Home page logo

basics logo Security Basics mailing list archives

Retrieving a User's Last Logon in Windows NT4
From: Alexander Bolante <alexander.bolante () gmail com>
Date: Thu, 12 Jan 2006 00:16:54 -0800

Hi Everyone,

I'm trying to find a way to retrieve all Users last logon over
multiple NT4 Domains in order to reconcile inactive accounts. From a
Security standpoint, you never want stale accounts active in your
system. So, does anyone know of a way to do this?

Now in Active Directory Win2K Server, you can do an ldapsearch on the
lastLogon attrib. In Win2K3 Server, you can do an ldapsearch for
lastLogonTimestamp. Is there anything similar to this in NT4? What is
the attrib called? If not, how would you go about obtaining a User's
last logon?

In my current environment, I do have a Trust setup between NT4 and
Active Directory Domains, however, I don't believe you can retrieve a
User's last logon from NT4 thru Active Directory, unless I'm wrong.

I've seen a few VBScript's on Google that can do this and have seen
Dameware NT Utilities provide a similar export functionality, but I'm
looking for any other suggestions as well.

Your expertise is much appreciated.


Alexander Bolante | Alexander.Bolante () gmail com

The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]