The best solution for user accounts would be to use the non-replicated lastLogon property and query all domain controllers. This would be a network intensive operation. Would you want to try that? I could incorporate that functionality in a couple days.
