cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
davidp
Engaged Sweeper
Hello all,

I'm seeing some weird behavior in Lansweeper regarding the Last Logon information. I have a particular account that's disabled, yet it's showing last logon of today on two different machines. There's nothing I can find in any event logs to suggest this account was logged on.

This makes me wonder: how is Lansweeper obtaining Last Logon information?

Any information would be appreciated.

Thanks,
David
1 ACCEPTED SOLUTION
Daniel_B
Lansweeper Alumni
The last logged on user will be stored in the database for every computer as soon as a logged on user was detected once during scanning. After that, this entry will only be changed if another user was detected during a later scan.

Likely the disabled user was logged on once while Lansweeper scanned the computer. After that, the computer wasn't scanned while any other user was logged on to it, so this information doesn't change on its asset page.

If you would like to remove this information, you could go to Configuration\Database scripts, section Database scripts and execute a command like the following. Replace the username with the user logon you would like to remove. We recommend performing a backup of your Lansweeper database before running a script here.

UPDATE tblAssets SET username = '', userdomain = ''
WHERE Assetname = 'AffectedComputername'

View solution in original post

6 REPLIES 6
Susan_A
Lansweeper Alumni
Lansweeper uses several WMI queries to determine who the currently logged on user is. Win32_ComputerSystem is queried, but some other WMI classes are as well. (We're not sure development would want us to post the entire procedure.)
mfry1379
Engaged Sweeper II
There is a registry key which WMI probably pulls the information from.

http://itminutes.net/?p=761
Daniel_B
Lansweeper Alumni
Each time Lansweeper scans a computer, the currently logged on user is reported via WMI. This information will be saved in tblAssets.Username and only be replaced if during the next scan another user is logged on.
gdavid
Champion Sweeper
can you explain how the last logon is pulled? registry key or some other method?

davidp
Engaged Sweeper
Thanks Daniel.

It looks like the particular server had a SQL job that was running as the disabled user.

Thanks for the information about clearing that field!

Daniel_B
Lansweeper Alumni
The last logged on user will be stored in the database for every computer as soon as a logged on user was detected once during scanning. After that, this entry will only be changed if another user was detected during a later scan.

Likely the disabled user was logged on once while Lansweeper scanned the computer. After that, the computer wasn't scanned while any other user was logged on to it, so this information doesn't change on its asset page.

If you would like to remove this information, you could go to Configuration\Database scripts, section Database scripts and execute a command like the following. Replace the username with the user logon you would like to remove. We recommend performing a backup of your Lansweeper database before running a script here.

UPDATE tblAssets SET username = '', userdomain = ''
WHERE Assetname = 'AffectedComputername'