastLogontimeStamp attribute, there are irrelevant.
> Possibly everybody else knows that a computer logon event and a user logon event are one in the same
> thing
That’s different. For example, computer logon domain to apply computer policy, this action happens before user logon. Also computer password change is related nothing with user.
The lastLogonTimestamp attribute reflects simple bind operations and NTLM network-based logons. This behavior enables stale account cleanup in Active Directory without affecting LDAP client authentication that uses only simple bind operations.
For more information please refer to following MS articles:
List Inactive Computer Accounts in Active Directory
http://gallery.technet.microsoft.com/scriptcenter/6b8163d1-5fae-43b5-a664-a2d1f6e1e2da
Dandelions, VCR Clocks, and Last Logon Times: These Are a Few of Our Least Favorite Things
http://blogs.technet.com/b/heyscriptingguy/archive/2010/01/27/dandelions-vcr-clocks-and-last-logon-times-these-are-a-few-of-our-least-favorite-things.aspx
Last-Logon-Timestamp attribute
http://msdn.microsoft.com/en-us/library/windows/desktop/ms676824(v=vs.85).aspx
Lawrence
TechNet Community Support