If you use some other form of authentication you can probably get what you want. Doesn't Active Directory log more than you need to know about users? Try using, looking at, or writing an Auth extension.
Newer versions of Sun Directory Server (and OpenDS as well I think), will also track last login time.
V/r,
Ryan Lane