2 Replies Latest reply on Mar 26, 2012 2:40 PM by irishmn76

    Determing last login time and user

    Rookie

      I have been asked by management to determine the last logged in user (not the primary user) and the last login time for all the computers in our environment.  I have not found a way to find either.  I can find the primary user and the bootup time but I don't know if someone actually logged onto the computer when it booted.  Is there a way to get this information out of LANDesk?  I am running 9.0 SP3.

        • 1. Re: Determing last login time and user
          Catalysttgj Expert

          There's not going to be much to tell you exactly when the last time a user logged in, except that the inventory scan date itself (hardware scan) will be somewhat close provided that its not updated already by a scheduled scan. Depending on how you have your agents configured, typically a logon triggers an inventory scan in a default agent configuration. You may have changed this however, so it might not be relevant. Unfortunately, even if you didn't change this, and you do get inventory scans when folks log on, the fact is the inventory scan date still changes also when the scheduled inventory scan happens, so it still won't be a certainty that the date for inventory scan matches a logon event, though many times it will. At anyrate, the field "Login Name" is the last user that was logged on when an inventory scan occured.

           

          I think the only place that you could possibly get data about last logon would have to come from AD itself. I know there are fields in there that will change when a user touches the domain, so that's probably what you'll have to fool around with. I think LANDesk is now incorporating Managed Planet into their product (not free, but available).. and managed planet pulls AD and LANDesk stuff together, so it would probably be a useful tool for this. Not helpful, for your immediate need probably, unless you have this extra bit. I can't remember what LD is calling it within there tool set though. Might check into that.

          • 2. Re: Determing last login time and user
            irishmn76 SupportEmployee

            The best way to get this information is via Active Directory, leveraging this script as part of the ldiscn32.exe helper file called ldscnhlp.ini.  The code to retrieve the last logon data from AD is here:

            http://blogs.technet.com/b/heyscriptingguy/archive/2010/01/27/dandelions-vcr-clocks-and-last-logon-times-these-are-a-few-of-our-least-favorite-things.aspx

             

            You can then store the value in the registry and gather that via ldappl3.template file, or store it in a .dat file and suck it up as part of the ldiscn32.exe scan.

             

            Another option will be to pull the data from the domain and not use a script.  If in a Windows 2008 domain, there are user properties for logon and logoff.  Those will not require any conversions like what's posted above.