I get asked about this every once in a while so I thought I would post it here in case it’s something you might find helpful as well. This report will contain the last login time on a particular computer along with the user who logged in to it as well as some additional details.
To create the report follow the steps below:
1. Edit the SMS_DEF.mof file to enable the following class:
Network Login Profile
Also enable the sub class:
LastLogon
2. Create a report with the below query: Select V_GS_SYSTEM.Name0 as [ComputerName], V_GS_NETWORK_LOGIN_PROFILE.TimeStamp as [Last Login Time], V_GS_NETWORK_LOGIN_PROFILE.Name0 as [Logon User], V_GS_SYSTEM.Domain0 as [Logon Domain], V_GS_SYSTEM.SystemRole0 as [System Role], V_GS_SYSTEM.SystemType0 as [System Type] from V_GS_NETWORK_LOGIN_PROFILE left JOIN v_GS_SYSTEM ON V_GS_NETWORK_LOGIN_PROFILE.ResourceID = v_GS_SYSTEM.ResourceID where V_GS_NETWORK_LOGIN_PROFILE.LastLogon0 is not NULL
Note: This information was originally contributed by Arnab Mitra, Configuration Manager Support Engineer, on the Configuration Manager Support Team blog:
http://blogs.technet.com/configurationmgr/archive/2009/09/09/report-to-find-last-logon-details-of-each-computer-using-configmgr-2007.aspx
Richard Mueller edited Revision 2. Comment: Replaced RGB values with color names in HTML to restore color
Richard Mueller edited Revision 1. Comment: Modified title casing, added tags
I am using a query based on the one above but it shows 1 entry for every person who has logged onto a computer. So the computer names are repeated and I get 80,000 results when I only have 18,000 computers.
I have it sorted so by computer name and then with newest logon date at the top, so that if I export it to Excel I can simply remove duplicates and the one that remains is the latest.
However, I would like my SQL query to remove the duplicates so it shows me only 1 computer and the very last user that logged onto that computer.
Select
DISTINCT V_GS_SYSTEM.Name0 as [ComputerName],
V_GS_NETWORK_LOGIN_PROFILE.LastLogon0 as [Last Login Time],
V_GS_NETWORK_LOGIN_PROFILE.Name0 as [Logon User],
V_GS_SYSTEM.Domain0 as [Logon Domain],
V_GS_SYSTEM.SystemRole0 as [System Role],
V_GS_SYSTEM.SystemType0 as [System Type]
from V_GS_NETWORK_LOGIN_PROFILE
left JOIN v_GS_SYSTEM ON V_GS_NETWORK_LOGIN_PROFILE.ResourceID =
v_GS_SYSTEM.ResourceID
where V_GS_NETWORK_LOGIN_PROFILE.LastLogon0 is not NULL
AND
V_GS_SYSTEM.SystemRole0='Workstation'
Order by V_GS_SYSTEM.Name0, V_GS_NETWORK_LOGIN_PROFILE.LastLogon0 DESC
Something I also noticed is a problem: Many machines seem to be missing the Network Profile last logon time stamp, or have only 1 that is 2 years old. What mechanism controls the reporting of this data point? Is there a way I can make as system scan in a current Network Profile last logon time?
Richard Mueller, why would you bother making changes to the capitalization of the words in the title of this document and not address the question about the duplicated machines names or missing Network Profile data?
Help me Microsoft!
I need to find out where exactly the field V_GS_NETWORK_LOGIN_PROFILE.LastLogon0 gets its information.
I have machines reporting in with dates/times that cannot be right so I need to explain why.
Thanks