Run as Administrator vs. AD Last Logon Date: Understanding User Account Types

User Account Types

Local Administrator Account: A local administrator account is created on an individual machine to manage its local settings and permissions. It is not linked to the Active Directory domain. For instance, let's consider the user account CONTOSO\Panki. If Panki is a local administrator on a computer, they will have separate user local admin permissions.

Local Administrator Permissions

Local administrators have complete control over the local machine. They can install software, create user accounts, manage group policies, and perform other administrative tasks. However, these permissions only apply to the local machine. To manage other machines, an administrator would need to log in locally or remotely using other tools.

Active Directory User Accounts

Active Directory User Account: An Active Directory user account is a domain user account that is created and managed within the Active Directory environment. These accounts are linked to the domain and provide access to network resources, such as file shares, printers, and applications.

Active Directory Permissions

Active Directory user accounts can be assigned various permissions based on their membership in Active Directory groups. These groups determine the level of access users have to specific resources. For example, a user might be a member of a group that grants them access to a shared folder, while another user might belong to a group that allows them to manage a specific application.

Determining Last Logon Dates

To determine the last logon date for a local administrator account, you would need to log in locally or use a tool like the net user command in an elevated command prompt. For Active Directory user accounts, you can use various tools, such as the dsquery command, PowerShell scripts, or the Active Directory Users and Computers console.

Tools for Determining Last Logon Dates

• Net User: To check the last logon date for a local administrator account, open an elevated command prompt and type:

net user  query

• DSQuery: To find the last logon date for an Active Directory user account, use the following PowerShell command:

Import-Module ADDSDeployment; Get-ADUser  -Properties lastLogon -Filter * | Select-Object Name, lastLogon

Other tools and resources for managing and determining user account types and last logon dates include:

• Net User Command
• DSQuery PowerShell Module
• PowerBI PowerShell Module
• Active Directory Users and Computers Console