Computer Login Timestamp Reports

9 Reports
About Computer Login Timestamp Reports

Computer Login Timestamp Reports use the replicated lastLogonTimestamp attribute to track computer login activity. Unlike the non-replicated lastLogon attribute, the timestamp is available from any domain controller without needing to scan all DCs, though it may be up to 14 days behind the actual last logon.

Replicated Attribute

Available from any DC

Fast Queries

No multi-DC scanning needed

Stale Detection

Find inactive computers

lastLogonTimestamp vs lastLogon

The lastLogonTimestamp attribute is replicated across all domain controllers but may lag up to 14 days behind the actual logon time. For exact logon times, use the standard Computer Logon Status Reports which scan all DCs.

Example: Computer Login Timestamp Reports in AD Reports

AD Reports Computer Login Timestamp Reports

Available Reports

Never Logged on (Timestamp)

Never Logged on Computer Accounts (lastLogonTimestamp). Computers that have never authenticated to the domain based on the replicated timestamp attribute.

Use Cases
  • Identify computer accounts created but never joined to the domain
  • Detect orphaned pre-created computer accounts
  • Cleanup target for AD hygiene — reduce account sprawl
Key Information
  • Computer name and Distinguished Name
  • OU path and enabled/disabled status
  • Account creation date
  • Operating System
Note: Computer accounts that have never logged on may have been pre-staged for deployment but never used, or were created in error. Verify before deletion.
Never Logged on Enabled (Timestamp)

Never Logged on Enabled Computer Accounts (lastLogonTimestamp). Active computer accounts that have never authenticated — potential provisioning issues or stale pre-staged accounts.

Priority: Enabled accounts that have never authenticated are unexpected — either the machine was never deployed or the account was created incorrectly. Investigate each before disabling.
Never Logged on Disabled (Timestamp)

Never Logged on Disabled Computer Accounts (lastLogonTimestamp). Disabled computers that have never authenticated — candidates for deletion.

Cleanup: Disabled accounts that never authenticated are strong deletion candidates. Confirm with your asset management system before removing.
Inactive Computers for (Timestamp)

Computer accounts that have not logged on for at least N days (lastLogonTimestamp). Identify stale computer accounts that may need to be disabled or removed.

Use Cases
  • Find computers that haven't contacted the domain within your threshold (14-90 days)
  • Identify stale workstations due for decommission
  • Validate against asset inventory for compliance
Key Information
  • Computer name and Distinguished Name
  • Last logon timestamp date
  • Days since last logon
  • OU path and Operating System version
Important: The lastLogonTimestamp attribute can be up to 14 days behind actual activity. A computer appearing inactive here may have logged on within the past two weeks.
Inactive Enabled Computers for (Timestamp)

Enabled computer accounts that have not logged on for at least N days (lastLogonTimestamp). Active accounts that are not being used — priority cleanup targets.

Priority Review: Enabled but inactive computer accounts represent your highest-risk stale account category. Consider disabling before deletion after verifying with asset owners.
Inactive Disabled Computers for (Timestamp)

Disabled computer accounts that have not logged on for at least N days (lastLogonTimestamp). Already disabled and inactive — strong candidates for deletion.

Cleanup: Disabled and inactive computer accounts are safe deletion candidates after verifying they are not needed for rollback or forensic purposes.
Active Computers during last (Timestamp)

Computer accounts that have logged on during the last N days (lastLogonTimestamp). Your actively used computer population.

Use Cases
  • Generate an inventory of recently active machines in the domain
  • Validate that workstations are regularly checking in (domain connectivity health)
  • Support license compliance and asset management
Key Information
  • Computer name and Distinguished Name
  • Last logon timestamp date
  • Operating System and OU path
  • Enabled status
Note: Active computers in this report have a lastLogonTimestamp within your specified window. For real-time precision, use the Computer Logon Status report which queries all domain controllers.
Active Enabled Computers during last (Timestamp)

Enabled computer accounts that have logged on during the last N days (lastLogonTimestamp). Active and enabled — your healthy computer fleet.

Tip: Use this report as your authoritative active fleet inventory — these are the computers that are both enabled and recently checking in to the domain.
Active Disabled Computers during last (Timestamp)

Disabled computer accounts that have logged on during the last N days (lastLogonTimestamp). Recently active but now disabled — verify the disable action was intentional.

Investigate: A disabled computer that recently authenticated may indicate that the account was disabled incorrectly or that authentication occurred before the disable took effect. Verify with the device owner.
Related Reports
Computer Logon Status Reports Exact logon times from all DCs (lastLogon)
General Computer Reports Computer inventory, DNS names, descriptions
See These Reports in Action

Try AD Reports free for 14 days — run any of these reports on your own Active Directory.

Download Free Trial View All Features
Back to Report Library Back to Top