We have a client wanting to capture Last Logon user and timestamp, using SG-SCCM.
My understanding is SCCM does a hardware scan on a scheduled basis, weekly by default.
Does anyone know if logon information is captured more frequently than that, or what triggers it?
If so, does it anyone it updates any of the timestamps that the Computer Identity data source captures, like LastHWScan or TimeKey?
Also, I believe the CMDB is only updated when the SCCM import records are "newer" than the LastScan date on the Source [sys_object_source] records. Does anyone know what date on the SCCM Computer Identity imports are tested against that LastScan date? Is it LastHWScan from SCCM?
If the logon info is captured by SCCM more recently than the last "hardware" scan, does that mean it might not get written to the CMDB?
(We're using SG-SCCM to track laptop info a client, but we do not have direct access to their environment, hard to investigate exactly how SCCM works.)
