# Can you query AD with Elastic to see Last Logon time? **URL:** \ **Category:** Elasticsearch\ **Created:** [February 22, 2023, 9:49pm UTC](https://discuss.elastic.co/t/can-you-query-ad-with-elastic-to-see-last-logon-time/326230 "2023-02-22T21:49:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Mahigs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mahigs/32/116177_2.png) [@Mahigs](https://discuss.elastic.co/u/Mahigs)\ **Post date:** [February 22, 2023, 9:49pm UTC](https://discuss.elastic.co/t/can-you-query-ad-with-elastic-to-see-last-logon-time/326230/1 "2023-02-22T21:49:44Z")
Relatively new to Elastic and all that it can do. Our team is trying to query Active Directory with Elastic so that we can view user's last logon time. We're trying to satisfy DoD requirements relating to accounts needing to be disabled after a certain amount of days and the disablement of temporary/emergency accounts. Is there an Elastic capability that can do this? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 22, 2023, 9:58pm UTC](https://discuss.elastic.co/t/can-you-query-ad-with-elastic-to-see-last-logon-time/326230/2 "2023-02-22T21:58:30Z")
You need to be using winlogbeat to pull this data from the event logs and then send them to Elasticsearch, so yes 🙂 (I replied with this in your reddit thread) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 22, 2023, 9:59pm UTC](https://discuss.elastic.co/t/can-you-query-ad-with-elastic-to-see-last-logon-time/326230/3 "2023-03-22T21:59:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.