Last Logon Report

The last logon report has userAccountControl and employeeType flags similar to the password last set report. By default it only considers lastLogonTimestamp, but this can be customized to also view lastLogon. 

This report can be used to show:

• Users that have never logged in
• Users that have logged in recently
• Users that have NOT logged in recently

This report requires the AD Users Base report.

{
  "Data": [
    {
      "$type": "SoftwareIDM.ReportingModule.Models.Report, SoftwareIDM.ReportingModule",
      "Id": "4567a1c3-a44f-4366-a753-f89e1fbeb38d",
      "Name": "Last Logon",
      "UserId": null,
      "UserProfile": false,
      "Tags": null,
      "Roles": null,
      "CacheExpiration": "12:00:00",
      "Description": "Report filtering users by account expiration range. Supports optional filtering on userAccountControl flags and employeeType, as well as before and after time ranges relative to the present.",
      "Parameters": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
          "ValueChoices": [
            "PASSWD_NOTREQD",
            "PASSWD_CANT_CHANGE",
            "ACCOUNTDISABLE",
            "NORMAL_ACCOUNT",
            "INTERDOMAIN_TRUST_ACCOUNT",
            "DONT_EXPIRE_PASSWORD",
            "SMARTCARD_REQUIRED",
            "TRUSTED_FOR_DELEGATION",
            "PASSWORD_EXPIRED",
            "*"
          ],
          "Name": "Flag",
          "Description": "",
          "Required": false,
          "Validation": "",
          "DefaultValue": ""
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.SelectReportParameter, SoftwareIDM.ReportingModule",
          "ValueChoices": [
            "A",
            "C",
            "SVC",
            "*"
          ],
          "Name": "Employee Type",
          "Description": "",
          "Required": true,
          "Validation": "",
          "DefaultValue": ""
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
          "Name": "Logon Before",
          "Description": "Enter 'Never' or a timespan to subtract from present e.g. '365.00:00:00'",
          "Required": false,
          "Validation": "",
          "DefaultValue": "0.00:00:00"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.TextReportParameter, SoftwareIDM.ReportingModule",
          "Name": "Logon After",
          "Description": "Enter 'Never' or a timespan to subtract from present e.g. '365.00:00:00'",
          "Required": false,
          "Validation": "",
          "DefaultValue": "Never"
        }
      ],
      "DataSets": [],
      "ReportSets": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.ReportData, SoftwareIDM.ReportingModule",
          "Name": "AD",
          "Report": "cb5036bf-5ee6-43b0-b6ee-9fba04c3ea3b"
        }
      ],
      "Relations": [],
      "FieldProjections": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DN",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "$\"{TimeTraveler(Id)}|{DN}\""
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeID",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "employeeID"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "EmployeeType",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "employeeType"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "DisplayName",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "displayName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "AccountName",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "sAMAccountName"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "UserAccountControl",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "userAccountControl"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "LastLogon",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "// Can also do something like FirstNotNull(lastLogonTimestamp, lastLogon)\nIf(\n  Not(lastLogonTimestamp),\n  \"Never\",\n  DateTimeFormat(FromFileTime(lastLogonTimestamp), \"yyyy-MM-dd\")\n)"
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Projection, SoftwareIDM.ReportingModule",
          "Name": "Manager",
          "RelationName": "",
          "RelationSide": null,
          "ValueRule": "$\"{TimeTraveler(manager)}|{managerDN}\""
        }
      ],
      "Transformations": [
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "If(Memo(\"Flag\") == \"*\", true, Contains(UserAccountControl, Memo(\"Flag\")))",
          "GroupingRule": "",
          "TransformRules": []
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "If(Memo(\"Employee Type\") == \"*\", true, EmployeeType == Memo(\"Employee Type\"))",
          "GroupingRule": "",
          "TransformRules": []
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "Or(Not(Memo(\"Logon Before\")), LastLogon == \"Never\", AddTime(Today(), \"-\" + Memo(\"Logon Before\")) > LastLogon)",
          "GroupingRule": "",
          "TransformRules": []
        },
        {
          "$type": "SoftwareIDM.ReportingModule.Models.Transform, SoftwareIDM.ReportingModule",
          "FilterRule": "Or(Not(Memo(\"Logon After\")), And(LowerCase(Memo(\"Logon After\")) == \"never\", LastLogon == \"Never\"), AddTime(Today(), \"-\" + Memo(\"Logon After\")) < LastLogon)",
          "GroupingRule": "",
          "TransformRules": []
        }
      ],
      "Styles": [],
      "Sort": {
        "Field": "EmployeeID",
        "Direction": "Ascending"
      }
    }
  ],
  "Count": 1
}