Sample script that searches Active Directory for all the users who last logged off on or before October 1, 2007. The lastLogoff attribute is not replicated to the Global Catalog, meaning you cannot connect to a Global Catalog server and search across the forest for the last time a user logged off. In addition, this attribute is not replicated within a domain, meaning that the only way to determine the last time a user logged off is to contact each domain controller in the domain and retrieve the appropriate value.

Visual Basic
Edit|Remove
On Error Resume Next

Const ADS_SCOPE_SUBTREE = 2

dtmLogoffDate = "10/1/2007"

Set objShell = CreateObject("Wscript.Shell")
lngTimeZoneBias = objShell.RegRead("HKLM\System\CurrentControlSet\Control\" _
  & "TimeZoneInformation\ActiveTimeBias")
If UCase(TypeName(lngTimeZoneBias)) = "LONG" Then
  lngFinalBias = lngTimeZoneBias
ElseIf UCase(TypeName(lngTimeZoneBias)) = "VARIANT()" Then
  lngFinalBias = 0
  For k = 0 To UBound(lngTimeZoneBias)
    lngFinalBias = lngFinalBias + (lngTimeZoneBias(k) * 256^k)
  Next
End If

dtmNewDate = DateAdd("n", lngFinalBias, dtmLogoffDate)
lngSeconds = DateDiff("s", #1/1/1601#, dtmNewDate)
strModifiedLogoffDate = CStr(lngSeconds) & "0000000"

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 

objCommand.CommandText = _
    "SELECT Name FROM 'LDAP://dc=fabrikam,dc=com' WHERE objectClass='user' "  & _
        "AND lastLogoff<='" & strModifiedLogoffDate & "'" 
Set objRecordSet = objCommand.Execute

objRecordSet.MoveFirst
Do Until objRecordSet.EOF
    Wscript.Echo objRecordSet.Fields("Name").Value
    objRecordSet.MoveNext
Loop