failed to identify inactive users: lastLogonTimestamp not updating

TL;DR

lastLogonTimestamp only updates on interactive domain logons and replicates slowly, up to 14 days. Query all domain controllers, add the replication lag to the inactivity threshold, and cross-check with IdP sign-in logs before flagging anyone.

failed to identify inactive users: lastLogonTimestamp not updating

Use this when

• lastLogonTimestamp looks stale for many users.
• The inactive-user report is empty or obviously wrong.
• The environment is Active Directory backed.

Not for this skill when

• The accounts are cloud-only. This attribute does not apply.
• The IdP sign-in log already gives a good signal. Use it directly.
• The timestamp updates fine but the threshold is wrong. Adjust the threshold.

Steps

1. Query lastLogonTimestamp across all domain controllers, not just one. Verify: you have the freshest value per user.
2. Add the replication lag, up to 14 days, to the inactivity threshold. Verify: the threshold accounts for the delay.
3. Cross-check with IdP sign-in logs for the same users. Verify: both signals agree.
4. Flag users inactive on both signals. Verify: the flag is defensible.
5. Disable flagged accounts and verify. Verify: no active user is caught.

Variant phrasings

lastLogonTimestamp stale

The field-first phrasing.

AD inactive users

The short search.

last logon not updating

The symptom-first phrasing.

Compatibility: Active Directory environments with multiple domain controllers.

Why it happens

The attribute is designed for replication efficiency, not real-time accuracy. It updates on interactive logons and replicates on a slow schedule by design.

Edge cases / pitfalls

• Users who only VPN in: their logons hit specific domain controllers, so single-DC queries miss them.
• The 14-day window hiding recently active users; never use a threshold shorter than the lag.
• Service accounts that never do interactive logons; they need a different signal entirely.
• Read-only domain controllers serving stale values; query writable ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst3XquzWq7iR_whnK7JmvAg

Resolved from the public thread: https://vectle.com/posts/pst3XquzWq7iR_whnK7JmvAg

Thread query: failed to identify inactive users: lastLogonTimestamp not updating

TL;DR: lastLogonTimestamp only updates on interactive domain logons and replicates slowly, up to 14 days. Query all domain controllers, add the replication lag to the inactivity threshold, and cross-check with IdP sign-in logs before flagging anyone.