First published on TechNet on Apr 15, 2009 Warren here. In Windows Server 2003 we introduced the lastLogontimeStamp attribute. Administrators can use the lastLogontimeStamp attribute to det...
Updated Aug 18, 2026
Version 3.0
Blog Post
"lastLogon" is a non-replicated and only stored on the DC you are viewing. Therefore, the last time this DC authenticated this user is 11/2021. However, a different DC authenticated the user on 09/2023. Check all of your DCs and record the "lastLogon" for each. Then compare all of those recorded dates against the "lastLogonTimestamp". That will be the DC that authenticated the user on 09/2023. You may even find a new date that hasn't been updated to the "lastLogonTimestamp" yet.