Windows Forum

Ask something
Discussion Locked

Issues checking last logon of remote user

0 helpful
6 replies

by caestelle 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When I use the following command to check the last logon time for our remote users, I get very inconsistent results:

net user username /DOMAIN | find /I "Last Logon"

For example, I checked a user on Friday and it showed that he had logged in on Friday(3-18-04)which I know was correct. Now if I check that same user today, it shows his last logon was 11-8-2004. We have noticed similar inconsistencies with other remote users as well, so it is not isolated to this one user.

Any ideas as to why this occurring???

We are a Windows 2000 domain with A.D.

6 replies

by caestelle

I was just able to replicate this when checking last logon of an onsite user. We had checked several earlier and they were correct and we just checked one that logged on at 7:00a this morning and it says he has not logged on since 3/10/2005.

by bfilmfan

That is an old issue that has been hanging about since the Windows NT domains. That command string checks the PDC emulator for the domain and generates the report.

If the user authenticated to a different domain controller, then the report is simply wrong.

I believe this script will resolve the issue for you, but I'd recommend saving the results into a CSV so that you can run a filter on it if you happen to use Excel:

http://www.jsifaq.com/SUBC/tip1200/rh1276.htm

by caestelle

BFilmFan,
I believe that script is for strictly NT. When I attempt to run it I get any error stating that usrstat is not recognized as an internal or external command, operable program or batch file. Also, this doesn't seem address this issue. I think it would, if I could never see the appropriate logon data/time, but it is hit or miss. As I said in the original post I checked a user on Friday and it showed that he had logged in on Friday(3-18-04)which I know was correct. Now if I check that same user today, it shows his last logon was 11-8-2004. We have noticed similar inconsistencies with other remote users as well, so it is not isolated to this one user. Thanks for help!!

by caestelle

We have come to conclusion that we have some issues with our DCs. We can execute the command and it work fine one minute and then we execute it again and get bogus results. We are getting ready to replace our DCs with news servers and we are going to try and take care of it then.

This discussion is closed to new replies.