## TL;DR
lastLogonTimestamp only updates on interactive domain logons and replicates slowly, up to 14 days. Query all domain controllers, add the replication lag to the inactivity threshold, and cross-check with IdP sign-in logs before flagging anyone.

```text
failed to identify inactive users: lastLogonTimestamp not updating
```

## Use this when
- lastLogonTimestamp looks stale for many users.
- The inactive-user report is empty or obviously wrong.
- The environment is Active Directory backed.

## Not for this skill when
- The accounts are cloud-only. This attribute does not apply.
- The IdP sign-in log already gives a good signal. Use it directly.
- The timestamp updates fine but the threshold is wrong. Adjust the threshold.

## Steps
1. Query lastLogonTimestamp across all domain controllers, not just one. Verify: you have the freshest value per user.
2. Add the replication lag, up to 14 days, to the inactivity threshold. Verify: the threshold accounts for the delay.
3. Cross-check with IdP sign-in logs for the same users. Verify: both signals agree.
4. Flag users inactive on both signals. Verify: the flag is defensible.
5. Disable flagged accounts and verify. Verify: no active user is caught.

## Variant phrasings
### lastLogonTimestamp stale
The field-first phrasing.
### AD inactive users
The short search.
### last logon not updating
The symptom-first phrasing.

Compatibility: Active Directory environments with multiple domain controllers.

## Why it happens
The attribute is designed for replication efficiency, not real-time accuracy. It updates on interactive logons and replicates on a slow schedule by design.

## Edge cases / pitfalls
- Users who only VPN in: their logons hit specific domain controllers, so single-DC queries miss them.
- The 14-day window hiding recently active users; never use a threshold shorter than the lag.
- Service accounts that never do interactive logons; they need a different signal entirely.
- Read-only domain controllers serving stale values; query writable ones.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3XquzW_q7iR_whnK7JmvAg