"The LastLogonTimeStamp" 특성 - 어떤 것이며 어떻게 동작하는가

???? : “The LastLogonTimeStamp Attribute” ? “What it was designed for and how it works”

https://blogs.technet.com/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

??(Warren)???. Windows Server 2003?? lastLogontimeStamp ??? ???????. ???? ???? ??? ??? ??? ???? ??? ??? ????lastLogontimeStamp ??? ??? ? ????. ? ??? ?? ???? ?? ???? ? ? ?? ????? ???? ??? ? ????.

???? ??

lastLogontimeStamp ??? ???? ??? ???? ?? ???? ??? ??? ????? ??? ?? ??? ???? ?? ?????. lastLogon ??? ??? ??? ?? ?? ??? ????? ???? ?? ????. lastLogontimeStamp? ?? ??? ?? ???? 9~14? ?? ? ????.

?? "???" ???? ???? ??? ??? ??? ???(528 - Windows XP/2003 ???4624 Windows Vista/2008)? DC? ?? ??? ???? ???? ??. ? ??? ??? Eric Fitzgerald? ???? ???? ???.(??? ??? ???)

??? ???? ?? ??? ??? ?????? ??????? ?? ??? ????? ?? ??? ??? ???? ??? ?? ?? ???? ???? ????. ???? ??? ??? ???? ?? ?? ???????? ??? ? ? ????. ?? ??? ?? ??? ?? Microsoft? ???? ?? ?? ???(Audit Collection Services)???. ??? ???? ?? ?? ????.

Windows 2000?? ??? ?????

Windows Server 2003 ???? ???? ?? ???? ???? ??? ??? ???? ?? lastLogon ??? ??????. ? ????? ?? ????? lastLogon ??? ??? ????? ??? ??? ??? ?? ?????? ???????. lastLogon ??? ???? ????. ??? ???? ?? ??? ?????? lastLogon ??? ???? ???? ??? ??? ??? ???? ???? lastLogon? ?? ??? ??? ??? ?? ????? ???????. Windows Server 2003 ????? lastLogon ? ??? ?? ??? ?? ????. ??? ??? ????? ????? ?????? ???? ????.

Windows Server 2003 ????? ??? ?????

??? lastLogontimeStamp ??? ????? ?? ??? ????? ??? ?? ?? ?? ??? ???.(????) ??? ?? ??? ??? ?? ?? ?? ???? ???? ?? ??? ?????? ??? ? ????.

????

llastLogontimeStamp? ?????? ???? Windows Server 2003 ??? ?? ????? ???.

lastLogontimeStamp ??? ????? ?? ??? ??

lastLogontimeStamp? ?? ??? ???? ?? ???? ??? ???? ?? ????. ?? ??? ???? ???? ??? ??? ?? ?????? ???? ?? ??? ???? ??? ????? ????? ????.

Interactive logons? Network logons? lastLogontimeStamp? ????? ????. ??? ?? ???? interactive ???? ??, ???? ??? ????, ??? ??? ???? LDAP ??? ????, lastLogontimeStamp ??? ?? ??? ???? ? ????. (? ??? ???? lastLogontimeStamp? ????? ?? ?? ?? ?? ????)

Windows Server 2003 SP1??? ??? ?? ??? ???? lastLogontimeStamp? ???? ?? ???? .

l Microsoft Internet Information Services (IIS)? ?? ??? ??

l IIS? ?? Microsoft .NET ??

[2009? 7? 19? ???? - repro? ??? ??? ?? ??? ???? ??? ??? ??????]

====================================================

lastLogontimeStamp? ????? ??

??? ms-DS-Logon-Time-Sync-Interval ??? ?????. ??? ??? NC? ???? lastLogontimeStamp ??? ???(??) ?????? ?? ?????. ???? 14?? ??? ???? ????. ADSIEDIT.MSC?? ? ??? ???? "Not Set"? ?? ??? ??? ???. ??? ????? ????? 14? ????? ?????.

lastLogontimeStamp ??? ???? ???? ???? ??????? ?? ?????? ????. ?? ?????? ?? ???? ?? ?? ?? ?? (ms-DS-Logon-Time-Sync-Interval attribute ?? ??? 5% ?)? ?????. ?? ??? lastLogontimeStamp ? ??? ??? ??? ???????. lastLogontimeStamp ??? ?? ??? ??? ????. ?? ??? ?????? ?? ?? ?????? ??? ????. ??? ??? ??? ????.

lastLogontimeStampUpdate? ???? ?? ?????.

1. (ms-DS-Logon-Time-Sync-Interval? ?? ???? 14?? ?????.)

2. ???? ???? ??????.

3. ???? lastLogontimeStamp ?? ?? ?????.

4. 14 - (5% ???) = X

5. ?? ?? - lastLogontimeStamp? ? = Y

6. X = Y - lastLognTimeStamp ???? ?

7. X > Y - lastLogontimeStamp ???? ?? ??

? ???? ??????

?? ?? ??? ?? ??? ?????? ??? ???? ??? lastLogontimeStamp ??? ?????? ?? ???? ??? ???? ?????. lastLogontimeStamp ??? ??? ??? ??? ??? ???? ?? ??? ???? ?? ??? ???? ???? ?? ?????.

lastLogontimeStamp? ???? ?? ????

lastLogontimeStamp? ???? ??? ????? ???? ??? ???? ?? ?? ?????. ?? ?? ?? ??? ????? msDS-LogonTimeSyncInterval ??? ?? 5~100,000??? ??? ? ????. ?? ?? 100,000 ????... ?? ?? 280? ?? ??... ??? ?? ?? ??? ?????? ????? ????.

? ????? ?? ??? ???? ????? ???? ???? ??? ??? ??? ?????. ?? ??? ?? ???? ??? ??? 30? ?? ? ??? ?? ????? ???? ?? ??? ??????.

?? : ?? msDS-LogonTimeSyncInterval? 5? ????, ???? ??? ?? ????.

? ??? ???? ???? ??? ????

?? msDS-LogonTimeSyncInterval ??? ???? ???? msDS-LogonTimeSyncInterval ??? 0?? ???? ???.

????? lastLogontimeStamp? ???? ??? ???? ???? ??? ?????? ????. ???? ???? ????? ????? ??? ?? ??? ????? ?????. ?? ??? ???? ?? ??? ?? 9~14??? ??? timestamp? ????? DC ??? ??????? ?????. ??? ??? ??? ?????.

=======================================

?? ??? - LastLogontimeStamp ????? ????? ?? ??? ????? ??????.

???? ??? (????? ?? ??? ???) ???? ??? ??? ?????. ??? ??? ???? lastLogontimeStamp ?? ??? lastLogon ??? ???? ??? ???? ?????.

?? ?? ?? ?? ??? ??? acctinfo.dll? lastLogontimeStamp ???? ?? lastLogon ?? ???? ?????. ?? ???? ??? ???? ??? ? ?? ? ?? ???? ???? ????. ??? lastLogon ??? ???? ???? ????? ???? ???? ??? ?????? ???? ????(? ??? null???) ???? ??? ?????? ?? ???? ???? ??? ?????.

lastLogontimeStamp? ??? ????

lastLogonTimeStamp? ?????? ????? ??? ?? ????? repadmin.exe? showattr ???? ?? ? ? ????. ??? ??? ?? ?????. lastLogontimeStamp? 9~14? ??? ?????? ????? ?? ??? ????? ???? ?? ?????. ??? ???? ?? ??? ???? ??? ????.

1. ??? ???? ?? ?? ??? ?????? lastLogontimeStamp? ?? repadmin? ?? ?????.

repadmin /showattr * (DN of the target user) /attrs:lastLogontimeStamp >lastLogontimeStamp.txt

??

repadmin /showattr * CN=user1,OU=accounting,DC=domain,dc=com /attrs:lastLogontimeStamp >lastLogontimeStamp.txt

2. lastLogontimeStamp ??? ???? ?? ???? ???? ??? ?? ?? ???? lastLogontimeStamp? repadmin? ?? ?????.

repadmin /showattr * /subtree /filter:"(&(objectCategory=Person)(objectClass=user))" /attrs:lastLogontimeStamp >lastLogontimeStamp.txt

3. ??? ??? ???? lastLogonTimeStamp? ?????.

repadmin /showattr * dc=domain,dc=com /subtree /filter:"((&(lastLogontimeStamp=*)(objectCategory=Person)(objectClass=user)))" /attrs:lastLogontimeStamp > lastLogontimeStamp-2-22-2009.txt

- Warren ‘For Once not DFSR’ Williams