Be very cautious in using lastlogon. This value is unique on each domain controller. It is not replicated. You will have have to check every DC then find the highest value to get the true lastlogon value.
See this link near the bottom for confirmation of my statement.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adschema/adschema/a_lastlogon.asp
