Last login

All, Here's one for you. In WGM, you can tell OD to disable an account after being inactive for X days. Where does that information (when the last login occurred) get stored? It doesn't seem to be in LDAP (a dscl read of a user record has no info about last login, or any date for that matter). I'd love to query this information so I can clear out crufty user accounts... but I don't know where to start. Thanks!