I needed
to clean out a bunch of old accounts at Veracity Solutions, and wanted
to delete those that hadn’t used their account in more than a year. I found that AD has a property on objects called the lastLogonTimestamp. However, this value isn’t exposed
to you in any useful fashion. Sure, you can pull up ADSI Edit and and eventually get
to it there, but it’s painful. I spent some time searching, and discovered that there’s not much out there
to help, so I thought a blog post showing exactly how
to get at this information would be in order. Basically, what you end up doing is using System.DirectoryServices
to search for accounts and then filtering those for users, doing some conversion and such
to make it happen. Basically, the end result of this is that you get a list of users with their logon information and you can then do with that what you will. I turned my list into an observable collection and bound it into a XAML form. One important note, you need
to add a reference
to ActiveDs Type Library in the COM section of the world in references
to get
to LargeInteger. Here’s the class: namespace Veracity.Utilities
{
using System;
using System.Collections.Generic;
using System.DirectoryServices;
using ActiveDs;
using log4net;
/// <summary>
/// Finds users inside of the active directory system.
/// </summary>
public class UserFinder
{
/// <summary>
/// Creates the default logger
/// </summary>
private static readonly ILog log = LogManager.GetLogger(typeof(UserFinder));
/// <summary>
/// Finds last logon information
/// </summary>
/// <param name="domain">The domain
to search.</param>
/// <param name="userName">The username for the query.</param>
/// <param name="password">The password for the query.</param>
/// <returns>A list of users with their last logon information.</returns>
public IList<UserLoginInformation> GetLastLogonInformation(string domain, string userName, string password)
{
IList<UserLoginInformation> result = new List<UserLoginInformation>();
DirectoryEntry entry = new DirectoryEntry(domain, userName, password, AuthenticationTypes.Secure);
DirectorySearcher directorySearcher = new DirectorySearcher(entry);
directorySearcher.PropertyNamesOnly = true;
directorySearcher.PropertiesToLoad.Add("name");
directorySearcher.PropertiesToLoad.Add("lastLogonTimeStamp");
SearchResultCollection searchResults;
try
{
searchResults = directorySearcher.FindAll();
}
catch (System.Exception ex)
{
log.Error("
Failed to do a find all.", ex);
throw;
}
try
{
foreach (SearchResult searchResult in searchResults)
{
DirectoryEntry resultEntry = searchResult.GetDirectoryEntry();
if (resultEntry.SchemaClassName == "user")
{
UserLoginInformation logon = new UserLoginInformation();
logon.Name = resultEntry.Name;
PropertyValueCollection timeStampObject = resultEntry.Properties["lastLogonTimeStamp"];
if (timeStampObject.Count > 0)
{
IADsLargeInteger logonTimeStamp = (IADsLargeInteger)timeStampObject[0];
long lastLogon =
(long)((uint)logonTimeStamp.LowPart + (((long)logonTimeStamp.HighPart) << 32));
logon.LastLogonTime = DateTime.FromFileTime(lastLogon);
}
result.Add(logon);
}
}
}
catch (System.Exception ex)
{
log.Error("
Failed to iterate search results.", ex);
throw;
}
return result;
}
}
}
Some important things
to note:
Username and Password can be set
to null and if your computer us part of the domain, this may still work.
Domain should be set
to something like LDAP://servername/CN=Users,CN=Domain,CN=com
You’re actually getting a com object back, so that’s why the LongInteger conversions are happening. The class for UserLoginInformation looks like this:
namespace Veracity.Utilities
{
using System;
/// <summary>
/// Represents user login information.
/// </summary>
public class UserLoginInformation
{
/// <summary>
/// Gets or sets Name
/// </summary>
public string Name { get; set; }
/// <summary>
/// Gets or sets LastLogonTime
/// </summary>
public DateTime LastLogonTime { get; set; }
/// <summary>
/// Gets the age of the account.
/// </summary>
public TimeSpan AccountAge
{
get
{
TimeSpan result = TimeSpan.Zero;
if (this.LastLogonTime != DateTime.MinValue)
{
result = DateTime.Now.Subtract(this.LastLogonTime);
}
return result;
}
}
}
}
I hope this is useful and instructive.
Technorati Tags: Active Directory
