https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313451#M58749 <P>Good Morning,</P> <P>I have been using SA-LdapSearch for a project. I have had the same issue with the time for I see results back, but I have other problems. I need the user's "last logon" information. When I compare with AD directly, information does not match with the SA-LdapSearch information. At AD the "last logon" is topday, at SA-LdapSearch the "last logon" was yesterday.</P> <P>Has this happened to anybody else? </P> <P>Regards</P> Tue, 28 Nov 2017 13:53:24 GMT evinasco 2017-11-28T13:53:24Z https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313451#M58749 <P>Good Morning,</P> <P>I have been using SA-LdapSearch for a project. I have had the same issue with the time for I see results back, but I have other problems. I need the user's "last logon" information. When I compare with AD directly, information does not match with the SA-LdapSearch information. At AD the "last logon" is topday, at SA-LdapSearch the "last logon" was yesterday.</P> <P>Has this happened to anybody else? </P> <P>Regards</P> Tue, 28 Nov 2017 13:53:24 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313451#M58749 evinasco 2017-11-28T13:53:24Z https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313452#M58750 <P>I converted this to a question from a comment on an unrelated subject.</P> Tue, 28 Nov 2017 15:12:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313452#M58750 richgalloway 2017-11-28T15:12:08Z https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313453#M58751 <P>The LastLogon time stamp can vary from Domain Controller to Domain Controller as LastLogon is not replicated. lastLogonTimeStamp is replicated, but it is on a delay so this value will be 10-14 days behind. The main use for this field is to find accounts that are stale (i.e. &gt;90 days old). <A href="https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/">https://blogs.technet.microsoft.com/askds/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works/</A></P> Tue, 28 Nov 2017 15:31:37 GMT https://community.splunk.com/t5/Getting-Data-In/Why-doesn-t-the-LastLogon-timestamp-match-betweeen-the-active/m-p/313453#M58751 the0duke0 2017-11-28T15:31:37Z