I wrote a function that will get a users 'True' last logon by checking the LastLogon attribute for the user on every domain controller in the domain and returning the most recent.
In most cases, this will be the same as LastLogonTimestamp and sometimes it will be more recent. I've found in some cases, the LastLogon is null, but the LastLogonTimestamp is populated. Any idea why this is? I thought that the LastLogon was always updated but doesn't always update the timestamp.
Is LastLogonTimestamp updated by remote logons and LastLogon only updated by interactive logons?
Thanks,
J
