Added days_since_last_logon attribute to Windows ntuser test

[vanderpol]

Added element per discussions with @solind

[solind]

Is "rounded" too ambiguous? I think if it's been < 24 hrs since the last login, perhaps this should be 0, less than 48 hrs than 1, etc. Kind of like the proverbial "days since last accident" sign on a jobsite.

[vanderpol]

Is "rounded" too ambiguous? I think if it's been < 24 hrs since the last login, perhaps this should be 0, less than 48 hrs than 1, etc. Kind of like the proverbial "days since last accident" sign on a jobsite.

Sounds reasonable, how about

The last_logon data, converted to days and then rounded down to the nearest integer (floor function). If the account is determined to be currently logged in, this date should be reported as 0.

[solind]

Works for me.