Please use the report below to list the logon events of users that logged into more than one computer:
Select Top 1000000 tsysOS.Image As icon,
tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.IPAddress,
tblAssets.Firstseen,
tblAssets.Lastseen,
SubQuery2.Username,
SubQuery2.Userdomain,
tblCPlogoninfo.logontime
From tblAssets
Inner Join tblCPlogoninfo On tblAssets.AssetID = tblCPlogoninfo.AssetID
Inner Join tsysOS On tsysOS.OScode = tblAssets.OScode
Inner Join (Select Top 1000000 SubQuery1.Username,
SubQuery1.Userdomain,
SubQuery1.Day,
Count(SubQuery1.Computer) As Count
From (Select Distinct Top 1000000 tblCPlogoninfo.Username,
tblCPlogoninfo.Domain As Userdomain,
Convert(nvarchar,tblCPlogoninfo.logontime,101) As Day,
tblCPlogoninfo.AssetID As Computer
From tblCPlogoninfo) SubQuery1
Group By SubQuery1.Username,
SubQuery1.Userdomain,
SubQuery1.Day) SubQuery2 On SubQuery2.Username = tblCPlogoninfo.Username And
SubQuery2.Userdomain = tblCPlogoninfo.Domain And SubQuery2.Day =
Convert(nvarchar,tblCPlogoninfo.logontime,101)
Where SubQuery2.Count > 1
Order By SubQuery2.Userdomain,
SubQuery2.Username,
SubQuery2.Day Desc,
tblAssets.Domain,
tblAssets.AssetName,
tblCPlogoninfo.logontime Desc
To use the report above, do the following:
•Open the report builder under Reports/Create New Report.
•Paste the SQL code we provided at the bottom of the page.
•Left-click somewhere in the upper section of the page so the code applies.
•Give the report a Title and hit the Save & Run button to save it. Export options are listed on the left.
