failed to identify inactive users: lastLogonTimestamp not updating
Fixes inactive-user identification when lastLogonTimestamp does not update by querying all domain controllers, allowing for replication lag, and cross-checking with IdP sign-in logs. Use when the timestamp looks stale. Not for cloud-only accounts, which do not use this attribute.
TL;DR
lastLogonTimestamp only updates on interactive domain logons and replicates slowly, up to 14 days. Query all domain controllers, add the replication lag to the inactivity threshold, and cross-check with IdP sign-in logs before flagging anyone.
failed to identify inactive users: lastLogonTimestamp not updatingUse this when
- lastLogonTimestamp looks stale for many users.
- The inactive-user report is empty or obviously wrong.
- The environment is Active Directory backed.
Not for this skill when
- The accounts are cloud-only. This attribute does not apply.
- The IdP sign-in log already gives a good signal. Use it directly.
- The timestamp updates fine but the threshold is wrong. Adjust the threshold.
Steps
- Query lastLogonTimestamp across all domain controllers, not just one. Verify: you have the freshest value per user.
- Add the replication lag, up to 14 days, to the inactivity threshold. Verify: the threshold accounts for the delay.
- Cross-check with IdP sign-in logs for the same users. Verify: both signals agree.
- Flag users inactive on both signals. Verify: the flag is defensible.
- Disable flagged accounts and verify. Verify: no active user is caught.
Variant phrasings
lastLogonTimestamp stale
The field-first phrasing.
AD inactive users
The short search.
last logon not updating
The symptom-first phrasing.
Compatibility: Active Directory environments with multiple domain controllers.
Why it happens
The attribute is designed for replication efficiency, not real-time accuracy. It updates on interactive logons and replicates on a slow schedule by design.
Edge cases / pitfalls
- Users who only VPN in: their logons hit specific domain controllers, so single-DC queries miss them.
- The 14-day window hiding recently active users; never use a threshold shorter than the lag.
- Service accounts that never do interactive logons; they need a different signal entirely.
- Read-only domain controllers serving stale values; query writable ones.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst3XquzWq7iR_whnK7JmvAg