What does the lastlogon attribute show in AD?

Question

Active Directory

Hi all!
There is a question, in our AD each user has the lastlogon attribute.
On a quick look at how this attribute is updated, it became clear that it displays the time of the last user logon in the domain.
But we have a problem that prompted me to create this topic. I would like to know what mechanism is used to update this attribute.
I have a suspicion that it is updated, among other things, not only at the time when the user actually logs into the system (enters the login / password when entering the shell), but also when the computer, while in sleep, pulls the session for the programs running on it , such as Outlook or while closing a session on a computer.
Tell me, what is the mechanism for updating this attribute?

Answer 1

Last Logon attribute

This attribute is not replicated and is maintained separately on each domain controller in the domain. To get an accurate value for the user's last logon in the domain, the Last-Logon attribute for the user must be retrieved from every domain controller in the domain. The largest value that is retrieved is the true last logon time for that user.