How to Find Active Directory User’s/Computer’s Last Logon Time?

Hi Admins,

I call this case; “find when was last seen” : ) … well there are some good news as AD store those information and I am going to show you how to fetch them.

Using Active Directory Users and Computers (ADUC)

You can find out the last logon time for the domain user with the ADUC graphical console.

1. Run the console dsa.msc;
2. In the top menu, enable the option View > Advanced Features;
   
3. In the AD tree, select the user and open its properties;
4. Click on the tab Attribute Editor;
5. In the list of attributes, find lastLogon. This attribute contains the time the user was last logged in the domain.

Using PowerShell

To find the last logon time for the domain administrator account, run the command:

Get-ADUser -Identity administrator -Properties LastLogon

dealing with computer is pretty much the same, only use Get-ADComputer instead of Get-ADUser and provide the computer name you want to enquiry

Get-ADComputer -identity someComputerName -Properties * | select LastLogonDate

The cmdlet returned the time in Timestamp format. To convert it to normal time use the following command:

Get-ADUser -Filter {Name -eq "administrator"} -Properties * | Select-Object Name, @{N='LastLogon'; E=[DateTime]::FromFileTime($_.LastLogon)}}

below is how the output should looks like

thats it, Cheers1

Jaber