Interactive Windows Logon Sessions

Q: What is an interactive Windows logon session and how can users start an interactive logon session? Are there any Group Policy Object (GPO) settings I can use to control user interactive logons in my Active Directory (AD) environment? Can you also tell me where a user’s last interactive logon time is stored in AD?

A: An interactive Windows logon session is the result of an interaction between a user and the Windows OS. An interactive logon session is always initiated by a user and tells Windows that the user wants to authenticate either to a local machine or to a domain. Following this user action, Windows will prompt the user for a set of authentication credentials. Because of the interaction between the OS (requesting credentials) and the user (providing credentials), Microsoft calls this method of starting an authentication process "interactive” logon. Interactive logon is also referred to as "local logon." A successful interactive logon results in a logon session. In Windows, a user can start an interactive authentication or logon process in different ways:

There are interactive logon scenarios in which the interaction between the user and the authentication server remains hidden. For example, you can save the username and password that you use to connect to a remote desktop computer object, so you don’t have to retype it. Also, Windows allows you to automate the logon process at system startup by storing a username and password in the registry. This feature is known as autologon. In XP, autologon can be enabled from the GUI: Simply select the “Users must enter a user name and password to use this computer” checkbox in the Windows XP User Accounts dialog box. To call the Windows XP User Accounts dialog box from the command line, type:

  control userpasswords2.   

Look at the Microsoft article "How to turn on automatic logon in Windows" at http://support.microsoft.com/?id=324737 to learn how you can enable autologon from the system registry.

Table 1, below, lists the GPO settings you can use to control interactive logon in a Windows AD environment and their recommended values. All settings are located in the Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options GPO container.

AD stores a user’s last logon time in the LastLogon AD user object attribute. Like the case for the logging of account logon events in the Windows Event Viewer, the last logon time is only updated in the AD instance of the DC that authenticated the user. That is why you must query all DCs in a user’s definition domain to find out the user’s last logon time.

In Windows Server 2003, Microsoft included a new AD user object attribute called LastLogonTimeStamp that resolves the LastLogon problem outlined above to a certain extent… LastLogonTimeStamp stores the "approximate" value of the last logon of a user to other DCs. The value is approximate because AD replicates it only once every 14 days to avoid replication overhead. So even though LastLogonTimeStamp doesn't resolve the LastLogon problem completely, at least it gives administrators a way to discover inactive accounts that have not logged on in the last few weeks. The LastLogonTimeStamp attribute is only activated when the domain is switched to the Windows 2003 domain functional level. See the following Microsoft Technet reference for more information: http://www.microsoft.com/technet/scriptcenter/topics/win2003/lastlogon.mspx.

Table 1: Table 1: Interactive Logon Related GPO Settings