We have a network of primarily Windows 7 (and Windows 8.1) PCs, and we'd like to be able to report on who is the most recent person to have logged on to the various hosts.

We've got SCCM in place; however, that seems to give reasonable "last logged on" times, but we know that the "last logged on user" is a comparative work of fiction.

Is this a known problem with SCCM, or is there something we need to tweak to improve its accuracy? Better still, is this something we can query via LDAP (for example, using OPENQUERY from SQL Server)?


There's no central store of user logins in Active Directory, so you can't just slap together an LDAP query for this information.

Regarding SCCM, you might be running into this issue - check the query being run by your last logged on user report - but if not, the easiest solution is probably going to be some variant of a logon script that records the user name, time/date and machine name somewhere.

The query in question was accessing the User_Name0 field in the v_R_System view.

In case you are not aware v_R_System.User_Name0 is only updated during the last Network Discovery or Heartbeat Discovery.

So I always recommend using v_GS_COMPUTER_SYSTEM.UserName0 as this is updated when hardware inventory runs.

Now most places run their hardware inventory more frequently than their Network or Heartbeat discovery, hence my recommendation.

The SCCM tweak, of course, would be to run a query on the most up-to-date user name field, as well as possibly adjusting your SCCM settings so that the user name field you do use is updated more frequently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.