Active directory where is a user logged in

It's worth noting that the last logon time stored on each domain controller isn't replicated between domain controllers, there are in fact two attributes that store the last logon time, one is replicated but only every 14 I think. If an accurate time is important to you I would use a third part tool that queries each domain controller we have 90! At some point an auditor will ask you how you remove old accounts, and you'll need the documentation.

Set each suspected account's password to expire and require reset upon next login. Place an asterisk in the description field of each account.

Wait a week or so, re-check your flagged accounts to see which ones still need the password reset. Disable the offenders, wait for helpdesk calls, re-enable the ones that were on vacation. Finally, I believe that if you open "Active Directory Users and Computers" and expand the AD Query tool, you can create a query that details what you're looking for. Sign up to join this community. The best answers are voted up and rise to the top.

Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams? Learn more. Ask Question. Asked 12 years, 5 months ago. Active 3 years, 4 months ago. The intuitive console gives you real-time information on user habits such as currently active and locked sessions, users with multiple sessions and connections to web applications such as Outlook Web Access.

From the console, you can interact with your users by sending a pop-up message to an open session. You can also perform daily tasks such as logging off an open or locked session. For helpdesk requests, you can easily identify where the user has an open session and remote desktop into that machine, to troubleshoot the issue.

It requires the presence of certain Events in regards to the particular server, events which are logged when you turn on Auditing and which have to be analyzed in order to get proper results. Here are some cool references, which depict each step in details:.

I am npot quite sure how exactly you get the logon history, but you certainly need audit events for that. So in your case if you don't have such, this might be the cause. If the reply was helpful please don't forget to upvote or accept as answer, thank you Regards, Stoyan.

Hey this looks great. I stay away from powershell too often because some package is not installed the command "is not recognized as the name of a cmdlet". In This Article. You can also search for these event IDs. Event ID Description Logon Whenever an account is successfully logged on Logoff When an account is successfully logged off Logon session end time System was locked System was unlocked.