"The LastLogonTimeStamp" 특성 - 어떤 것이며 어떻게 동작하는가
???? : “The LastLogonTimeStamp Attribute” ? “What it was designed for and how it works”
??(Warren)???. Windows Server 2003?? lastLogontimeStamp ??? ???????. ???? ???? ??? ??? ??? ???? ??? ??? ????lastLogontimeStamp ??? ??? ? ????. ? ??? ?? ???? ?? ???? ? ? ?? ????? ???? ??? ? ????.
???? ??
lastLogontimeStamp ??? ???? ??? ???? ?? ???? ??? ??? ????? ??? ?? ??? ???? ?? ?????. lastLogon ??? ??? ??? ?? ?? ??? ????? ???? ?? ????. lastLogontimeStamp? ?? ??? ?? ???? 9~14? ?? ? ????.
?? "???" ???? ???? ??? ??? ??? ???(528 - Windows XP/2003 ???4624 Windows Vista/2008)? DC? ?? ??? ???? ???? ??. ? ??? ??? Eric Fitzgerald? ???? ???? ???.(??? ??? ???)
??? ???? ?? ??? ??? ?????? ??????? ?? ??? ????? ?? ??? ??? ???? ??? ?? ?? ???? ???? ????. ???? ??? ??? ???? ?? ?? ???????? ??? ? ? ????. ?? ??? ?? ??? ?? Microsoft? ???? ?? ?? ???(Audit Collection Services)???. ??? ???? ?? ?? ????.
Windows 2000?? ??? ?????
Windows Server 2003 ???? ???? ?? ???? ???? ??? ??? ???? ?? lastLogon ??? ??????. ? ????? ?? ????? lastLogon ??? ??? ????? ??? ??? ??? ?? ?????? ???????. lastLogon ??? ???? ????. ??? ???? ?? ??? ?????? lastLogon ??? ???? ???? ??? ??? ??? ???? ???? lastLogon? ?? ??? ??? ??? ?? ????? ???????. Windows Server 2003 ????? lastLogon ? ??? ?? ??? ?? ????. ??? ??? ????? ????? ?????? ???? ????.
Windows Server 2003 ????? ??? ?????
??? lastLogontimeStamp ??? ????? ?? ??? ????? ??? ?? ?? ?? ??? ???.(????) ??? ?? ??? ??? ?? ?? ?? ???? ???? ?? ??? ?????? ??? ? ????.
????
llastLogontimeStamp? ?????? ???? Windows Server 2003 ??? ?? ????? ???.
lastLogontimeStamp ??? ????? ?? ??? ??
lastLogontimeStamp? ?? ??? ???? ?? ???? ??? ???? ?? ????. ?? ??? ???? ???? ??? ??? ?? ?????? ???? ?? ??? ???? ??? ????? ????? ????.
Interactive logons? Network logons? lastLogontimeStamp? ????? ????. ??? ?? ???? interactive ???? ??, ???? ??? ????, ??? ??? ???? LDAP ??? ????, lastLogontimeStamp ??? ?? ??? ???? ? ????. (? ??? ???? lastLogontimeStamp? ????? ?? ?? ?? ?? ????)
Windows Server 2003 SP1??? ??? ?? ??? ???? lastLogontimeStamp? ???? ?? ???? .
l Microsoft Internet Information Services (IIS)? ?? ??? ??
l IIS? ?? Microsoft .NET ??
[2009? 7? 19? ???? - repro? ??? ??? ?? ??? ???? ??? ??? ??????]
====================================================
lastLogontimeStamp? ????? ??
??? ms-DS-Logon-Time-Sync-Interval ??? ?????. ??? ??? NC? ???? lastLogontimeStamp ??? ???(??) ?????? ?? ?????. ???? 14?? ??? ???? ????. ADSIEDIT.MSC?? ? ??? ???? "Not Set"? ?? ??? ??? ???. ??? ????? ????? 14? ????? ?????.
lastLogontimeStamp ??? ???? ???? ???? ??????? ?? ?????? ????. ?? ?????? ?? ???? ?? ?? ?? ?? (ms-DS-Logon-Time-Sync-Interval attribute ?? ??? 5% ?)? ?????. ?? ??? lastLogontimeStamp ? ??? ??? ??? ???????. lastLogontimeStamp ??? ?? ??? ??? ????. ?? ??? ?????? ?? ?? ?????? ??? ????. ??? ??? ??? ????.
lastLogontimeStampUpdate? ???? ?? ?????.
1. (ms-DS-Logon-Time-Sync-Interval? ?? ???? 14?? ?????.)
2. ???? ???? ??????.
3. ???? lastLogontimeStamp ?? ?? ?????.
4. 14 - (5% ???) = X
5. ?? ?? - lastLogontimeStamp? ? = Y
6. X = Y - lastLognTimeStamp ???? ?
7. X > Y - lastLogontimeStamp ???? ?? ??
? ???? ??????
?? ?? ??? ?? ??? ?????? ??? ???? ??? lastLogontimeStamp ??? ?????? ?? ???? ??? ???? ?????. lastLogontimeStamp ??? ??? ??? ??? ??? ???? ?? ??? ???? ?? ??? ???? ???? ?? ?????.
lastLogontimeStamp? ???? ?? ????
lastLogontimeStamp? ???? ??? ????? ???? ??? ???? ?? ?? ?????. ?? ?? ?? ??? ????? msDS-LogonTimeSyncInterval ??? ?? 5~100,000??? ??? ? ????. ?? ?? 100,000 ????... ?? ?? 280? ?? ??... ??? ?? ?? ??? ?????? ????? ????.
? ????? ?? ??? ???? ????? ???? ???? ??? ??? ??? ?????. ?? ??? ?? ???? ??? ??? 30? ?? ? ??? ?? ????? ???? ?? ??? ??????.
?? : ?? msDS-LogonTimeSyncInterval? 5? ????, ???? ??? ?? ????.
? ??? ???? ???? ??? ????
?? msDS-LogonTimeSyncInterval ??? ???? ???? msDS-LogonTimeSyncInterval ??? 0?? ???? ???.
????? lastLogontimeStamp? ???? ??? ???? ???? ??? ?????? ????. ???? ???? ????? ????? ??? ?? ??? ????? ?????. ?? ??? ???? ?? ??? ?? 9~14??? ??? timestamp? ????? DC ??? ??????? ?????. ??? ??? ??? ?????.
=======================================
?? ??? - LastLogontimeStamp ????? ????? ?? ??? ????? ??????.
???? ??? (????? ?? ??? ???) ???? ??? ??? ?????. ??? ??? ???? lastLogontimeStamp ?? ??? lastLogon ??? ???? ??? ???? ?????.
?? ?? ?? ?? ??? ??? acctinfo.dll? lastLogontimeStamp ???? ?? lastLogon ?? ???? ?????. ?? ???? ??? ???? ??? ? ?? ? ?? ???? ???? ????. ??? lastLogon ??? ???? ???? ????? ???? ???? ??? ?????? ???? ????(? ??? null???) ???? ??? ?????? ?? ???? ???? ??? ?????.
lastLogontimeStamp? ??? ????
lastLogonTimeStamp? ?????? ????? ??? ?? ????? repadmin.exe? showattr ???? ?? ? ? ????. ??? ??? ?? ?????. lastLogontimeStamp? 9~14? ??? ?????? ????? ?? ??? ????? ???? ?? ?????. ??? ???? ?? ??? ???? ??? ????.
1. ??? ???? ?? ?? ??? ?????? lastLogontimeStamp? ?? repadmin? ?? ?????.
repadmin /showattr * (DN of the target user) /attrs:lastLogontimeStamp >lastLogontimeStamp.txt
??
repadmin /showattr * CN=user1,OU=accounting,DC=domain,dc=com /attrs:lastLogontimeStamp >lastLogontimeStamp.txt
2. lastLogontimeStamp ??? ???? ?? ???? ???? ??? ?? ?? ???? lastLogontimeStamp? repadmin? ?? ?????.
repadmin /showattr * /subtree /filter:"(&(objectCategory=Person)(objectClass=user))" /attrs:lastLogontimeStamp >lastLogontimeStamp.txt
3. ??? ??? ???? lastLogonTimeStamp? ?????.
repadmin /showattr * dc=domain,dc=com /subtree /filter:"((&(lastLogontimeStamp=*)(objectCategory=Person)(objectClass=user)))" /attrs:lastLogontimeStamp > lastLogontimeStamp-2-22-2009.txt
- Warren ‘For Once not DFSR’ Williams