Event 5136 does not record logon time
Every successful logon is recorded in Event 4624 but does not necessarily update the lastLogonTimestamp
attribute (nor its human-friendly version LastLogonDate
). Even when it gets updated (after ms-DS-Logon-Time-Sync-Interval
minus a random percentage of 5 has passed), Event 5136 (a directory service object was modified) will not capture it.