We have an inactive user task which runs daily that disables accounts after 30 days of inactivity.
We had an example yesterday of a user account which had been disabled which had a last-logon-timestamp attribute value of 17/08/17. The last-logon attribute was displayed in the addaxes console as 14/07/17.
As we believed the addaxes inactive user task uses the last-logon-timestamp attribute to determine the period of inactivity we cannot work out why this happened.
We have checked the replication of the last-logon-timestamp attribute across all our DC's and it is consistent.
Are you able to provide any explanation of how this could have happened?