Home / server / Questions / 660099
Accepted
Rowland Shaw
Asked: 2015-01-17 07:54:14 +0800 CST

How can I determine the last user who logged on to each PC on our domain?

  • 772

We have a network of primarily Windows 7 (and Windows 8.1) PCs, and we'd like to be able to report on who is the most recent person to have logged on to the various hosts.

We've got SCCM in place; however, that seems to give reasonable "last logged on" times, but we know that the "last logged on user" is a comparative work of fiction.

Is this a known problem with SCCM, or is there something we need to tweak to improve its accuracy? Better still, is this something we can query via LDAP (for example, using OPENQUERY from SQL Server)?

windows

1 Answers

  1. Best Answer

    There's no central store of user logins in Active Directory, so you can't just slap together an LDAP query for this information.

    Regarding SCCM, you might be running into this issue - check the query being run by your last logged on user report - but if not, the easiest solution is probably going to be some variant of a logon script that records the user name, time/date and machine name somewhere.

    The query in question was accessing the User_Name0 field in the v_R_System view.

    In case you are not aware v_R_System.User_Name0 is only updated during the last Network Discovery or Heartbeat Discovery.

    So I always recommend using v_GS_COMPUTER_SYSTEM.UserName0 as this is updated when hardware inventory runs.

    Now most places run their hardware inventory more frequently than their Network or Heartbeat discovery, hence my recommendation.

    The SCCM tweak, of course, would be to run a query on the most up-to-date user name field, as well as possibly adjusting your SCCM settings so that the user name field you do use is updated more frequently.

    • 2