anomolous results from last logged on user reporting

[MrPatrick]

We have been running Lansweeper for a couple of years with apparent success, although we have only used it for odd jobs now and again.

Our client has finally decided that they want us to use use it to form a comprehensive asset register (which is what we had them buy it for in the first place).

Up until now we haven't had any problem but now my colleague is using it in earnest we have popped up a couple of anomalies.

Specifically I would like to know how Lansweeper identifies the last logged on user. I assumed it would be some kind of lookup against the registry

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\DefaultUserName

However we have at least one server that is showing

First seen: 16/03/2011 16:51:15
Last seen: 26/06/2013 00:06:31

However the Last User is showing a colleague who hasn't been with us for nearly 2 years, and looking at that reg key shows a completely different user.


So the question is in two parts:
i) Where does Lan Sweeper get its last logged on user value from
ii) Why is is showing the wrong data.


-----

All of this has completely knocked trust in the data we are getting back from Lan Sweeper. We have always referred to it as a pretty authoritative resource but now we aren't sure whats right and what isn't, which kind of defeats the point of its purpose.

[Hemoco]

Problem resolved through email. Lansweeper 4.1 was in use, which we no longer support. Many changes have been made to user scanning since Lansweeper 4.1. You should be running the latest version of Lansweeper 4.2 or (preferably) Lansweeper 5.0.

[Hemoco]

Lansweeper checks WMI for this information, not the client machine's registry. Could you contact support@lansweeper.com and provide us with:
- Program Files (x86)\Lansweeper\Service\Errorlog.txt, as present on your Lansweeper server.
- Screenshots of the problem machine's Lansweeper webpage. Show us the following sections: Summary, Config\User Info\Last Logon, Scan Time and Errors (if this tab exists).