Notification

Icon
Error

Windows: Events generated in last 7 days

Posted: Thursday, December 14, 2017 9:27:50 AM(UTC)
Susan.A

Susan.A

Member Administration Original PosterPosts: 1,510
0
Like
The report below lists scanned events of Windows computers that occurred in the last 7 days. This includes error, warning, information, success audit and failure audit events. Keep in mind however that scanning of non-error events is disabled by default and must be enabled by following the instructions in this knowledge base article.

The report will only list assets that meet all of the following criteria:
  • The asset state is set to "active".
  • The asset has been successfully scanned at least once.
  • The asset is a Windows computer.
  • There are scanned events for the computer that occurred in the last 7 days.

Code:
Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tblAssets.Username,
  tblAssets.Userdomain,
  Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
  tblAssets.IPAddress,
  tsysIPLocations.IPLocation,
  tblAssetCustom.Manufacturer,
  tblAssetCustom.Model,
  tsysOS.OSname As OS,
  tblAssets.SP,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblNtlog.Eventcode,
  Case tblNtlog.Eventtype When 1 Then 'Error' When 2 Then 'Warning'
    When 3 Then 'Information' When 4 Then 'Security Audit Success'
    When 5 Then 'Security Audit Failure' End As EventType,
  tblNtlog.TimeGenerated,
  tblNtlogSource.Sourcename,
  tblNtlogFile.Logfile,
  tblNtlogUser.Loguser,
  tblNtlogMessage.Message
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tsysIPLocations On tsysIPLocations.LocationID =
    tblAssets.LocationID
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Inner Join tblNtlog On tblNtlog.AssetID = tblAssets.AssetID
  Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
  Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
    tblNtlog.SourcenameID
  Inner Join tblNtlogUser On tblNtlogUser.LoguserID = tblNtlog.LoguserID
  Inner Join tblNtlogFile On tblNtlogFile.LogfileID = tblNtlog.LogfileID
  Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Where tblNtlog.TimeGenerated > GetDate() - 7 And tblState.Statename = 'Active'
Order By tblNtlog.TimeGenerated Desc,
  tblAssets.Domain,
  tblAssets.AssetName

Active Discussions

Report Center Failed Logins Report/Chart
by  Cindy.C   Go to last post Go to first unread
Last post: Today at 11:05:12 AM(UTC)
Lansweeper Microsoft Patch Tuesday Report - May 2019
by  jase  
Go to last post Go to first unread
Last post: Yesterday at 10:17:06 PM(UTC)
Lansweeper Report of Monitors Connected To PC's
by  meddlema   Go to last post Go to first unread
Last post: Yesterday at 10:04:39 PM(UTC)
Lansweeper Windows 7 Assets, their user, and users manager
by  Jeff Hilmo  
Go to last post Go to first unread
Last post: Yesterday at 6:51:55 PM(UTC)
Lansweeper Firefox 67 Critical Security Issue
by  Esben.D   Go to last post Go to first unread
Last post: Yesterday at 11:40:51 AM(UTC)
Report Center BIOS version check
by  Esben.D  
Go to last post Go to first unread
Last post: 5/22/2019 1:22:28 PM(UTC)
Lansweeper report in defined period
by  CHIREC   Go to last post Go to first unread
Last post: 5/22/2019 10:46:34 AM(UTC)