Configuring "Most Frequent Logged in User" to Show Primary User Name

Go to solution
hstetsenka
Tera Contributor

‎08-13-2025 07:44 AM

Hi All,

How do you configure and use the "Most Frequent Logged in User" field?


I’d like to set it up so it shows the name of the primary user — the person who uses a specific computer most often.

 

Thanks in advance!

0 Helpfuls
  • 1,060 Views
1 ACCEPTED SOLUTION

Go to solution
nityabans27
Mega Patron

‎08-13-2025 10:18 PM

 

The "Most Frequent Logged in User" field in ServiceNow is not a magically auto-filled OOTB field — it’s usually part of the CMDB CI Computer (or similar asset table) and is meant to be populated from Discovery / SCCM / Intune / JAMF / other inventory data sources.

If you want it to work as intended, you need two things:

  1. A source of login history per device

  2. A process to calculate who’s the most frequent user and update the field

1️⃣ Where This Field Comes From

  • In CMDB CI Computer (table cmdb_ci_computer), there’s often a field like most_frequent_user (reference to sys_user).

  • OOTB, this field is not automatically populated unless:

    • You are running ServiceNow Discovery with the “Computer Users” probe enabled.

    • Or you have SCCM integration with the Computer User Affinity feature mapped into ServiceNow.

2️⃣ How It Gets Populated OOTB

  • Discovery / SCCM sends login events for each device.

  • The Identification & Reconciliation Engine (IRE) or transform maps these events to a “Last logged in user” field and a frequency counter.

  • A scheduled job or transform logic updates the most_frequent_user reference when enough data is collected.

Example: In SCCM:

  • UserMachineRelationship table contains “Primary User” per device.

  • The SCCM → ServiceNow MID Server import transforms this into most_frequent_user.

3️⃣ How to Configure If You Don’t Have SCCM or Discovery

If you have no automatic feed, you can simulate it:

Step A — Gather login history

  • You’ll need a table (custom or log) that records each login event: device ID + user + timestamp.

  • This could come from:

    • AD login logs

    • Intune sign-in data

    • Custom script importing CSV logs

Step B — Calculate the most frequent user

  • Create a scheduled script execution (daily/weekly) that:

    • Counts login events per device per user.

    • Picks the top user for each device.

    • Updates cmdb_ci_computer.most_frequent_user with that user’s sys_id.

Example script logic:

 

javascript
CopyEdit
var gr = new GlideAggregate('x_your_login_history'); gr.groupBy('device'); gr.groupBy('user'); gr.addAggregate('COUNT'); gr.orderByAggregate('COUNT', 'DESC'); gr.query(); var lastDevice = ''; var topUser = ''; while (gr.next()) { if (lastDevice != gr.device) { lastDevice = gr.device; topUser = gr.user; var ci = new GlideRecord('cmdb_ci_computer'); if (ci.get(lastDevice)) { ci.most_frequent_user = topUser; ci.update(); } } } 
 

4️⃣ Testing

  • Verify the field is visible on the form (may need to personalize the form layout).

  • After running the job or import, the field should display the user’s name.

If you’re using SCCM integration, I can give you the exact transform mapping that will populate the field automatically without scripting — that’s how most enterprises handle it.

View solution in original post

5 REPLIES 5

Go to solution
Asim7
Tera Contributor
In response to nityabans27

‎09-09-2025 08:45 AM

Hi,

 

Thanks for the above.

 

In my organisation even though we have the Intune integration, the 'Most frequent logged in user' field is not being populated. Where does this need to be activated?

 

If someone wanted to map the 'Primary user' field value to the 'Most frequent logged in user' field instead, is this possible?

 

Thanks,

Asim

0 Helpfuls