Active Directory - User last logon
AD Account Last Logon
Query
IdentityInfo
| summarize arg_max(Timestamp, *) by AccountObjectId
| join kind=leftouter (
IdentityLogonEvents
| where Application == @"Active Directory"
| extend LastLogonTime = Timestamp
| summarize arg_max(Timestamp, *) by AccountObjectId, AccountSid, AccountDomain
| where ActionType == @"LogonSuccess")
on $left.AccountObjectId == $right.AccountObjectId
| extend NoLogon = iff(isempty(LastLogonTime), "True", "False")
| project
AccountName,
AccountDomain,
AccountObjectId,
LastLogonTime,
Type,
DistinguishedName,
IsAccountEnabled,
CreatedDateTime,
NoLogon
| where NoLogon == "True"About this query
Active Directory - User last logon
Query Information
MITRE ATT&CK Technique(s)
| Technique ID | Title | Link |
|---|---|---|
| T1110.003 | Credential Access: Brute Force: Password Spraying | https://attack.mitre.org/techniques/T1110/003/ |
Description
Use the below query to identify User account last logon activity. Those that did not have activity for the defined lookback period can be considered to be disabled depending on your company policies.
References
Microsoft Defender XDR
Explanation
This KQL query is designed to identify user accounts in Active Directory that have not logged on within a specified period. Here's a simple breakdown of what the query does:
-
Data Source: The query uses two tables:
IdentityInfoandIdentityLogonEvents. -
Summarization:
- It first summarizes the
IdentityInfotable to get the most recent information for each user account byAccountObjectId. - It then summarizes the
IdentityLogonEventstable to find the most recent successful logon event for each user account, specifically for those using Active Directory.
- It first summarizes the
-
Joining Data:
- The query performs a left outer join between the summarized
IdentityInfoandIdentityLogonEventstables based on theAccountObjectId. This means it keeps all records fromIdentityInfoand matches them with logon events if available.
- The query performs a left outer join between the summarized
-
Determine Logon Status:
- It checks if there is a
LastLogonTimefor each account. If there isn't, it marks the account withNoLogonas "True", indicating no logon activity.
- It checks if there is a
-
Projection and Filtering:
- The query projects (selects) specific fields such as
AccountName,AccountDomain,AccountObjectId,LastLogonTime, and others. - It filters the results to only show accounts where
NoLogonis "True", meaning these accounts have not logged on recently.
- The query projects (selects) specific fields such as
-
Purpose:
- The main goal is to identify user accounts that have not logged on within a certain timeframe, which could indicate they are inactive or should be disabled according to company policies.
This query helps in maintaining security and compliance by identifying potentially inactive accounts that might need attention.
