8 August 2026

Active Directory: lastLogon and lastLogonTimestamp Are Not the Same Thing

Why Active Directory exposes multiple logon attributes and why choosing the wrong one can give misleading results.

When looking for inactive Active Directory accounts, it is tempting to retrieve a logon attribute and assume it represents the user’s exact last authentication.

It is not that simple.

Two commonly encountered attributes are:

lastLogon
lastLogonTimestamp

The important operational distinction is that lastLogon is maintained per domain controller rather than being a single replicated exact value.

That means finding the most recent lastLogon can require querying the relevant domain controllers and taking the newest result.

lastLogonTimestamp, on the other hand, is designed to provide replicated information suitable for identifying broadly stale accounts rather than an exact real-time audit timestamp.

So the question comes first:

Do I need:
    ↓
an exact/latest logon investigation?
or
a scalable stale-account indicator?

The attribute should follow the use case.

This is also why an Active Directory cleanup script should document exactly which logon signal it is using rather than exposing a column simply labelled Last Logon.