1

After STTR's very good explanations on how to get the dates of last login of existing (including disabled) AD users and how to retrieve the list of deleted users, One question remains.

Provided that logs are preserved long enough, is it possible to obtain the date when some particular deleted user logged in to AD for the last time? How?

2
  • If you can not find the user value lastLogon (ldifde -u -x -f <fileName.txt>), then there are two ways. 1. security eventlog on the server. 2. security eventlog on the workstations and user profiles on workstations while changing NTUSER.DAT.LOG NTUSER.DAT and give information about the last input from the workstation.If possible, give the version and service pack of the server operating system. wmic os get caption, CSDVersion For different versions of OS available in different administrative tools. Additionally, what do you think the entrance? Interactive, a network, or as a job?
    – STTR
    Apr 13, 2015 at 12:47
  • As variant - RRAS and SMTP log, and proxy-server log.
    – STTR
    Apr 13, 2015 at 13:03

1 Answer 1

1

If you are running with Domain Functional Level 2008 and have Active Directory Recycle Bin enabled, this powershell command will work for accounts deleted in the last 6 months:

[datetime]::FromFileTime((Get-ADObject -Filter {SamAccountName -like "joeuser"} –IncludeDeletedObjects -prop *).lastLogonTimestamp)

Substitute the username for joeuser

1
  • I'll have to verify it someday, but I like what I see :)
    – ZygD
    Apr 22, 2015 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .