Lansweeper doesn't retrieve the entirety of the user logon events from the eventviewer of a local computer when it scans them. What happens instead is, when Lansweeper scans a Windows computer and a user is logged on during scanning, a logon event is created for that user for that computer at the time of scanning. For accurate user log on scanning we would recommend setting up LsPush scanning via a logonscript GPO, as this will record a logon event for every single user logon.
LsPush is a small executable that, when run on a Windows computer, scans the computer locally. The scan results can manually or automatically be forwarded to your Lansweeper server for import. You can find the LsPush executable in the Program Files (x86)\Lansweeper\Client folder on your Lansweeper server and information on its parameters in this knowledge base article.
LsPush can easily be deployed in domain environments with a logon script or group policy. A sample .vbs script that runs LsPush can be seen below. You will need to replace what we've highlighted with the folder hosting the LsPush executable and the name of your own Lansweeper server. If you deploy this script as part of a logon script or group policy, LsPush will automatically scan your machines when users log into them and send the results directly to your Lansweeper server for import. General info on setting up a logon based group policy, not specific to LsPush, can be found here.
Set WshShell = CreateObject("Wscript.Shell")
WshShell.run "%logonserver%\netlogon\lspush.exe lansweeperservername",0
