We have been tasked with a security requirement to display the last time a user was logged into the server upon login on our Windows 2003 and 2008 servers. This would apply to local and AD accounts. What is the best way to accomplish this? There doesn't appear to be any built in mechanism to do this and the best idea that we have found was the possibility of using a script with BgInfo.
SnapOverflow
A workaround that would work on both Server 2003 and 2008 would be to use BGInfo from sysinternal with the
getCurrentUserLastLoginTime.vbsscript from slingfive.com. You'll probably want to make sure you protect the script and the bginfo executable to make sure nobody plays tricks with your last login information.For Windows Server 2008: this article explains how to enable this feature.
Change this Group Policy setting if you want to write the information into the directory at logon:
Warning: For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level.
If you only had server 2008 DC's , so you could raise the domain functional level to Windows Server 2008 there is a quick and easy group policy setting to do this.
Unfortunately, if you Server 2003 DC's you need to look at the 'lastLogonTimeStamp' attribute of the user account.
use gpedit.msc, go to
Computer Configuration\Administrative Templates\Windows Components\Windows Logon Options\
disable this Display information about previous logons during user logon