When you enable last login time tracking using the password policy attribute pwdKeepLastAuthTime(5dsat), Directory Server records the time of the last successful authentication in the operation attribute pwdLastAuthTime(5dsat) on the user entry.