Is it possible to get the date of a user's last login to AD if the user was deleted?

After STTR's very good explanations on how to get the dates of last login of existing (including disabled) AD users and how to retrieve the list of deleted users, One question remains.

Provided that logs are preserved long enough, is it possible to obtain the date when some particular deleted user logged in to AD for the last time? How?


Solution 1:

If you are running with Domain Functional Level 2008 and have Active Directory Recycle Bin enabled, this powershell command will work for accounts deleted in the last 6 months:

[datetime]::FromFileTime((Get-ADObject -Filter {SamAccountName -like "joeuser"} –IncludeDeletedObjects -prop *).lastLogonTimestamp)

Substitute the username for joeuser