Kaseya Community

Last logon TIME

  • Has anyone found a field in the SQL database which shows the last logon time a specific user loged onto a computer? We need this for an audit.

    A SQL view or TABLE would work. We're not touching the data, just reporting on it.

    Thanks!

    Gavin

  • I presume you mean from the Kaseya Database find the last time someone logged into the managed endpoint ?

    The following will give you the last logged in user , but you want the Date/Tiem as well ?

    SELECT TOP 1000 [Machine_GroupID]

         ,[agentGuid]

         ,[machName]

         ,[groupName]

         ,[currentUser]

         ,[lastLoginName]

         ,[workgroupDomainType]

         ,[workgroupDomainName]

    FROM [ksubscribers].[dbo].[vAgentConfiguration]

    Assuming they are on a domain , and from the above you know the username and domain name , you could then query AD and find out from there

    Paul

  • The short answer is that Kaseya does not log user logon/logoff times and dates out of the box. To do this you have to enable Windows Security Auditing and use Event Log Monitoring to filter and Alert if required.

    Below are a few links that explains how this works;

    go.microsoft.com/fwlink

    blogs.technet.com/.../getting-the-effective-audit-policy-in-windows-7-and-2008-r2.aspx

    The other thing you will need to know to make good reporting and monitor sets are Logon Types;

    technet.microsoft.com/.../cc787567%28v=ws.10%29.aspx

    Hope this helps...

  • here is another document that might be of some use;

    www.sans.org/.../windows-logon-forensics-34132