Searching "last login" on a specific date

[Alan_LS]

How to search the "last login" user on a specific date and a history of "last login" on a specific asset?
I need such feature for investigation. thank you

[Esben_D]

The usernames should be there. Since they are not this might point towards a database issue or an issue with scanning the usernames used in your network.

To properly troubleshoot the issue, I would recommend sending the information to our support team at support@lansweeper.com and inlcude the following:

• An Excel output of one of the reports.
  
• A screenshot or output of one of the Audit Successes from one of the asset's Security Windows logs in the Event Viewer.
  
• Program Files (x86)\Lansweeper\Service\Errorlog.txt, as present on your Lansweeper server.
  
• Program Files (x86)\Lansweeper\Website\App_Data\web_errorlog.txt, if it exists.

[Alan_LS]

Hi Charles,

I have tried the 2 example scripts but there is no name surface at the username column for both scripts.
Please see the attachment file.

[Esben_D]

You're right, I forgot about the page limitation.

In that case you will have to use a report for both. Reports are always shared as an SQL query, you can find an explanation on how to add the SQL queries to your installation here: https://www.lansweeper.com/forum/yaf_postst9882_How-to-run-a-report.aspx

To get all the logon information from a single asset, you can run the following report after replacing the highlighted text with your asset's name.

Select Top 1000000 tblCPlogoninfo.Username,
tblCPlogoninfo.logontime,
tblAssets.AssetID,
tblAssets.AssetName
From tblAssets
Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
Where tblAssets.AssetName Like '%YourAssetName%'
Order By tblCPlogoninfo.Username,
tblCPlogoninfo.logontime

To filter it for a specific date you can modify the following report:

Select Top 1000000 tblCPlogoninfo.Username,
tblCPlogoninfo.logontime,
tblAssets.AssetID,
tblAssets.AssetName
From tblAssets
Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
Where tblCPlogoninfo.logontime Between '05/01/2018' And '06/01/2018'
Order By tblCPlogoninfo.Username,
tblCPlogoninfo.logontime

Date format is MM/DD/YYYY

[Alan_LS]

Hi Charles,

In the Config\User Info\Last Logon, you can't view all the history because of the limited to a single page.

As for the url that you recommended it's not useful as is a SQL command. I would prefer the report.

Do you have any more example?

[Esben_D]

To search for specific in the last logins, you will have to use a report and add your criteria. (Example: https://www.lansweeper.com/forum/yaf_postst15789_User-logon-history.aspx)

If you want to get an overview of all logins for a specific asset, you can find it on the assets page in Config\User Info\Last Logon.

Some side notes that might be useful:

1. Last logon scans which users is logged onto the asset at the moment of the scan. If you have scheduled scans, this might not accurately reflect logon times as the date and time will be the same as the scan.
   
2. Logon history is kept for 60 days by default. Any logon information older than 60 days will be automatically deleted unless this setting is changed. You can find more information about the cleanup options here: https://www.lansweeper.com/kb/167/performing-automated-database-cleanups.html