Activedirectory

[bmaier]

Hi all,

I try to query the lastLogon value from the AD. Therefore I use folowing code:

#include <adfunctions.au3>
#include <array.au3>

Dim $ou = "OU=PONTIT,OU=EU,OU=people,DC=modine,DC=com"
Dim $EXISTINGUSER

_ADGetObjectsInOU($EXISTINGUSER, $Ou, "(objectClass=user)", 1, "name,lastLogon,whenCreated")
_ArrayDisplay($EXISTINGUSER)

I get all values, but not the lastLogon-value. Plese, have anyone a idea why? I search a lot the INet but nothing realy helps me. Ore I'm to stupid

Thanks a lot and greetings, Bernd

Edited March 3, 2010 by bmaier

[water]

Oh, that's easy

Please download the AD UDF (see my signature). It's based on adfunctions.au3.

The function _AD_GetLastLoginDate does what you need. Please see the example script for this function.

[bmaier]

Hi Water,

works nearly perfect! Thx therefore. But....it takes a long time to query the lastlogondate. Round about 2 minutes.

Is it possible to accelerate that?

Thanks again and greetings, Bernd

[water]

As the lastlogondate is not propagated to all DCs the function has to ask all DCs in the domain.

First it gets a list off all DCs in the domain then queries every single DC. If the DC is down or the service is not available then the function runs longer (it has to wait for the ping to time out - so if you have a lot of DCs that can not be reached ...)

Please check @error and @extended.

@error - Number of DCs which could not be reached. Result is returned from all available DCs.

@extended is set to the total number of Domain Controllers

Edited March 3, 2010 by water

[99ojo]

Hi,

i don't think so. Theproblem is, that the lastlogon timestamps are different on every Ad Controller and aren't replicated between the controllers.

So you have to query every AD Controller to get the real lastlogon timestamp.

Even on Win2003/2008 AD the new value lastlogintimestamp isn't a solution, although this value is replicated between the controllers, but only every 14 days (as i know).

;-))

Stefan

[water]

I have 5 DCs, all are available. In this situation the function needs 0.2 seconds to return the result.

[99ojo]

4 DC 0,27 seconds for quering one account.

@bmeier:

You also query one or more accounts?

If you query more accounts, how your code looks like?

You may have DC on WAN?

You might query only your site controller if defined.

;-))

Stefan

[bmaier]

Water,

First: thanks a lot for your realy quick help!

We have a lot of DCs arround the world and for me the europe DCs would be enough. So, I think I will modify the Func _AD_GetLastLoginDate for only our Europe DCs.

Therefore I will comment out the peace of code which creates the array of DCs and insert a array with our europe DCs.

Thanks again and greetings, Bernd

Edited March 3, 2010 by bmaier

[water]

Water,

First: thanks a lot for your realy quick help!

We have a lot of DCs arround the world and for me the europe DCs would be enough. So, I think I will modify the Func _AD_GetLastLoginDate for only our Europe DCs.

Therefore I will comment out the peace of code which creates the array of DCs and insert a array with our europe DCs.

Thanks again and greetings, Bernd

Or I could modify the function so it only queries the DCs belonging to a site you specify (run the example for _AD_ListDomainControllers to get a list of all available sites). Or - but a bit more complicated - determine the DCs with the corresponding subnet settings. This would be the only DCs where the computer can connect to and therefore reduces the number of DCs to query.

What do you think?

[bmaier]

Water,

thats a great offer and thanks for that. But for me, this work for you is to much. I think I can mod the Func _AD_GetLastLoginDate to query only my DCs in Europe and thats ok for me.

Realy great this Forum and the Users. Hyperquick responses and solutions THANKS

Greetings, Bernd

[water]

I'm constantly improving the AD UDF so I think I will put it on the list - at least the site check.