Most frequent logged in user

[sg570]

Hello!

I'm trying to find some information related to the field/column labeled "Most frequent logged in user" that I see in my SNow instance. It appears to be OOTB, but I'm not able to find any documentation that helps me understand what the purpose of this field is.

Is "Most frequent logged in user" something that is "open to whatever the customer wants to do with it", or is there some sort of build/configuration/future intent behind this?

Overall... from an SG-SCCM perspective, can we safely do either of these ideas:

Map u_username to Most frequent logged in user (instead of Assigned to)
Map u_consoleuser to Most frequent logged in user (instead of Assigned to)

We would end up deciding which value to use based on feedback, but before we decide to use "Most frequent logged in user", I want to make sure we're not missing something with this field.

Any info is helpful, thanks!

[Will Patterson]

I'm wondering the same thing.. Perhaps we can get some additional eyes on this to help answer. @Prasad Chundi -- any ideas? Or someone that might?

In the past, my organization introduced a custom attribute at the cmdb_ci table for "Top Console User" which appears to be mapped to SCCM's console user. Now our SCCM integration is severed and the information is now stale.

I'm hoping to be able to adjust the Windows OS - Desktops and/or the Windows OS - Servers patterns to add a powershell command to assist with populating the Most Frequent Logged In user, if something OOTB is incapable of doing it..

FWIW, I came across this snippet of Powershell code I'm hoping to adapt to a 'Get-WMIObject' command to return the same information from a remote workstation/server that I can then drop into the pattern and populate the M.F.L.I.U. reference.

================================================================

function get-freq-user
{
    $newest=20
    $ComputerName = $env:computername

    $UserProperty = @{n="User";e={((New-Object System.Security.Principal.SecurityIdentifier $_.ReplacementStrings[1]).Translate([System.Security.Principal.NTAccount])).ToString()}}
    $logs = Get-EventLog System -Source Microsoft-Windows-Winlogon -ComputerName $ComputerName -newest $newest | select $UserProperty
    
    
    $logs | Group-Object user | Sort Count | Select -First 1
}

================================================================

Hopefully we can get both find the answers we're looking for!

-Will

[Will Patterson]

I may have found a better solution. I went into the Windows OS - Desktops and Windows OS - Servers pattern and started poking around and found step 8.2 and 8.3..

In 8.3, the pattern is only setting "Assigned To" IF it is empty. It will not set it if it's already populated, which makes sense from a HAM perspective.

I'm thinking I might replicate 8.3 to update Most Frequently Logged In user with the computer, regardless of whether it is empty or not.

Anyway, hope this helps someone.

[Bradley Pingel]

Any luck on this?  I find it amazing that there is not 1 bit of info on this field anywhere on service now docs or google search.   Only this one thread here.   

Would be good if this can return the logon that occurs most of the time but only over the past say 3 months.  So if it changes hands after being with someone for a long time, we will see the new MFLIU sooner.  

[sg570]

Hello!  So, no luck in getting any info here but we did successfully start using the field anyway.

We converted from the old "2012 SCCM Plugin" to the "SG-SCCM Service Graph Connector".

We had the old setup doing "u_consoleuser" (from SCCM) --> Assigned to... but that had all kinds of problems (Inactive Users... SCCM now gathers a generic user but SNow didn't change.. others).

We basically just recreated the old setup but not for Assigned to...

"u_consoleuser" --> Most frequent logged in user

However - it still has the same problems:

- Inactive Users don't get cleared

- If SCCM now gathers a generic login, the SNow field does not clear or change to a generic ID

So while we converted the setup, it still needs some work on our end. We can fix/get around the issues with some code and a generic User Record... but there's a lot "left to the customer" here with this field and if SNow decides to start using this field for something, we'll have to make adjustments and it would have been nice to know months ago when the field first appeared and/or when I asked for info on this!

Edit: For your line about "return the logon that occurs most of the time" - I think that can be controlled or adjusted within SCCM itself. For the "Top Console User" in SCCM, it has some kind of formula where it stamps a name in there if something like "user that logged into the PC most over 7 days" -- that gets captured in SCCM and that value is sent across the SG into SNow. Well, if SCCM has "Sally" and Sally has recently left the organization, but no one else has logged into that PC enough to replace Sally as the Top Console User, you end up with "SCCM continuing to force Sally into the field even through she is now an Inactive User"... and the other one is "Now it is no longer Sally, it is X12345 - a generic login" - well, Sally was entered in MFLIU but there is nothing in place to remove Sally when it should no longer be Sally (we have to write code to achieve this).