Finding when a user last logged on

In this case ADSIEdit.msc is our friend (this is found on the Windows 2003 support pack or from the Administrative tools on your 2008 DC / in the RSAT pack on Windows Vista / 7. So open up adsiedit.msc Connect to your Domain Naming context, navigate to the users account and right click and go properties.

Navigate down to lastLogonTimestamp and it should appear like this

image

Now, that’s not very readable is it ?

Open up Command Prompt, copy the value from above then type this command:

w32tm /ntte <value>

image

Easy!