samba - Apr 2019 - How to get users last Login time

On Tue, 23 Apr 2019 17:12:37 +0200
Sven Schwedas via samba <samba at lists.samba.org> wrote:
>
https://docs.microsoft.com/en-us/windows/desktop/adschema/a-lastlogontimestamp
> 
> Works on Samba AD as on Windows and can be queried by any LDAP client
> and used in Bash/Powershell scripts. There's probably finished scripts
> somewhere you can use.
> 
Yes, you could use that attribute, but it isn't as accurate.

Rowland

>
https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/
It was literally designed for *this exact use case*.

On 23.04.19 17:35, Rowland Penny via samba wrote:
> On Tue, 23 Apr 2019 17:12:37 +0200
> Sven Schwedas via samba <samba at lists.samba.org> wrote:
> 
>>
https://docs.microsoft.com/en-us/windows/desktop/adschema/a-lastlogontimestamp
>>
>> Works on Samba AD as on Windows and can be queried by any LDAP client
>> and used in Bash/Powershell scripts. There's probably finished
scripts
>> somewhere you can use.
>>
> 
> Yes, you could use that attribute, but it isn't as accurate.
> 
> Rowland
> 
-- 
Mit freundlichen Grüßen, / Best Regards,
Sven Schwedas, Systemadministrator
✉ sven.schwedas at tao.at | ☎ +43 680 301 7167
TAO Digital   | Teil der TAO Beratungs- & Management GmbH
Lendplatz 45  | FN 213999f/Klagenfurt, FB-Gericht Villach
A8020 Graz    | https://www.tao-digital.at

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20190424/e724948e/signature.sig>

On Wed, 24 Apr 2019 11:00:39 +0200
Sven Schwedas via samba <samba at lists.samba.org> wrote:
> >
https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/
> 
> It was literally designed for *this exact use case*.
> 
Yes, but not very well ;-)

It actually says 'the lastLogontimeStamp will be 9-14 days behind the
current date.'

So what happens if a user has logged in 6 days ago and you want to
delete users that have been inactive for over 10 days ?

I know this isn't a likely scenario, but, hopefully, you take my
point, to get the correct last logon time, you need to check all DC's
for a users 'lastLogon' attribute.

Rowland