As I'm sure most of us are aware, the LastLogonTimeStamp attribute is meant to store the last time a user/computer logged on. When the user gets authenticated by a DC, this attribute on their account gets set to the current date/time.
Although it represents a date/time, it is actually stored as a number (a 64 bit Integer to be precise), so theoretically it could actually be set to a number that does not represent a date... and it seems that sometimes the "system" sometimes does
indeed set it to something completely invalid like this:
Image may be NSFW.
Clik here to view.
I've seen this happen twice now and in two completely separate organisations, but both instances were within the last month. Interestingly in both cases it was a service account that the issue was on (not sure if they were Managed Service Accounts or just regular
user accounts created only to run services). EDIT: Seems like someone else
had the same issue a few years ago so I guess its not a new thing.
Anyway, I realise its very unlikely anyone will have an idea of what caused this but what I'm wondering is: how can it be fixed? The attribute is owned by the system, so we cannot manually edit it. Is there any way to override this and modify an attribute that is owned by the system?
Thanks
Chris
My website (free apps I've written for IT Pro's) : www.cjwdev.co.uk My blog: cjwdev.wordpress.com
