Configuring "Most Frequent Logged in User" to Show Primary User Name

[hstetsenka]

Hi All,

How do you configure and use the "Most Frequent Logged in User" field?

I’d like to set it up so it shows the name of the primary user — the person who uses a specific computer most often.

Thanks in advance!

[Pratiksha]

OOB you can one assinged to, if the data coming from third party tool like SCCM or Intune then the values in tool will be used here. 

In past we have done integration where in we got the last logged in user with the time stamp, created a read only field to populate the value. 

One more case where in client wanted to know how many ppl are loggin in to the system, we created m2m table on cmdb_ci_computer, the job runs 4 time a day based on shift and populate the information. 

Both the ideas are custom and need dev work. 

[Ankur Bawiskar]

@hstetsenka 

what's your actual business requirement?

share some screenshots.

If my response helped please mark it correct and close the thread so that it benefits future readers.

[nityabans27]

The "Most Frequent Logged in User" field in ServiceNow is not a magically auto-filled OOTB field — it’s usually part of the CMDB CI Computer (or similar asset table) and is meant to be populated from Discovery / SCCM / Intune / JAMF / other inventory data sources.

If you want it to work as intended, you need two things:

1. A source of login history per device

2. A process to calculate who’s the most frequent user and update the field

---

1️⃣ Where This Field Comes From

• In CMDB CI Computer (table cmdb_ci_computer), there’s often a field like most_frequent_user (reference to sys_user).

• OOTB, this field is not automatically populated unless:

  • You are running ServiceNow Discovery with the “Computer Users” probe enabled.

  • Or you have SCCM integration with the Computer User Affinity feature mapped into ServiceNow.

---

2️⃣ How It Gets Populated OOTB

• Discovery / SCCM sends login events for each device.

• The Identification & Reconciliation Engine (IRE) or transform maps these events to a “Last logged in user” field and a frequency counter.

• A scheduled job or transform logic updates the most_frequent_user reference when enough data is collected.

Example: In SCCM:

• UserMachineRelationship table contains “Primary User” per device.

• The SCCM → ServiceNow MID Server import transforms this into most_frequent_user.

---

3️⃣ How to Configure If You Don’t Have SCCM or Discovery

If you have no automatic feed, you can simulate it:

Step A — Gather login history

• You’ll need a table (custom or log) that records each login event: device ID + user + timestamp.

• This could come from:

  • AD login logs

  • Intune sign-in data

  • Custom script importing CSV logs

Step B — Calculate the most frequent user

• Create a scheduled script execution (daily/weekly) that:

  • Counts login events per device per user.

  • Picks the top user for each device.

  • Updates cmdb_ci_computer.most_frequent_user with that user’s sys_id.

Example script logic:

javascript

CopyEdit

var gr = new GlideAggregate('x_your_login_history'); gr.groupBy('device'); gr.groupBy('user'); gr.addAggregate('COUNT'); gr.orderByAggregate('COUNT', 'DESC'); gr.query(); var lastDevice = ''; var topUser = ''; while (gr.next()) { if (lastDevice != gr.device) { lastDevice = gr.device; topUser = gr.user; var ci = new GlideRecord('cmdb_ci_computer'); if (ci.get(lastDevice)) { ci.most_frequent_user = topUser; ci.update(); } } }

---

4️⃣ Testing

• Verify the field is visible on the form (may need to personalize the form layout).

• After running the job or import, the field should display the user’s name.

---

If you’re using SCCM integration, I can give you the exact transform mapping that will populate the field automatically without scripting — that’s how most enterprises handle it.

[Hitesh_Mourya]

Hi,
I am also looking for the same I want to map the assigned to field with most frequent logged in user or Primary user from Intune in ServiceNow.
I have checked direct source column is not available for the mapping can we pull the source column from Intune or if we create a custom column so how we can create?

could you please suggest and share a code?