curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity
blog/source/_posts/2025-01-12.md

975 B
Raw Blame History

title date
Event 5136 does not record logon time 2025-01-12

Every successful logon is recorded in Event 4624 but does not necessarily update the lastLogonTimestamp attribute (nor its human-friendly version LastLogonDate). Even when it gets updated (after ms-DS-Logon-Time-Sync-Interval minus a random percentage of 5 has passed), Event 5136 (a directory service object was modified) will not capture it.