Notification

Icon
Error

Local Admin logged on to workstations report from last 24 hours

Posted: Tuesday, June 8, 2021 5:15:13 PM(UTC)
adeos

adeos

Member Original PosterPosts: 2
0
Like
Needing a report that shows workstations has a local admin logged on from last 24 hours

I appreciate it and thanks in advance
Joshua
#1Joshua Member Posts: 13  
posted: 6/10/2021 3:33:23 PM(UTC)
This is a pretty basic report that will show if any built in local admin accounts have logged into a computer in the past day. You can change DATEADD(day, -1, GETDATE()) to go back however many days you want.

SELECT tblCPlogoninfo.AssetID, tblAssets.AssetName, tblCPlogoninfo.LogonTime, tblCPlogoninfo.Username, tblCPlogoninfo.IPaddress
FROM tblCPlogoninfo
LEFT JOIN tblAssets ON tblCPlogoninfo.AssetID = tblAssets.AssetID
LEFT JOIN tblUsers ON tblUsers.AssetID = tblAssets.AssetID AND tblUsers.buildinadmin = 1
WHERE tblCPlogoninfo.Username = tblUsers.Name and tblCPlogoninfo.logontime >= DATEADD(day, -1, GETDATE())


If you want to get more complicated you can do something like the below that will show if anyone in the local administrator group logs into a machine. This report will get noisy if you have some people who are a local admin as it will show every time they login to their workstation.

SELECT tblCPlogoninfo.AssetID, tblAssets.AssetName, tblCPlogoninfo.LogonTime, tblCPlogoninfo.Username, tblCPlogoninfo.IPaddress
FROM tblCPlogoninfo
LEFT JOIN tblAssets ON tblCPlogoninfo.AssetID = tblAssets.AssetID
LEFT JOIN tblUsersInGroup ON tblUsersInGroup.AssetID = tblAssets.AssetID AND tblUsersInGroup.Groupname like 'Administrators' AND tblUsersInGroup.Username = tblCPlogoninfo.Username
WHERE tblUsersInGroup.Username IS NOT NULL and tblCPlogoninfo.logontime >= DATEADD(day, -1, GETDATE())

If you wanted to get even more complicated you could tie into AD groups that have local admin rights but I think that might be more than what you're asking.
adeos
#2adeos Member Original PosterPosts: 2  
posted: 6/11/2021 10:21:58 PM(UTC)
Originally Posted by: Joshua Go to Quoted Post
This is a pretty basic report that will show if any built in local admin accounts have logged into a computer in the past day. You can change DATEADD(day, -1, GETDATE()) to go back however many days you want.

SELECT tblCPlogoninfo.AssetID, tblAssets.AssetName, tblCPlogoninfo.LogonTime, tblCPlogoninfo.Username, tblCPlogoninfo.IPaddress
FROM tblCPlogoninfo
LEFT JOIN tblAssets ON tblCPlogoninfo.AssetID = tblAssets.AssetID
LEFT JOIN tblUsers ON tblUsers.AssetID = tblAssets.AssetID AND tblUsers.buildinadmin = 1
WHERE tblCPlogoninfo.Username = tblUsers.Name and tblCPlogoninfo.logontime >= DATEADD(day, -1, GETDATE())


If you want to get more complicated you can do something like the below that will show if anyone in the local administrator group logs into a machine. This report will get noisy if you have some people who are a local admin as it will show every time they login to their workstation.

SELECT tblCPlogoninfo.AssetID, tblAssets.AssetName, tblCPlogoninfo.LogonTime, tblCPlogoninfo.Username, tblCPlogoninfo.IPaddress
FROM tblCPlogoninfo
LEFT JOIN tblAssets ON tblCPlogoninfo.AssetID = tblAssets.AssetID
LEFT JOIN tblUsersInGroup ON tblUsersInGroup.AssetID = tblAssets.AssetID AND tblUsersInGroup.Groupname like 'Administrators' AND tblUsersInGroup.Username = tblCPlogoninfo.Username
WHERE tblUsersInGroup.Username IS NOT NULL and tblCPlogoninfo.logontime >= DATEADD(day, -1, GETDATE())

If you wanted to get even more complicated you could tie into AD groups that have local admin rights but I think that might be more than what you're asking.


Thank you very much Joshua this has helped me a ton! More power to you sir

Active Discussions

Lansweeper RPC Unavailable error
by  Greeno   Go to last post Go to first unread
Last post: Yesterday at 7:15:07 PM(UTC)
Lansweeper Exclude Search
by  pryan67   Go to last post Go to first unread
Last post: 6/16/2021 4:01:43 PM(UTC)
Lansweeper Report: All Apple Mac devices with Memory RAM asset
by  gabrielo  
Go to last post Go to first unread
Last post: 6/16/2021 3:17:24 PM(UTC)
Lansweeper Does technical support for LS really respond?
by  tosch   Go to last post Go to first unread
Last post: 6/16/2021 12:48:50 PM(UTC)
Lansweeper Deployment packages using lsagent
by  CyberCitizen  
Go to last post Go to first unread
Last post: 6/15/2021 11:44:33 PM(UTC)
Lansweeper INFO DateTimeService time refresh
by  ZachO21   Go to last post Go to first unread
Last post: 6/15/2021 4:23:15 PM(UTC)
Lansweeper Helpdesk tabs always regenarated
by  Carla  
Go to last post Go to first unread
Last post: 6/14/2021 9:49:27 PM(UTC)