Active Directory and lastlogontimestamp

The Problem
I was tasked with retrieving all of the enabled Machines accounts from Active Directory and the date/time they last logged in. After googling some articles on the topic, I found some reasonable solutions, but ran into a couple issues on the topic so I thought I’d document it here for others.

To start off, here is the one article you want to read to introduce the topic and give some background:
Dandelions, VCR Clocks, and Last Logon Times: These are a Few of Our Least Favorite Things

Most of the references online show how to retrieve the lastlogontimestamp using the DirectoryEntry object, as illustrated in the next snippet of code I pulled from one post on a forum showing how to properly retrieve the lastlogontimestamp value:
<br />DirectoryEntry user = <br /> new DirectoryEntry("LDAP://" + strDN);<br />if (user.Properties.Contains("lastlogontimestamp"))<br />{<br /> // lastlogontimestamp is a IADsLargeInteger<br /> IADsLargeInteger li = (IADsLargeInteger) <br /> user.Properties["lastlogontimestamp"][0];<br /> long lastlogonts = <br /> (long)li.HighPart << 32 | (uint)li.LowPart;<br /> user.Close();<br /> return DateTime.FromFileTime(lastlogonts);<br />}<br />
What the post failed to do was explain what any of this meant.
The lastlogontimestamp is stored in Active Directory as object that implements the IADsLargeInteger (an ActiveDS object). Ideally, AD would return a long (Int64) instead of the IADsLargeInteger object, eliminating the need to reference COM (ActiveDS is where this interface is defined), as well as allowing use to work with a .NET primitive.

Instead we have to use the IADsLargeInteger interface to extract the HighPart, stored as an Int32, shift it left 32 and cast it to a long (Int64) and then OR that with the LowPart, another Int32. If you’re wondering what the bit shifting and OR ‘’ code is doing – it essentially converts the IADsLargeInteger into a long (Int64).

Now let’s say you are using the DirectorySearcher object instead of the DirectoryEntry object to find the object in Active Directory you need. If you try to use similar code as provided in the sample above, you will get an InvalidCastException when casting the lastlogontimestamp to the IADsLargeInteger. For some reasone, when using the DirectorySearcher object, the lastlogontimestamp object is returned as a long (Int64) instead of an IADsLargeInteger. I found this behavior to be a bit schizophrenic.

Here’s an example of what I’m talking about:
<br />SearchResultCollection resultCollection = null;<br />DirectoryEntry entry = <br /> new DirectoryEntry("LDAP://DC=BLAH,DC=COM/"); <br />DirectorySearcher searcher =<br /> new DirectorySearcher(entry);<br />searcher.SearchScope = SearchScope.Subtree;<br /><br />// Filter out only Enabled Computer Accounts<br />searcher.Filter = <br /> "(&(objectCategory=computer)(name=*)(!" +<br /> "userAccountControl:1.2.840.113556.1.4.803:=2))";<br /><br />resultCollection = searcher.FindAll();<br /><br />foreach (SearchResult result in resultCollection)<br />{<br /> // Huh, this time it’s a long (Int64)!<br /> long lastlogontimestamp = <br /> (long)result.Properties["lastlogontimestamp"][0];<br /> DateTime dtLastLoginTimeStamp = <br /> DateTime.FromFileTime(lastlogontimestamp);<br /> ...<br />}<br />
A Poorly Named Method
The next thing you may be wondering is why I show an examples that use the DateTime.FromFileTime() method. What does a file time have to do with Active Directory and the lastlogontimestamp?

Well, I’m guessing whoever wrote the .NET DateTime object must have thought something like this – “a time expressed in a 100 nanosecond units starting from January 1, 1601 is how file times are stored. I’ll write a method on DateTime called FromFileTime(long nanotime)” or maybe “AH crap, I’ve got this file timestamp as a long and I need an easy way to convert it to a DateTime object without repeating the same code over and over again. I’ll just add a method to DateTime that takes a long and returns the corresponding DateTime.”

This method name, while accurate, is a limited expression of what is expressed as a 100 nanosecond unit starting from 1/1/1601- namely ANY time that is expressed as an Int64. Active Directory uses this same 100 nanosecond unit to store its timestamps and I’m better there are other things that do as well.

What IS nice about the FromFileTime() method is that it returns a DateTime using the current Time Zone, so we don’t have to convert it.

There are actually a couple ways to convert the Int64 100 nano second representation to the DateTime object in .NET and they are as follows:

1. One of the TimeSpan object constructor overloads takes a period expressed in 100 nanosecond units which is exactly what AD is returning, if we create a DateTime object that starts at 1/1/1601, and then add a TimeSpan created with our Int64 value, we should get the corresponding UTC time expressed in a DateTime object. Finally we need to convert the UTC time to local time. Here is the code to illustrate this:

<br />long lastlogontimestamp = <br /> (long)result.Properties["lastlogontimestamp"][0];<br />// Create a date object starting at 1/1/1601<br />DateTime dt = new DateTime(1601, 1, 1, 0, 0, 0);<br />// Convert it to local time<br />DateTime dtLastLoginTimeStamp =<br /> dt.Add(<br /> new TimeSpan(lastlogontimestamp)<br /> ).ToLocalTime();<br />

2. More simply, we can just use the DateTime.FromFileTime() and this will accomplish what the code above does, though with less code.
Here’s some sample code:
<br />long lastlogontimestamp = <br /> (long)result.Properties["lastlogontimestamp"][0];<br />DateTime dtLastLoginTimeStamp = <br /> DateTime.FromFileTime(lastlogontimestamp);<br />
With all of that said, the solution I came up with to report on the lastlogontimestamp of the machine accounts in AD is pretty straight forward:
<br />SearchResultCollection resultCollection = null;<br />DirectoryEntry entry = <br /> new DirectoryEntry("LDAP://DC=BLAH,DC=COM/");<br />DirectorySearcher searcher = new DirectorySearcher(entry);<br />searcher.SearchScope = SearchScope.Subtree;<br /><br />// Filter out only Enabled Computer Accounts<br />searcher.Filter = "(&(objectCategory=computer)(name=*)" +<br /> "(!userAccountControl:1.2.840.113556.1.4.803:=2))";<br /><br />searcher.PropertiesToLoad.Add("name");<br />searcher.PropertiesToLoad.Add("description");<br />searcher.PropertiesToLoad.Add("operatingSystem");<br />searcher.PropertiesToLoad.Add("operatingSystemVersion");<br />searcher.PropertiesToLoad.Add("lastlogontimestamp");<br /><br />try<br />{<br /> resultCollection = searcher.FindAll();<br /><br /> foreach (SearchResult result in resultCollection)<br /> {<br /> //...<br /> long lastlogontimestamp =<br /> (long)result.Properties["lastlogontimestamp"][0];<br /> DateTime dtLastLoginTimeStamp =<br /> DateTime.FromFileTime(lastlogontimestamp);<br /> string answer =<br /> dtLastLoginTimeStamp.ToShortDateString() +<br /> " " + <br /> dtLastLoginTimeStamp.ToShortTimeString();<br /> //...<br /> }<br />}<br />finally<br />{<br /> resultCollection.Dispose();<br /> searcher.Dispose();<br /> entry.Close();<br />}<br />
One Last Problem:
It turns out, the value of lastlogontimestamp is replicated from the DC's to the GC every 14 days. This ends up presenting a problem if you want real-time data. If you really want the latest and greatest value logon time, the solution is as follows: Connect to EACH domain controller and check the lastlogon value instead. I wrote code to do this and found that on a LARGE domain with over 4,000 computers the time it takes to run this report takes a loooooong time to run. If anyone has any suggestions on how to practically do this efficiently, please let me know.

Further reading:
Decimal Time - Computers – a reference describing how Computers store times in Decimal.