最后我找到了解决方案。
要访问 lastLogon (以及此类 AD 变量),首先必须设置一个接收当前 AD 用户对象的对象:
Set objUser = GetObject(rs.Fields("adspath").Value)
...
那么 lastLogon 也必须设置为一个对象:
Set objLastLogon = objUser.Get("lastLogonTimeStamp")
此 OLE 对象将有一个 HighPart 和一个 LowPart 成员。使用该成员可以计算上次登录日期和时间。
这篇博文让我大开眼界:
http ://sgwindowsgroup.org/blogs/badz/archive/2010/03/01/querying-for-the-lastlogontimestamp-attribute-of-all-users-in-an-ou.aspx
这是我实现的功能,可以接收特定用户的CN和lastLogonTimeStamp。
Sub getADUserLastLogon(sUser As String)
Dim workspace As New NotesUIWorkspace
Dim conn As Variant
Dim sRoot As String
sRoot = "LDAP://ou=USERS_OR_WHATEVER,dc=my,dc=domain"
Set oConn = CreateObject("ADODB.Connection")
oConn.Provider = "ADSDSOObject"
oConn.Open "Ads Provider", "USERNAME", "SECRETPWD" ' open connection with specific user credentials
Dim rs
Set rs = oConn.Execute("<" & sRoot & ">;(&(objectCategory=person)(objectClass=user)(cn=" & sUser & "));" &_
"adspath,distinguishedname,sAMAccountName,cn,mail,telephoneNumber,lastLogonTimeStamp;subtree")
While Not (rs.EOF)
On Error Resume Next
Set objUser = GetObject(rs.Fields("adspath").Value)
'Print "getting user: " & objUser.Get("cn")
Set objLastLogon = objUser.Get("lastLogonTimeStamp")
Dim intLastLogonTime As Double
intLastLogonTime = (objLastLogon.HighPart * (2^32)) + objLastLogon.LowPart ' due to the 64 bit number
intLastLogonTime = intLastLogonTime / (60 * 10000000) ' convert from 100nanosec to minutes
intLastLogonTime = intLastLogonTime + 60 ' local timezone
intLastLogonTime = intLastLogonTime / 1440 ' convert to hours
intLastLogonTime = intLastLogonTime + Datenumber(1601,1,1)
Call workspace.CurrentDocument.Document.ReplaceItemValue("txtADResult", _
workspace.CurrentDocument.FieldGetText("txtADResult") & Chr(13) & _
rs.Fields("cn").Value & " Last Logon: " & Format$(Cdat(intLastLogonTime), "yyyy.mm.dd. hh:nn:ss"))
rs.MoveNext
Wend
End Sub