Note

When retrieving the lastLongonTimeStamp from a single Active Directory domain controller, you are NOT getting the full picture, acoss all sites.

Immagine a head-office, with on-premise DCs, and staff interactively logging into window PCs all day, every day.. That specific on-prem DC will have the accurate logon data. A remote branch office DC, won't have any logon data for staff who don't use that site!