Last Logon - How is this pulled?

[davidp]

Hello all,

I'm seeing some weird behavior in Lansweeper regarding the Last Logon information. I have a particular account that's disabled, yet it's showing last logon of today on two different machines. There's nothing I can find in any event logs to suggest this account was logged on.

This makes me wonder: how is Lansweeper obtaining Last Logon information?

Any information would be appreciated.

Thanks,
David

[Susan_A]

Lansweeper uses several WMI queries to determine who the currently logged on user is. Win32_ComputerSystem is queried, but some other WMI classes are as well. (We're not sure development would want us to post the entire procedure.)

[mfry1379]

There is a registry key which WMI probably pulls the information from.

http://itminutes.net/?p=761

[Daniel_B]

Each time Lansweeper scans a computer, the currently logged on user is reported via WMI. This information will be saved in tblAssets.Username and only be replaced if during the next scan another user is logged on.

[gdavid]

can you explain how the last logon is pulled? registry key or some other method?

[davidp]

Thanks Daniel.

It looks like the particular server had a SQL job that was running as the disabled user.

Thanks for the information about clearing that field!

[Daniel_B · Accepted solution]

The last logged on user will be stored in the database for every computer as soon as a logged on user was detected once during scanning. After that, this entry will only be changed if another user was detected during a later scan.

Likely the disabled user was logged on once while Lansweeper scanned the computer. After that, the computer wasn't scanned while any other user was logged on to it, so this information doesn't change on its asset page.

If you would like to remove this information, you could go to Configuration\Database scripts, section Database scripts and execute a command like the following. Replace the username with the user logon you would like to remove. We recommend performing a backup of your Lansweeper database before running a script here.

UPDATE tblAssets SET username = '', userdomain = ''
  WHERE Assetname = 'AffectedComputername'