Return
-
Title
'Last Logon' not being collected from all Domain Controllers -
Description
'Last Logon' not being collected from all Domain Controllers, or timestamp recorded doesn't add up. -
Cause
When workstations that are not continually connected to Domain Controllers like in a "work from home" scenario, it is likely that the local logon cache for stored Kerberos tickets is being used to unlock Workstations. Additionally, a Pin for "Windows Hello" may be used to unlock the Desktop after the computer went to sleep state, not requiring to contact a DC.
A credential cache holds Kerberos credentials while they remain valid and, generally, while the user's session lasts, so that authenticating to a service multiple times (e.g., connecting to a web or mail server more than once) doesn't require contacting the KDC every time.
-
Resolution
To record exact log-on and log-off events, set the Group Policy to disallow the local Kerberos cache. This will require the workstation to connected to a DC before log-in, so for a "work from home" scenario, the VPN solution needs to be enabled during Windows Boot-Up. -
Additional Information
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available