Last login time of Windows Domain user who used Cached Credentials? -
the following snippet queries domain controller last login time of domain user account:
private static datetime lastlogontimeofdomainuser(string username, string domain) { datetime latestlogon = datetime.minvalue; directorycontext context = new directorycontext(directorycontexttype.domain, domain); string servername = null; domaincontrollercollection dcc = domaincontroller.findall(context); foreach (domaincontroller dc in dcc) { directorysearcher ds; using (dc) using (ds = dc.getdirectorysearcher()) { ds.filter = string.format("(samaccountname={0})", username); ds.propertiestoload.add("lastlogon"); ds.sizelimit = 1; searchresult sr = ds.findone(); if (sr != null) { datetime lastlogon = datetime.minvalue; if (sr.properties.contains("lastlogon")) { lastlogon = datetime.fromfiletime((long)sr.properties["lastlogon"][0]); }
let's suppose user has disconnected laptop lan , has re-logged-in using windows cached credentials.
how obtain time of last login using cached credentials (obviously must kept locally somewhere?)
i @ process creation time winlogon prefer find more correct way
Comments
Post a Comment