Last Logged On User and Most Common User

(imported topic written by MBARTOSH)

Has there been a property included in 8.1 or 8.2 that would report the last logged on user and the most common user? If there has not been anything included in the release, does anyone have something they are currently using to get this information?

(imported comment written by SystemAdmin)

‘User Name’ is a default property for the current user. If you select Computers on the left, then right-click on the column header at the top, you can add ‘User Name’ as a column to display.

If you want the primary user or most common user, go so Tools > Manage Properties. Create a new property in the Master Action Site with report interval ‘every report’ that has the following relevance. Name it ‘Primary User’ or whatever makes sense to you. Once established, you can expose that property as a column.

if (exists ( key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats” whose (exists value “LogonHistory” of it) of registry)) then (concatenation “;” of unique values whose (multiplicity of it = (maximum of multiplicities of unique values of preceding texts whose (it != “none”) of firsts “;;” of substrings separated by “::” of (value “LogonHistory” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats” of registry as string)))of preceding texts whose (it != “none”) of firsts “;;” of substrings separated by “::” of (value “LogonHistory” of key “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\userstats” of registry as string)) else (“no user stats”)

(imported comment written by MBARTOSH)

Thank you JonLandis. I will give this a try, as well as what dmccalla runs.

(imported comment written by MBARTOSH)

How did you get the userstats key created?

(imported comment written by SystemAdmin)

Download and run as a recurring policy action the Track Primary User attachment provided in a previous message to get the userstats key populated.

(imported comment written by MBARTOSH)

How does the registry key userstats get created?

(imported comment written by MBARTOSH)

Sorry, I see. I was confused since the attachment did not come with your post.

(imported comment written by MBARTOSH)

What does “||” mean in Relevance language?

(imported comment written by MBARTOSH)

I am unable to get this to work. I see the correct entries in the registry, and the fixlet debugger returns the correct value, but when I add the property, the return value is none.

(imported comment written by dmccalla)

Logged on user(s) is out of box (actually called “User Name”) but most common (aka. primary) user is not. Try this out to get the primary user…

Create a property called Primary User with the following relevance…

if ((preceding text of first “||” of (it & “||”) of concatenation “||” of (if (exists setting “LogonHistory” of client) then (concatenation “||” of unique values whose (multiplicity of it = (maximum of multiplicities of unique values of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string))) of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string)) else (“No Data - Client Setting Does Not Exist”))) = “none”) then (preceding text of first “||” of (following text of first “||” of (it & “||”) of concatenation “||” of (if (exists setting “LogonHistory” of client) then (concatenation “||” of unique values whose (multiplicity of it = (maximum of multiplicities of unique values of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string))) of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string)) else (“No Data - Client Setting Does Not Exist”)))) else (preceding text of first “||” of (it & “||”) of concatenation “||” of (if (exists setting “LogonHistory” of client) then (concatenation “||” of unique values whose (multiplicity of it = (maximum of multiplicities of unique values of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string))) of preceding texts of firsts “;;” of substrings separated by “::” of (value of setting “LogonHistory” of client as string)) else (“No Data - Client Setting Does Not Exist”)))

Then run the attached task as a policy action (I run mine every 5 minutes). The action will execute an action script to set some client settings which hold login information, which is then analyzed by the Primary User property above to determine which user has logged in the most over the past 10 logins.

(imported comment written by MBARTOSH)

Wow! Thank you very much. This is great. Do you find much stress on your clients or network running this every 5 minutes. My report cycle is 15 minutes. It seems like 15 minutes would be more than adequate.

(imported comment written by MBARTOSH)

When you say you run it every 5 minutes, do you mean reapply the action while relevant, waiting 5 minutes, or is there a way to reoccur and action regardless of relevance?

(imported comment written by MBARTOSH)

What does “||” mean?

(imported comment written by MBARTOSH)

There is no client setting for userstats. Therefore, the return is “No Data - Client Setting Does Not Exist”.

(imported comment written by SystemAdmin)

Set the ‘Track Primary User’ task that you downloaded to run as a ‘Policy Action’ (no start or end date). On the Execution tab of the ‘Take Action’ dialog, check ‘Reapply this action’ on ‘whenever it becomes relevant again’. Target your all Windows machines and execute.

Log on and off a few machines to generate some data.

The ‘Primary User’ property should be enabled and evaluating on every report. You should then see data.

(imported comment written by Ryan_PD)

Apologies for digging up such an old post. This script has been immensely helpful but we’re having some issues with it. About 25% of our users are coming back as (Singular expression refers to non-existent object). Even when I log the user on and off and watch the policy re-evaluate, it still comes back with the error. Our company is new to TEM and I’m just unclear as to how I should proceed with troubleshooting this error.

Any input is greatly appreciated!