Back to all recipes

Level: JuniorLast updated: 2026-09-10

Get a user's true last logon time

Get-ADDomainController -Filter * | ForEach-Object {
  Get-ADUser jdoe -Server $_.HostName -Properties lastLogon |
    Select-Object @{n='DC';e={$_.PSComputerName}},
      @{n='LastLogon';e={[datetime]::FromFileTime($_.lastLogon)}}
} | Sort-Object LastLogon -Descending | Select-Object -First 1

Why it works this way

LastLogonDate replicates and is approximate; lastLogon does not replicate, so query every DC.

Watch out

For security questions take the maximum across DCs.
For stale-account cleanup LastLogonDate is enough.

Related events

4624Successful logon