Last logon in AD

Question

!--startfragment>I recently onboarded several managed accounts into Password Safe and synchronized them with my secret cache. Since these accounts are designated as break-glass accounts and are not actively used, I wasn’t expecting to see a last logon in AD associated with them. Could you explain why that information is appearing? Maybe Password Safe password change process.!--endfragment>

Howard · Accepted Answer

These are some Windows Event Id which you can review on the last logon

https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0020966

You might also want to check if these managed account has auto managed enabled and a next change date value. The last change date can also tell you when was the password changed which might coincide with the logon date.