RE: Retrieving a User's Last Logon in Windows NT4

["Huang, John, GCM" <John.Huang () rbsgc com>]

We use a vbscript that constantly monitor the DC for events and dump
those into a database. Also, if you have a bit of money to spend,
NetPro's ChangeAuditor AD suite is invaluable for monitoring realtime AD
changes.

-----Original Message-----
From: Alexander Bolante [mailto:alexander.bolante () gmail com] 
Sent: Thursday, January 12, 2006 3:17 AM
To: security-basics () securityfocus com
Subject: Retrieving a User's Last Logon in Windows NT4

Hi Everyone,

I'm trying to find a way to retrieve all Users last logon over multiple
NT4 Domains in order to reconcile inactive accounts. From a Security
standpoint, you never want stale accounts active in your system. So,
does anyone know of a way to do this?

Now in Active Directory Win2K Server, you can do an ldapsearch on the
lastLogon attrib. In Win2K3 Server, you can do an ldapsearch for
lastLogonTimestamp. Is there anything similar to this in NT4? What is
the attrib called? If not, how would you go about obtaining a User's
last logon?

In my current environment, I do have a Trust setup between NT4 and
Active Directory Domains, however, I don't believe you can retrieve a
User's last logon from NT4 thru Active Directory, unless I'm wrong.

I've seen a few VBScript's on Google that can do this and have seen
Dameware NT Utilities provide a similar export functionality, but I'm
looking for any other suggestions as well.

Your expertise is much appreciated.

Thanks!



--
Alexander Bolante | Alexander.Bolante () gmail com

------------------------------------------------------------------------
---
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich
University program offers unparalleled Infosec management education and
the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity
Planning, Computer Emergency Response Teams, and Digital Investigations.


http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
----




-----------------------------------------
********************************************************************

This e-mail is intended only for the addressee named above.
As this e-mail may contain confidential or privileged information,
if you are not the named addressee, you are not authorized
to retain, read, copy or disseminate this message or any part of it.

********************************************************************


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------------