Notification

Icon
Error

Windows: Events generated in last 7 days

Posted: Thursday, December 14, 2017 9:27:50 AM(UTC)
Susan.A

Susan.A

Member Administration Original PosterPosts: 1,536
0
Like
The report below lists scanned events of Windows computers that occurred in the last 7 days. This includes error, warning, information, success audit and failure audit events. Keep in mind that scanning of non-error events is disabled by default and must be enabled by following the instructions in this knowledge base article.

The report will only list assets that meet all of the following criteria:
  • The asset state is set to "active".
  • The asset has been successfully scanned at least once.
  • The asset is a Windows computer.
  • There are scanned events for the computer that occurred in the last 7 days.

Code:
Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblNtlog.Eventcode,
  Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
    When 3 Then 'Information' When 4 Then 'Security Audit Success'
    When 5 Then 'Security Audit Failure' End As EventType,
  tblNtlog.TimeGenerated,
  tblNtlogSource.Sourcename,
  tblNtlogFile.Logfile,
  tblNtlogUser.Loguser,
  tblNtlogMessage.Message
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Inner Join tblNtlog On tblNtlog.AssetID = tblAssets.AssetID
  Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
  Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where tblNtlog.TimeGenerated > GetDate() - 7 And tblState.Statename = 'Active'
Order By tblNtlog.TimeGenerated Desc,
  tblAssets.Domain,
  tblAssets.AssetName

Active Discussions

Lansweeper Changes in the licensing model
by  BullGates   Go to last post Go to first unread
Last post: Today at 7:30:32 PM(UTC)
Lansweeper About Memory Changes
by  fjca  
Go to last post Go to first unread
Last post: Today at 5:51:17 PM(UTC)
Lansweeper Wildcard in file scanning to get all files in a directory?
by  RKCar   Go to last post Go to first unread
Last post: Today at 4:03:43 PM(UTC)
Lansweeper Wishlist is dead, no responses from LS staff.
by  RobertB  
Go to last post Go to first unread
Last post: Today at 3:08:12 PM(UTC)
Lansweeper Deploy installer packages not working any more
by  richv   Go to last post Go to first unread
Last post: Today at 3:06:19 PM(UTC)
Lansweeper File Scanning
by  RKCar  
Go to last post Go to first unread
Last post: Today at 2:22:54 PM(UTC)
Lansweeper HP Warranty scan - broken for some products
by  zaty   Go to last post Go to first unread
Last post: Today at 1:52:38 PM(UTC)
Lansweeper How to stop deployments ?
by  Leandro Martins  
Go to last post Go to first unread
Last post: Today at 1:47:22 PM(UTC)