How can the LastLogonTimeStamp be a whole week older, yes older, than any LastLogon?

Question

I understand that LastLogon can be older than LastLogonTimeStamp because the person may have authenticated with a different DC more recently. However, how can the LastLogonTimeStamp be a whole week older, yes older, than any LastLogon?

LastLogon = yesterday

LastLogonTimeStamp = last week

How is that possible?

(all replication tests succeed)

Answer 1

Hello there,

The "lastlogon" attribute is only updated on one DC, that means this attribute is not replicated. Probably, the specific users haven't logged onto the specific DC for a long time, however, did log on to other DCs, and the "lastlogontimestamp" probably got updated and replicated to other DCs.

"LastLogonTimestamp" attribute can be updated with different logon types: Interactive, Network, and Service logons. The "lastLogon" attribute reflects the last interactive logon, not includes the last network-based logon.

Similar discussion here https://social.technet.microsoft.com/Forums/ie/en-US/f27376fe-bdbb-4219-aa2d-4eb69bef4281/lastlogon-attribute-older-than-lastlogontimestamp-attribute?forum=winserverDS

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–