I checked a couple of my Win7 X64 machines and the Login Name maches the entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser . ldiscn32 is 18.104.22.168
We've recently started to see this issue on our LDMS 8.8 SP4 core. I have about 3% of my Windows 7 x64 machines reporting as administrator. Reloading the agent from the Console does not seem to work. However, logged in as the user and manually reloading the agent does correct the issue. Not sure if this is a deployment bug or something Microsoft fixed in a patch.
We too are facing the same Login name (Missing/Old) problem on some (~20%) Windows 7 - 32 bit machines as well. And the qualified login name in the inventory would be just "\". However XP seems to be fine and not get affected with this issue. We are on LDMS 9.0 SP2. I 've already logged a support case with LANDesk and awaiting their response on it.
I to am seeing this. Has anyone got a response from LANDesk?
If I do a full force scan it reports correctly but then gets overwritten when the next scan happens.
I am on 9.0 SP2.
I no longer have access to that case, since I've moved to another company. My TAM was Josh R. He can probably tell you the case number.
What we discovered (in December) was this is only happening if you disconnect (not logoff) from an RDP session, and then an inventory scan kicks off (via the console or local scheduler). The loginname lookup won't work if the session is disconnected, so it defaults to reading the loginname from the first regkey I listed above. That regkey exists in Win7, but it usually doesn't contain anything. The second regkey I listed is where LANDesk should default to for Win7 clients.
I have done some tests in my lab, and here is what I can say about the Login Name attribute in the inventory:
1) Logged in as mylocal\myuser1, then ran inventory scan. Login Name == Myuser1
2) Deleted the value of LastLoggedOnUser (myuser1): ran an inventory scan and the Login Name is still myuser1
3) Deleted the value of LastLoggedOnSAMUser (myuser1): ran an inventory scan and the Login Name is still myuser1.
4) Deleted the values for LastLoggedOnUser; LastLoggedOnSAMUser; DefaultUserName (was set to Phil. Phil is the user created when I set up Windows); and deleted invdelta.dat file from the client. Started a full inventory scan. Login Name attribute now disappeared from the inventory of my client! This is normal since there is no login user found in the Registry.
5) Manually Set the value of LastLoggedOnUser = myuser1; ran full inventory scan. Still no Login Name attribute in the inventory
6) Set the value of DefaultUserName to Phil; ran a full inventory scan. Login Name is now populated in the inventory scan and it is "Phil" so the value of "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName"
7) Log off myuser1. Then logon with myuser1 again and run an inventory scan. Now the Login Name == LastLoggedOnUser (myuser1).
==> this key seems to be filled in for the very first time one logs in after the machine was setup. Thereafter, Windows does not seem to be using it at all whether I log in as domain user or a local user. As per point 4 above DefaultUserName was Phil in my case and that user was set up when I installed Windows (manual installation asks to enter a username since the default administrator is disabled by default)
Final test through Windows RDP to the client. RDP session disconnected without logging off the client frist: This now causes that the user that was logged in when I RDPed in as well as the user that I used to log in for RDP are both still logged in Windows. And Windows is waiting at "Press CTRL + ALT + DEL to log on" window.
With the final test if you now run a full inventory scan from the 32-bit Console, you will see that the Login Name == DefaultUserName as described above (Phil). Phil is the user that was set up during the Windows installation.
1) The inventory scanner does indeed use [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser] when a user is logged in and a scan is started (scheduled or manual remote or local) and the value is not empty
2) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName] gets used if you run an inventory scan while nobody is logged in Windows (CTRL + ALT + DEL window = default user). However the moment you log into Windows LastLoggedOnUser is used in the inventory.
Hope this helps.
Thank you for the tests.
How can we tell LANDesk to use one or the other?
We have a Scheduled Scan that runs as the user so we can retrieve User Based Registry Keys.
I wonder if that is what is messing up our Windows 7 machines.
Is there a better way or best practice of setting up LANDesk to Scan as user to be able to get User based Registry Settings? Without having to push the Scheduled scan out to the PCs?
Unfortunately the inventory scanner does not allow us to define which of the Registry values to use. However, a normal user should have read right to the keys, (although I haven't tested this). As per your post you are running inventory scanner under the user context so it can gather information from user's hive.
Without knowing the details, there are two things that I could suggest
a) use a vbscript or similar to gather the information from user's hive and put that information into [hklm\software\(wow6432nod)\Intel\LANDesk\Inventory\Custom Fields]. Any entries within this key will be gathered automatically for you so no need to modify ldappl3.ini :-)
b) If you are using LANDesk queries to filter Login Name from the inventory scan, you might want to also consider "LDAP User" in the root of the inventory. This value regardless of Login Name should always reflect correct value since it is gathered by ldapwhoami.exe through AD.
The beauty of ldapwhoami.exe is that it queries the AD, and even if the user has not logged off for quite some time or user information such as name has changed in AD, it will still gather the latest user information and send to the core.
I would recommend looking into this possibility and see if it fits your environment / use case scenario. Please keep us posted.
I guess the problem I have with this is that DefaultUserName may only get set once. It's faulty data on a Windows 7 machine. The inventory scanner should pick up the data without having to run something to correct it. It worked fine on Windows XP, but I'm seeing this issue on quite a few Windows 7 (23/64) and Server 2008 machines.
the problem is not the inventory scanner but rather Windows 7 having two locations where the username is stored in the registry. Windows XP has only one location hence it works fine there. The location that the inventory scanner can access when nobody is logged in is the one that happens to be the empty value in the registyr (legacy username).
You can get around this by running a vbscript at login times that would add the logged in user's name to the legacy location. The inventory scanner then will pick it up from there.
Hope this helps.
I have to disgree with your statement because the scanner is scanning a legacy location in the registry. The scanner should be able to sense the OS installed and scan the correct portion of the registry and not a legacy location. Are there any fixes that are planned for this issue?
Either way it is not working well and should be fixed, especially since this data is used for primary owner and may provide misleading information. We should have to write scripts the inventory scanner should have logic to interrogate and dictate what reg key to use.
Quick note regarding an update to our State Notifier plug-in; this has been revised to send updates when the currently logged in user changes. This sends correct login information for each version of windows and also clears out the user name when someone logs out so that you get current inventory information. We added this because some of our customers didn't want to have a hardware scan required each login and wanted to know that users were no longer logged into other machines.
I know this doesn't fix the inventory scanner but thought it might be of use.
LANDesk Silver ESP
The One-Stop Shop for LANDesk Enhancements
Update - WoW & State Notifier now integrate for even more functionality