“The LastLogonTimeStamp Attribute” – “What it was designed for and how it works”
1. (Assuming the value of the ms-DS-Logon-Time-Sync-Interval is at the default of 14)
2. User logs on to the domain
3. The lastLogontimeStamp attribute value of the user is retrieved
4. 14 - (Random percentage of 5) = X
5. Current date - value of lastLogontimeStamp = Y
6. X ≤ Y - update lastLognTimeStamp
7. X > Y - do not update lastLogontimeStamp