lastlogon question

[uminds]

Not sure if this has been answered before. The LS report grabs the lastlogon attribute from AD. Since this attribute is not be replicated, does LS check all the domain controllers and take the one with the latest date? Or it just scan the default 

[Mister_Nobody]

I think yes!

[uminds]

Thanks, do you have any reference on this?

[Mister_Nobody]

I can't remember where I saw it.

But you can sniff LDAP traffic.