How to Detect Every Active Directory User’s Last Logon Date

In Windows Server 2003 Microsoft introduced the lastLogontimeStamp attribute. Administrators can use the lastLogontimeStamp attribute to determine if a user or computer account has recently logged onto the domain. Using this information administrators can then review the accounts identified and determine if they are still needed and take appropriate action.

AD stores a user’s last logon time in the Last-Logon user object attribute. Like the logging of account logon events, The last logon time is updated only in the AD instance of the domain controller (DC) that actually authenticated the user and is not replicated.The authentication process is totally depend upon on your AD design. How we can redirect the users to particular domain controller for authentication.

Information about user’s last logon date in Active Directory may be very helpful in detecting inactive accounts. Knowing that IT admins can prevent unauthorized attempts to log in to IT systems thus minimizing risk of a security breach by disabling accounts not used.

Every time a user logs on, the logon time is stamped into the “Last-Logon-Timestamp” attribute by the domain controller.

Last logon time reports are essential to understanding what your users are doing

Detecting Last Logon Time with PowerShell

Start Windows PowerShell through the Start Menu or by using “Run”. You can also type “PowerShell” in the Start Menu search and press “Enter”.

Copy and run the following script to generate last logon reports on the command screen:

$Path = ‘C:\Temp\LastLogon.csv’
Get-ADUser -Filter {enabled -eq $true} -Properties LastLogonTimeStamp |

Select-Object Name,@{Name=”Stamp”; Expression={[DateTime]::FromFileTime($_.lastLogonTimestamp).ToString(‘yyyy-MM-dd_hh:mm:ss’)}} | Export-Csv -Path $Path –notypeinformation

Last Logon Script

Once script executed output file will store in Temp folder under C drive or you can also change the output file as per your requirement.

Last logon Script Output

Go to C\Temp folder and Open the CSV file-

Last Logon for enabled users

You can also check the last logon time for particular user as well by attribute editor.

Last Logon of Mark user

This is how we can get the last logon time stamp for all enabled users in csv format as well checked for particular user via attribute editor.

Guys please don’t forget to like and share the post. You can also share the feedback on below windows techno email id.

If you have any questions feel free to contact us on also follow us on facebook@windowstechno to get updates about new blog posts.

How useful was this post?

Click on a star to rate it!