Enterprise Reporter can report on both the LastLogonTimeStamp attribute of a user object and the LastLogon attribute. Please note these values are for the last logon to the domain. ER is not capable of reporting on when a user logs on to a workstation. Change Auditor can be used to return workstation logon information.
By default, the Active Directory Discovery collects the LastLogonTimeStamp value. To collect the LastLogon value the AD Discovery has to be changed to collect this information from each Domain Controller. To collect the LastLogon value:
- Edit the AD discovery
- Click the Scopes tab
- Under Users check Query all domain controller for last logon
Please note, this will increase the discovery time
Once you have enabled the setting, run the discovery to collect the information.
After you have run the discovery you will need to add either the Last Logon field or the Last Logon TimeStamp field to a report, such as the Domain Accounts report:
- Open the Report Manager
- Expand Report Library | Active Directory
- Right click the Domain Accounts report and select Copy
- Right click My Reports and select Paste
- Right click the copied Domain Accounts report under My Reports and select Edit Report
- Click the Fields tab
- Scroll down through the list. Right click Domain Account, check Domain User and click OK
- Scroll down through the list again and under Domain Account ->Domain User select either Last Logon or Last Logon TimeStamp and click Add
- Click Yes to the warning
- Click the Layout tab
- Click Auto-Generate
- Click Yes
- Click Next
- If you want a report showing just the Last Logon or Last Logon TimeStamp values, select Domain Name, Account Name and Last Logon and click the > arrow
- Click Next
- Click the > arrow to group by Domain name
- Click Finish
The new report should show just the account name and the last logon value.