If you want to see the date and time a user last accessed Active Directory, continue reading this guide. In this guide, there are two ways to determine the last login time of an Active Directory user. Every time an AD user logs into Active Directory from any workstation, the system records the date and time of the login in the attributes: lastLogon & lastLogonTimestamp. The most obvious attribute of the two is this last entry, represents the most recent login verified by a specific domain controller. *
*Note: The lastLogonTimestamp attribute “holds” the time the user last logged in to the domain and its value is repeated for all domain controllers, but only if it is 14 days or older than the domain. lastLogon value. The lastLogonTimestamp only enough to identify outdated accounts.
How to find the last logon time for a user in Active Directory. (Server 2016/2012)
Method 1. View the last login time from the Windows GUI.
Method 2. View the last login time from PowerShell
Method 1. Find the last login time from the Windows GUI.
To find out when a user was last logged into Active Directory, perform the following task on each domain controller:
1. It’s open Active Directory Users and Computers
2. From whom Appearance menu, press Advanced features.
3. select Users group in the left panel.
4. In the right pane, right-click and select the user whose last login time you want to view Characteristics.
5. In the User Properties window, select Attribute editor Tab.
6. Now scroll down lastLogon attribute to find out when the user last accessed active directory. *
1. If you have multiple DCs, you need to perform the above steps on all DCs to find out the user’s last login date and time.
2. If you want to find the last logon date and time for a legacy account, look at “lastLogonTimestamp”.
Method 2. View the last login time from PowerShell.
To see the user’s last login time from PowerShell:
1. It’s open PowerShell as administrator and issue this command:
* For example: To find out the last login date/time of AD user “User1”, type:
2. As you can see, after executing the above command, the “LastLogon” attribute will show a numerical value (for example, “132279814667281827” in this example).
To convert the “LastLogon” value to a known date and time, issue this command in PowerShell:
* For example, in this example, the value of the “LastLogon” attribute is “132279814667281827”. So the command would be:
Additional help: To find out the last login time for the old account, issue this command in PowerShell:
That’s it! Let me know if this guide helped you by leaving a comment about your experience. Please like and share this guide to help others.