Hi everybody, I have a problem with the AD system discovery. I have added the attribute lastLogonTimestamp, but for a lot of machines SCCM fails to retrieve the attribute from the computer account. A value exists in the computer account in AD DS for those machines. In the adsysdis.log I can see the following messages: INFO: discovered object with ADsPath = 'LDAP://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' WARN: Could not get property (domain) for system (0x80005010) WARN: Failed to get following optional attributes lastLogonTimestamp What can cause this?

What domain level is your AD domain at? Do you have multiple AD domains?Jason | http://blog.configmgrftw.com | Twitter @JasonSandys

Hi Jason, my domain functional level is server 2003, I have a root domain with 2 child domains.

Are all three domains at this level? Have you looked in AD to verify the attribute is populated for those objects?Jason | http://blog.configmgrftw.com | Twitter @JasonSandys

Does the computer account have the necessary permissions to query this attribute from AD? Maybe clients reside on a secured OU.

How can I verify this exactly?

Activate the advanced properties in AD Users and Computers and view the OU security settings.