Desktop

Ask something
Question Locked

Active directory

0 helpful
13 replies

by invincible_amritsar

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Anyone know how to get list of computers from AD for the people who are not logged in from the last 15 days?

regards,
Ravi bhanot

13 replies

by scott_heath

You could not get a list of computers, as the computers didn't "log in". You could get a list of user objects that have not logged in though. I am not going to write it all out here, instead I shall point you to two excellent TechNet articles by the Scripting Guys, who are my personal heroes.

http://www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx

http://www.microsoft.com/technet/technetmag/issues/2006/01/ScriptingGuy/default.aspx

Good Luck!

EDITED BECAUSE MY SPELLING SUCKS!!

by Member 25348569

depends on how many DCs you have. The Last Logon Date for users or computers isn't replicated around DCs so you have to interrogate all of them and take the latest.

by Member 25348569

has the same problem as DSQUERY on that it doesn't access all of the DCs and may report incorrect results. It makes it rather a blunt tool. Our organisation used to use it but I prefer a scripted alternative that I KNOW is giving the correct result.

Neil :)

by dumphrey

on a machine logged in with domain admin rights,
cd c:\ ::get root c: prompt
dsquery user domainroot -inactive 2 > c:\inactusers.txt
:: this will query AD for users, belonging to the current domaine machie is logged into, inactive for 2 1/2 weeks or more and output to a text file. Change domainroot to forestroot to check all domains in the forest.

by Member 25348569

DSQUERY accesses the LastLogontimeStamp AD property of the user and although this IS replicated between DCs - unlike the LastLogonTime, it's replicated every couple of weeks. Rather strangely, AD chooses a random value between 10 and 14 days. This means that the value returned by DSQUERY can be up to two weeks out of date.

The only way to get an accurate Last Logon time is with a commercial tool, a script that properly interrogates AD or run DSQUERY on [b]every[/b] DC and compare the results.

Neil :)

by kjell_andorsen

That's some great info. Got any recommendations as to which tool to use?

by dumphrey

about the delay in replication on this... any way to force it to replicate more often, or on demand? Either way, thats good info.
I would gladly give you a thumb if this was my thread.

by scott_heath

An admin who appreciates scripting. I love scripting, it's just too fun. You can do almost anything with vbscript, WMI, and COM. Most people don't know it, but just about every app comes with a COM object. One can manage virtual machines, SQL servers, practically anything using vbscript.

Have you gotten into Powershell yet? It's super cool with the way you can create objects to quickly and pipe output to other commandlets. I just downloaded the Powershell 2.0 beta but haven't had time to tinker.

by scott_heath

If you increased replication on this it would be baaaaaad. Think of how many users you have and how often they might be authenticating to the DCs. If you only have a few users one wouldn't be likely to even need anything like this. In my earlier post from the Technet Scripting Guys they describe how to pull a list of DCs from AD then you just query the list of DCs and collate the data.

If you use Google you can find some good scripts to use as a starting point.

This discussion is closed to new replies.