CAPTURING LOGON INFORMATION FROM ACTIVE DIRECTORY USING ASP.NET WEB APPLICATION AUTHENTICATION

Question

Hi We have developed a web application in which we authenticate the user against Active Directory. We need to capture the users who have not logged into the application from past 5 days. We tried using lastlogon attribute but it is not getting updated always the user is authenticated against Active Directory So how can we acheive this?

hima bindu · Answer

But that attribute is not getting updated for every login it is getting updated only after 9 days. We want to capture the login details atleast once in a day. Any ways of doing this?

Muralidharan Deenathayalan · Answer

Try to get the value of  lastLogonTimestamp attribute instead of  lastLogon.

hima bindu · Answer

One more thing I had observed is after an unsuccesfull authentication if he gives correct userID and password then for that login aloneLastlogon attribute is getting updated. Any ideas on this?

hima bindu · Answer

Hmm I enabled the Interactive Logon option as said by you... But I can see that LastLogon attribute is not getting still updated...

hima bindu · Answer

Hmm Sorry but I couldn't go to the path youhad specified to enable the Interactive logon.....

Muralidharan Dheenadhayalan · Answer

How to configure last interactive logon You configure last interactive logon through a GPO. You must configure the following setting for the GPO with domain controllers in its scope of management if you want to report last interactive logon information to the directory service: Computer Configuration| Policies | Administrative Templates | Windows Components | Windows Logon Options | Display information about previous logons during user logon = Enabled http://technet.microsoft.com/en-us/library/dd446680(WS.10).aspx Hope this helps you.

hima bindu · Answer

Hi Murali Thanks for your response... How can we enable the InteractiveLogin option in Active Directory? The problem with LastLogonTimestamp attribute is it is getting updated only once in 14 days. But we want it to get updated with every login... Is that possible?

Muralidharan Dheenadhayalan · Answer

You have to check the property of Interactive Logon. If it is enabled then only you LastLogonTime will update otherwise it will not update. The lastLogontimeStamp attribute is not updated with all logon types or at every logon. The good news is that the logon types that admins usually care about will update the attribute and often enough to accomplish its task of identifying inactive accounts. Interactive and Network logons will update the lastLogontimeStamp . So if a user logs on interactively browses a network share access the email server runs an LDAP query etc… the lastLogontimeStamp attribute will updated if the right condition is met. (The conditions are discussed below in the section Update and Replication of lastLogontimeStamp . http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx