Local Administrator Logon's in Last 30 Days

[RTI_IT]

I see that on each assets page I can see the last 50 logons. Is there a report somewhere that would show me where the local administrator account 'administrator' has been used within the last 30 days?

[Daniel_B · Accepted solution]

Scanned logons are stored in table tblCPlogoninfo. The example report below lists all logons of the local user "Administrator". Keep in mind that only during a scan the logon will be pulled. If you would like to have precise logon information, you need to set up logon scripts on your computers through group policy which trigger a scan with LsPush.

Select Top 1000000 tblCPlogoninfo.logontime,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tblAssets.Lastseen,
  tsysOS.OSname,
  tsysOS.Image As icon
From tblAssets
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
  Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
Where tblCPlogoninfo.logontime > GetDate() - 30 And tblAssetCustom.State = 1 And
  tblCPlogoninfo.Username Like 'administrator' And tblCPlogoninfo.Domain
  Like tblAssets.AssetName
Order By tblCPlogoninfo.logontime Desc