Geeks With Blogs
The Life and Times of a Dev Yes, we're really that weird

I needed to clean out a bunch of old accounts at Veracity Solutions, and wanted to delete those that hadn’t used their account in more than a year.

I found that AD has a property on objects called the lastLogonTimestamp.  However, this value isn’t exposed to you in any useful fashion.  Sure, you can pull up ADSI Edit and and eventually get to it there, but it’s painful.

I spent some time searching, and discovered that there’s not much out there to help, so I thought a blog post showing exactly how to get at this information would be in order.

Basically, what you end up doing is using System.DirectoryServices to search for accounts and then filtering those for users, doing some conversion and such to make it happen.  Basically, the end result of this is that you get a list of users with their logon information and you can then do with that what you will.  I turned my list into an observable collection and bound it into a XAML form.

One important note, you need to add a reference to ActiveDs Type Library in the COM section of the world in references to get to LargeInteger.

Here’s the class:

namespace Veracity.Utilities
{
    using System;
    using System.Collections.Generic;
    using System.DirectoryServices;

    using ActiveDs;

    using log4net;

    /// <summary>
    /// Finds users inside of the active directory system.
    /// </summary>
    public class UserFinder
    {
        /// <summary>
        ///   Creates the default logger
        /// </summary>
        private static readonly ILog log = LogManager.GetLogger(typeof(UserFinder));

        /// <summary>
        /// Finds last logon information
        /// </summary>
        /// <param name="domain">The domain to search.</param>
        /// <param name="userName">The username for the query.</param>
        /// <param name="password">The password for the query.</param>
        /// <returns>A list of users with their last logon information.</returns>
        public IList<UserLoginInformation> GetLastLogonInformation(string domain, string userName, string password)
        {
            IList<UserLoginInformation> result = new List<UserLoginInformation>();

            DirectoryEntry entry = new DirectoryEntry(domain, userName, password, AuthenticationTypes.Secure);
            DirectorySearcher directorySearcher = new DirectorySearcher(entry);
            directorySearcher.PropertyNamesOnly = true;
            directorySearcher.PropertiesToLoad.Add("name");
            directorySearcher.PropertiesToLoad.Add("lastLogonTimeStamp");
            SearchResultCollection searchResults;
            try
            {
                searchResults = directorySearcher.FindAll();
            }
            catch (System.Exception ex)
            {
                log.Error("Failed to do a find all.", ex);
                throw;
            }

            try
            {
                foreach (SearchResult searchResult in searchResults)
                {
                    DirectoryEntry resultEntry = searchResult.GetDirectoryEntry();
                    if (resultEntry.SchemaClassName == "user")
                    {
                        UserLoginInformation logon = new UserLoginInformation();
                        logon.Name = resultEntry.Name;

                        PropertyValueCollection timeStampObject = resultEntry.Properties["lastLogonTimeStamp"];
                        if (timeStampObject.Count > 0)
                        {
                            IADsLargeInteger logonTimeStamp = (IADsLargeInteger)timeStampObject[0];
                            long lastLogon =
                                (long)((uint)logonTimeStamp.LowPart + (((long)logonTimeStamp.HighPart) << 32));

                            logon.LastLogonTime = DateTime.FromFileTime(lastLogon);
                        }

                        result.Add(logon);
                    }
                }
            }
            catch (System.Exception ex)
            {
                log.Error("Failed to iterate search results.", ex);
                throw;
            }

            return result;
        }
    }
}

Some important things to note:

You’re actually getting a com object back, so that’s why the LongInteger conversions are happening.  The class for UserLoginInformation looks like this:

 

namespace Veracity.Utilities
{
    using System;

    /// <summary>
    /// Represents user login information.
    /// </summary>
    public class UserLoginInformation
    {
        /// <summary>
        /// Gets or sets Name
        /// </summary>
        public string Name { get; set; }

        /// <summary>
        /// Gets or sets LastLogonTime
        /// </summary>
        public DateTime LastLogonTime { get; set; }

        /// <summary>
        /// Gets the age of the account.
        /// </summary>
        public TimeSpan AccountAge
        {
            get
            {
                TimeSpan result = TimeSpan.Zero;
                if (this.LastLogonTime != DateTime.MinValue)
                {
                    result = DateTime.Now.Subtract(this.LastLogonTime);
                }

                return result;
            }
        }
    }
}

I hope this is useful and instructive.

Technorati Tags:
Posted on Thursday, February 3, 2011 4:35 PM | Back to top


Comments on this post: Searching for the last logon of users in Active Directory

# re: Searching for the last logon of users in Active Directory
Requesting Gravatar...
For real last logon reports ,visit and try active directory reporter tool

http://www.adsysnet.com/downloads.aspx
Left by Rajesh on May 26, 2014 11:11 PM

Your comment:
 (will show your gravatar)


Copyright © Robert May | Powered by: GeeksWithBlogs.net