Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

View Last User Logon in PDQ Inventory

I can view the currently logged in users on my domain under the user tab but I am wondering how I can also view the last log on as well?  Possible to add a column for this or run a report that covers it?

0

Comments

8 comments
Date Votes
  • YES!!

    0
  • In Windows 7 this is actually stored in a registry key that can be scanned for but we need to edit or add the following scan profile that I've attached. (ScanProfile-Misc. Registry Scans)  To import open PDQ Inventory -> File -> Import and choose the mentioned file.  Once imported you can go to File-> Preferences-> Scan Profiles and you'll see it listed as Misc. Registry Scans.  You can add other registry scans to this profile as well so that you don't have to scan for this value just by itself or add it to an existing scan profile.

    Once that is added you can then import the following attached report (Report-Last Logged On User) the same way we did the registry scan profile.  This report won't show any results until that scan is run in your environment. 

    ***Note*** - This process is only documented for Windows 7 and will only show results from connections made on the client machines that logged into the console session.  (RDP does not use the console session)

    0
  • This is the same issue I wrote to support about just a few weeks ago. At that time, you shared the beta of the feature now seen in PDQ Inventory v6 which shows the "current user's login state". While that feature is pretty cool and is valuable in itself, not having the "Last Logged On User" handy is becoming somewhat of an inconvenience.I figured out the registry scan and matching report workaround on my own. It works fine, but it was so much more convenient to have handy in the collections view as you did before the most recent PDQ updates.

    I run a call center where users sit at different computers, and not all computers are used every day. Entering the user name in the filter area while you are already looking at the PDQ collection list, allows me to:

    1) see all computers the user was logged on to which is useful for on-the-fly auditing and security purposes when there is an issue in question relating to user.

    2) If I need to support or install software on the PC while the user is not logged on, and don't know their PC names;  I could filter the user name to find out where they were last logged on without having to generate reports or relay on other sources. Again, users move around and it is good to know where they were.

    I could be wrong, but the scan and report workaround is only as good as the last scheduled scan. You need to run another scan first to get the most current and accurate data on online-only PCs. The last logged on user that appeared in older versions of PDQ Inventory would get that information more dynamically.

    Please consider adding an additional column for the "Last Logged On User" so users who chose to use it can add it to their collection views. Yes I am a little frustrated not to have that feature handy anymore, but overall, I'm happy with the product and want to see it become better for everyone who use it in whatever custom capacity works best for them.

    0
  • Yes this would be great to have it's one thing I have missed since moving from the old software deployment to PDQ

    0
  • Where's the attachment?  Thanks.

    0
  • I also need this, where can we find the attachment? Thanks

    0
  • I believe the registry key you are all looking for is "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnSAMUser"

     

    Here is a quick report I threw together:

    <?xml version="1.0" encoding="utf-8"?>
    <AdminArsenal.Export Code="PDQInventory" Name="PDQ Inventory" Version="11.2.0.0" MinimumVersion="3.1">
    <Report>
    <ReportDefinition name="Definition">
    <Columns type="list">
    <Column>
    <Column>Name</Column>
    <Summary></Summary>
    <Table>Computer</Table>
    <Title></Title>
    </Column>
    <Column>
    <Column>Value</Column>
    <Summary></Summary>
    <Table>Registry</Table>
    <Title>LastLoggedOnSAMUser</Title>
    </Column>
    </Columns>
    <RootFilter name="Filter">
    <Comparison>All</Comparison>
    <Filters type="list">
    <ValueFilter>
    <Table>Registry</Table>
    <Column>Hive</Column>
    <Comparison>Equals</Comparison>
    <Value>HKEY_LOCAL_MACHINE</Value>
    </ValueFilter>
    <ValueFilter>
    <Table>Registry</Table>
    <Column>PathName</Column>
    <Comparison>Equals</Comparison>
    <Value>SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI</Value>
    </ValueFilter>
    <ValueFilter>
    <Table>Registry</Table>
    <Column>Name</Column>
    <Comparison>Equals</Comparison>
    <Value>LastLoggedOnSAMUser</Value>
    </ValueFilter>
    </Filters>
    </RootFilter>
    <ReportDefinitionTypeName>BasicReportDefinition</ReportDefinitionTypeName>
    </ReportDefinition>
    <Description></Description>
    <Name>Last Logged on User</Name>
    <ReportFolderId value="1" />
    <ReportType>BasicReport</ReportType>
    </Report>
    </AdminArsenal.Export>
    0
  • I really need this feature as well. Was planning on replacing AuditWiz with PDQ Inventory and probably the most used feature, finding out who was using what computer. When you are looking for comp512 and it is not assigned to anyone the choice is to chase it through the switch or if you can see the last you can go right to it. 

    0