"The LastLogonTimeStamp" 특성 – 어떤 것이며 어떻게 동작하는가


???? : The LastLogonTimeStamp Attribute” ? “What it was designed for and how it works”


http://blogs.technet.com/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx


 


 


??(Warren)???. Windows Server 2003?? lastLogontimeStamp ??? ???????. ???? ???? ??? ??? ??? ???? ??? ??? ????lastLogontimeStamp ??? ??? ? ????. ? ??? ?? ???? ?? ???? ? ? ?? ????? ???? ??? ? ????. 


 


 


???? ??


 


lastLogontimeStamp ??? ???? ??? ???? ?? ???? ??? ??? ????? ??? ?? ??? ???? ?? ?????. lastLogon ??? ??? ??? ?? ?? ??? ????? ???? ?? ????. lastLogontimeStamp? ?? ??? ?? ???? 9~14? ?? ? ????.


 


????????? ???? ??? ??? ??? ???(528 – Windows XP/2003 ???4624 Windows Vista/2008)? DC? ?? ??? ???? ???? ??. ? ??? ??? Eric Fitzgerald? ???? ???? ???.(??? ??? ???)


 


??? ???? ?? ??? ??? ?????? ??????? ?? ??? ????? ?? ??? ??? ???? ??? ?? ?? ???? ???? ????. ???? ??? ??? ???? ?? ?? ???????? ??? ? ? ????. ?? ??? ?? ??? ?? Microsoft? ???? ?? ?? ???(Audit Collection Services)???. ??? ???? ?? ?? ????.


 


 


Windows 2000?? ??? ?????


 


Windows Server 2003 ???? ???? ?? ???? ???? ??? ??? ???? ?? lastLogon ??? ??????. ? ????? ?? ????? lastLogon ??? ??? ????? ??? ??? ??? ?? ?????? ???????. lastLogon ??? ???? ????. ??? ???? ?? ??? ?????? lastLogon ??? ???? ???? ??? ??? ??? ???? ???? lastLogon? ?? ??? ??? ??? ?? ????? ???????. Windows Server 2003 ????? lastLogon ? ??? ?? ??? ?? ????. ??? ??? ????? ????? ?????? ???? ????.


 


 


Windows Server 2003 ????? ??? ?????


 


??? lastLogontimeStamp ??? ????? ?? ??? ????? ??? ?? ?? ?? ??? ???.(????) ??? ?? ??? ??? ?? ?? ?? ???? ???? ?? ??? ?????? ??? ? ????.


 


 


????


 


llastLogontimeStamp? ?????? ???? Windows Server 2003 ??? ?? ????? ???.


 


 


lastLogontimeStamp ??? ????? ?? ??? ??


 


lastLogontimeStamp? ?? ??? ???? ?? ???? ??? ???? ?? ????. ?? ??? ???? ???? ??? ??? ?? ?????? ???? ?? ??? ???? ??? ????? ????? ????.


 


Interactive logons? Network logons? lastLogontimeStamp? ????? ????. ??? ?? ???? interactive ???? ??, ???? ??? ????, ??? ??? ???? LDAP ??? ????, lastLogontimeStamp ??? ?? ??? ???? ? ????. (? ??? ???? lastLogontimeStamp? ????? ?? ???? ?? ????)


 


Windows Server 2003 SP1??? ??? ?? ??? ???? lastLogontimeStamp? ?????? ????.


 


l  Microsoft Internet Information Services (IIS)? ?? ??? ??


l  IIS? ?? Microsoft .NET ??


 


[2009? 7? 19? ???? – repro? ??? ??? ?? ??? ???? ??? ??? ??????]


 


====================================================


 


lastLogontimeStamp? ????? ??


 


 


??? ms-DS-Logon-Time-Sync-Interval ??? ?????. ??? ??? NC? ???? lastLogontimeStamp ??? ???(??) ?????? ?? ?????. ???? 14?? ??? ???? ????. ADSIEDIT.MSC?? ? ??? ???? “Not Set”? ?? ??? ??? ???. ??? ????? ????? 14? ????? ?????.


 


lastLogontimeStamp ??? ???? ???? ???? ??????? ?? ?????? ????. ?? ?????? ?? ???? ?? ?? ?? ?? (ms-DS-Logon-Time-Sync-Interval attribute ?? ??? 5% ?)? ?????. ?? ??? lastLogontimeStamp ? ??? ??? ??? ???????. lastLogontimeStamp ??? ?? ??? ??? ????. ?? ??? ?????? ?? ?? ?????? ??? ????. ??? ??? ??? ????.


 


 


lastLogontimeStampUpdate? ???? ?? ?????.


 


1. (ms-DS-Logon-Time-Sync-Interval? ?? ???? 14?? ?????.)


 


2. ???? ???? ??????.


 


3. ???? lastLogontimeStamp ?? ?? ?????.


 


4. 14 – (5% ???) = X


 


5. ?? ?? – lastLogontimeStamp? ? = Y


 


6. X = Y – lastLognTimeStamp ???? ?


 


7. X > Y – lastLogontimeStamp ???? ?? ??


 


 


? ???? ??????


 


?? ?? ??? ?? ??? ?????? ??? ???? ??? lastLogontimeStamp ??? ?????? ?? ???? ??? ???? ?????. lastLogontimeStamp ??? ??? ??? ??? ??? ???? ?? ??? ???? ?? ??? ???? ???? ?? ?????.


 


 


lastLogontimeStamp? ???? ?? ????


 


lastLogontimeStamp? ???? ??? ????? ???? ??? ???? ?? ?? ?????. ?? ?? ?? ??? ????? msDS-LogonTimeSyncInterval ??? ?? 5~100,000??? ??? ? ????. ?? ?? 100,000 ?????? ?? 280? ?? ????? ?? ?? ??? ?????? ????? ????.


 


? ????? ?? ??? ???? ????? ???? ???? ??? ??? ??? ?????. ?? ??? ?? ???? ??? ??? 30? ?? ? ??? ?? ????? ???? ?? ??? ??????.


 


?? : ?? msDS-LogonTimeSyncInterval? 5? ????, ???? ??? ?? ????.


 


 


? ??? ???? ???? ??? ????


 


?? msDS-LogonTimeSyncInterval ??? ???? ???? msDS-LogonTimeSyncInterval ??? 0?? ???? ???.


 


????? lastLogontimeStamp? ???? ??? ???? ???? ??? ?????? ????. ???? ???? ????? ????? ??? ?? ??? ????? ?????. ?? ??? ???? ?? ??? ?? 9~14??? ??? timestamp? ????? DC ??? ??????? ?????. ??? ??? ??? ?????.


 


=======================================


 


?? ??? – LastLogontimeStamp ????? ????? ?? ??? ????? ??????.


 


???? ??? (????? ?? ??? ???) ???? ??? ??? ?????. ??? ??? ???? lastLogontimeStamp ?? ??? lastLogon ??? ???? ??? ???? ?????.


 


?? ?? ?? ?? ??? ??? acctinfo.dll? lastLogontimeStamp ???? ?? lastLogon ?? ???? ?????. ?? ???? ??? ???? ??? ? ?? ? ?? ???? ???? ????. ??? lastLogon ??? ???? ???? ????? ???? ???? ??? ?????? ???? ????(? ??? null???) ???? ??? ?????? ?? ???? ???? ??? ?????.


 


 


 


lastLogontimeStamp? ??? ????


 


lastLogonTimeStamp? ?????? ????? ??? ?? ????? repadmin.exe? showattr ???? ?? ? ? ????. ??? ??? ?? ?????. lastLogontimeStamp? 9~14? ??? ?????? ????? ?? ??? ????? ???? ?? ?????. ??? ???? ?? ??? ???? ??? ????.


 


1. ??? ???? ?? ?? ??? ?????? lastLogontimeStamp? ?? repadmin? ?? ?????.


 


repadmin /showattr * (DN of the target user) /attrs:lastLogontimeStamp >lastLogontimeStamp.txt


 


??


 


repadmin /showattr * CN=user1,OU=accounting,DC=domain,dc=com /attrs:lastLogontimeStamp >lastLogontimeStamp.txt


 


 


2. lastLogontimeStamp ??? ???? ?? ???? ???? ??? ?? ?? ???? lastLogontimeStamp? repadmin? ?? ?????.


 


repadmin /showattr * /subtree /filter:”(&(objectCategory=Person)(objectClass=user))” /attrs:lastLogontimeStamp >lastLogontimeStamp.txt


 


 


3. ??? ??? ???? lastLogonTimeStamp? ?????.


 


repadmin /showattr * dc=domain,dc=com /subtree /filter:”((&(lastLogontimeStamp=*)(objectCategory=Person)(objectClass=user)))” /attrs:lastLogontimeStamp > lastLogontimeStamp-2-22-2009.txt


 


 


– Warren ‘For Once not DFSR’ Williams


 

Comments (0)