→ Having trouble accessing our new support portal or creating a ticket? Please notify our team here

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
RTI_IT
Champion Sweeper
I see that on each assets page I can see the last 50 logons. Is there a report somewhere that would show me where the local administrator account 'administrator' has been used within the last 30 days?
1 ACCEPTED SOLUTION
Daniel_B
Lansweeper Alumni
Scanned logons are stored in table tblCPlogoninfo. The example report below lists all logons of the local user "Administrator". Keep in mind that only during a scan the logon will be pulled. If you would like to have precise logon information, you need to set up logon scripts on your computers through group policy which trigger a scan with LsPush.

Select Top 1000000 tblCPlogoninfo.logontime,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblAssets.Lastseen,
tsysOS.OSname,
tsysOS.Image As icon
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
Where tblCPlogoninfo.logontime > GetDate() - 30 And tblAssetCustom.State = 1 And
tblCPlogoninfo.Username Like 'administrator' And tblCPlogoninfo.Domain
Like tblAssets.AssetName
Order By tblCPlogoninfo.logontime Desc

View solution in original post

1 REPLY 1
Daniel_B
Lansweeper Alumni
Scanned logons are stored in table tblCPlogoninfo. The example report below lists all logons of the local user "Administrator". Keep in mind that only during a scan the logon will be pulled. If you would like to have precise logon information, you need to set up logon scripts on your computers through group policy which trigger a scan with LsPush.

Select Top 1000000 tblCPlogoninfo.logontime,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblAssets.Lastseen,
tsysOS.OSname,
tsysOS.Image As icon
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
Inner Join tsysOS On tblAssets.OScode = tsysOS.OScode
Where tblCPlogoninfo.logontime > GetDate() - 30 And tblAssetCustom.State = 1 And
tblCPlogoninfo.Username Like 'administrator' And tblCPlogoninfo.Domain
Like tblAssets.AssetName
Order By tblCPlogoninfo.logontime Desc