PowerShell Export Active Directory: Pulling Last Logon Data to CSV

Exporting Active Directory users’ last-logon information to CSV is a common ask — useful for identifying stale/inactive accounts, or general reporting.

Guide

First, import the Active Directory PowerShell module if you haven’t already:

Import-Module ActiveDirectory

Then export the data:

Get-ADUser -Filter * -Properties LastLogonDate,DisplayName,Enabled | Select DisplayName,SamAccountName,Enabled,LastLogonDate | Export-Csv -Path "C:\AD\LastLogon.csv" -NoTypeInformation

Important: LastLogonDate vs LastLogon

This uses LastLogonDate, which is replicated between domain controllers and is the practical choice for reporting — but it’s only updated periodically (not on every single logon) so it can be up to several days out of date. The raw LastLogon attribute is accurate to the exact logon but is not replicated between DCs, meaning you’d need to query every domain controller individually and take the most recent value to get a truly accurate picture. For most reporting purposes, LastLogonDate‘s approximate accuracy is more than good enough; only reach for the multi-DC LastLogon approach if you need precision down to the day.

The Entra ID Equivalent (Updated for 2026)

If you’re in a hybrid environment and also need last-logon data for cloud-only or Entra ID-synced accounts, the on-prem AD module won’t cover that — you need Microsoft Graph PowerShell instead:

Get-MgUser -All -Property signInActivity -Select DisplayName,UserPrincipalName,SignInActivity

The signInActivity property returns lastSignInDateTime and lastNonInteractiveSignInDateTime per user, giving you the Entra ID equivalent of LastLogonDate. Two things worth knowing before you rely on it: it requires an Entra ID P1 or P2 licence (it’s not available on the free tier), and the calling account/app needs the AuditLog.Read.All Graph permission granted.

Resources

• Active Directory