Notification

Icon
Error

Windows: Events generated in last 7 days

Posted: Thursday, December 14, 2017 9:27:50 AM(UTC)
Susan.A

Susan.A

Member Administration Original PosterPosts: 1,535
0
Like
The report below lists scanned events of Windows computers that occurred in the last 7 days. This includes error, warning, information, success audit and failure audit events. Keep in mind that scanning of non-error events is disabled by default and must be enabled by following the instructions in this knowledge base article.

The report will only list assets that meet all of the following criteria:
  • The asset state is set to "active".
  • The asset has been successfully scanned at least once.
  • The asset is a Windows computer.
  • There are scanned events for the computer that occurred in the last 7 days.

Code:
Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblNtlog.Eventcode,
  Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
    When 3 Then 'Information' When 4 Then 'Security Audit Success'
    When 5 Then 'Security Audit Failure' End As EventType,
  tblNtlog.TimeGenerated,
  tblNtlogSource.Sourcename,
  tblNtlogFile.Logfile,
  tblNtlogUser.Loguser,
  tblNtlogMessage.Message
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Inner Join tblNtlog On tblNtlog.AssetID = tblAssets.AssetID
  Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
  Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where tblNtlog.TimeGenerated > GetDate() - 7 And tblState.Statename = 'Active'
Order By tblNtlog.TimeGenerated Desc,
  tblAssets.Domain,
  tblAssets.AssetName

Active Discussions

Lansweeper Moving Assets in Location not Saving
by  brodiemac   Go to last post Go to first unread
Last post: Today at 12:23:04 PM(UTC)
Lansweeper HP Printer not showing correctly
by  Esben.D  
Go to last post Go to first unread
Last post: Today at 10:41:49 AM(UTC)
Lansweeper Scanning includes IOS devices even though I exclude them??
by  steveb   Go to last post Go to first unread
Last post: Yesterday at 11:05:33 PM(UTC)
Lansweeper Deployment condition
by  CyberCitizen  
Go to last post Go to first unread
Last post: Yesterday at 5:36:05 AM(UTC)
Lansweeper lsagent not scanning/sending when using relay
by  Esben.D   Go to last post Go to first unread
Last post: 8/19/2019 12:31:02 PM(UTC)
Lansweeper Check if Netbios is disabled over TCP/IP
by  TaherMD  
Go to last post Go to first unread
Last post: 8/19/2019 6:00:51 AM(UTC)
Lansweeper Email attachments
by  krejar   Go to last post Go to first unread
Last post: 8/15/2019 10:15:07 PM(UTC)
Lansweeper Install LsAgent on Mac
by  Jonnym  
Go to last post Go to first unread
Last post: 8/14/2019 10:14:08 AM(UTC)