Let's break this down nicely:
LastLogon
is not replicated among DCs - it's a unique per-DC timestamp for that account. If a computer has never logged onto the DC that your query is hitting, that property won't be populated. If it's mostly logged onto different DCs, the date could be inaccurate. Instead, if you simply want to know if computers have logged on "recently", query LastLogonTimeStamp
or LastLogonDate
- see note below.
When you want to understand what a query is doing, don't just throw it all through the pipeline and output to CSV. Unless you enjoy having no idea what's happening and opening an empty CSV file, run simple commands first to understand the output and ensure you get the right results before outputting to file. See examples below.
If all you need is the LastLogon
or LastLogonDate
and the computer name, please do not use -Properties *
. Your query will take much longer, because you're literally dragging back all the data in the computer account. If you've got certs stored in computer objects in AD, this can be KBs of data for each object. If you only need two properties, then just select them: Get-ADComputer -filter '*' -properties Name,LastlogonDate
. Example of data sizes is at the end.
LastLogonTimeStamp vs LastLogonDate
Unlike LastLogon
, LastLogonTimeStamp
is replicated among all DCs, but is only precise up to 14 days ago. LastLogonDate
is the same as LastLogonTimeStamp
, but it's a calculated [DateTime]
property (it's not stored in LDAP, but calculated when you query it). Since it's a [DateTime]
, It's easier to sort and filter.
If LastLogonTimeStamp
is 14 or less days old, there may be a newer LastLogon
for that machine on one or more DCs. If you need a more precise time, you will need to query all the DCs for LastLogon
on all the computer accounts and then compare which has the most recent date. But for typical reporting purposes, such as if you're auditing machine accounts that might be "stale", LastLogonDate
is generally fine.
Refer to this article for more info.
Understanding AD/LDAP query results
When you're unsure what your results look like, don't output them to file. To understand what your commands are doing, try a simple filter and let it output to the console. Then refine the query as needed. If you need to process the data after getting the result, do one step at a time and check results before adding more. I've been working with Powershell for 15 years, and I still start off like this - checking what comes out first before doing the next step to filter and process data.
Try the following examples, obviously replacing OU and computer names with correct ones from your environment (by the way, don't reveal real names in your questions.)
# List all the computers in the OU with default properties that Get-AdComputer outputs - this does not include LastLogonDate etc
# e.g. name, distinguishedName, enabled, objectype etc...
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net"
# Show -all- properties from a computer named "MyComputer"
Get-ADComputer -Filter 'name -eq "Mycomputer"' -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties *
# Show only specific properties from the same computer
Get-ADComputer -Filter 'name -eq "Mycomputer"' -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate
# List all the computers in the OU with names and LastLogonDate only
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate
# As above, using an expression to convert the unreplicated LastLogon property to [datetime] instead
# Note that further processing is needed if you need to compare this date between multiple DCs
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogon | Select Name, LogonDate,@{Name='LastLogon';Expression={[DateTime]::FromFileTime($_.LastLogon)}}
# If your results in a previous command look good, now you can sort and output to CSV
Get-ADComputer -Filter * -Searchbase "OU=MyOUPath,DC=example,DC=net" -properties Name,LastLogonDate | Sort LastLogonDate | select Name,LastLogonDate | export-csv -path c:\Temp\ADComputer.csv -NoTypeInformation
For the last example, the Select Name,LastLogonDate
is to exclude the default properties like DistinguishedName
and objectClass
from the CSV export. Also, if you don't like how LastLogonDate
is formatted, you may need to include an expression to format it there too (similar to converting the LogonDate
filetime).
LDAP query data size
The file listing below shows the difference in data size if I return just the name
and LastLogonDate
of one computer into "comp1.txt" vs ALL of the same computer's properties into "comp2.txt". Multiply by the number of machines that are queried - it is very easy to see why a query will take a lot longer when it's dragging unnecessary data out of AD and across the network.
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2022-02-14 18:41 894 comp1.txt
-a---- 2022-02-14 18:42 69736 comp2.txt