Discovery: how to get last logged in user from remote PC ?

[stryker129]

Is there a way to do that through Discovery?

Any hints would be appreciated.

Thanks

[VivekSattanatha]

Hi Ivan,

WMI probe won't work for this. You need to create Powershell probe. Take an example of existing PowerShell probe like Windows-MSSQL and create your own PowerShell probe and sensor like that.

The PowerShell script has to be added as a new parameter in your probe. Look at the existing PowerShell probe you will get an idea. Also, don't forget to add the sensor for your probe.

Note: At last the created probe has to be added into Windows classification table (discovery_classy_windows)

Let me know if you find any issue

Regards,

Vivek

Based on the impact hit like, helpful or correct

[stryker129]

Thanks for your input.

Vivek, at first, we would like to get last logged-in user.

In order to do that we're using the following PS script:

Get-WmiObject -ComputerName $computer -Credential $cred -Class Win32_UserProfile -Filter "Special='False'" | select @{Name='UserName';Expression={Split-Path $_.LocalPath -Leaf}}, PSComputerName | sort LastUsed -Descending | Select-Object -first 1

When I am testing probe I have got next result:

Input:

Output:

In the "Sensors That React to This Probe" tab I created a new sensor:

new DiscoverySensor({
   process: function(result) {
      current.u_username = result.output;
   },
   type: "DiscoverySensor"
});

I don't get any result in the field "u_username".

Where I am wrong here?

[VivekSattanatha · Accepted solution]

Hi Ivan,

For your probe, you have to write sensor like this. Try and let me know if that works.

new DiscoverySensor({

  process: function(result) {

  if (gs.nil(result.output))

  return;

  this.parseOutput(result.output);

  },

  parseOutput: function(output) {

  var ci = this.getCmdbRecord();

  var line = output.split("\n");

  ci.u_username= line[2];

  },

  type: "DiscoverySensor"

});

Regards,

Vivek

Based on the impact hit like, helpful or correct.

[stryker129]

Thanks, it works but for the 1st time:

if sensor will start again - it should update current record in the table, but I catch an error:

TypeError: Cannot set property "u_username" of null to "admin"

Why ci is null second time (while update record) ? And what are the differences between "current" and "this.getCmdbRecord()" in this case? Why I cannot type var ci = current, for example?

Any thoughts?

Thanks

[VivekSattanatha]

Hi Ivan,

The error won't come if you run the discovery completely. It won't update the record if you test the probe by UI action.

And what are the differences between "current" and "this.getCmdbRecord()" in this case?   - Its a different way of writing code. you can use current as well. If you want to use current then inside the function use like below.

parseOutput: function(output) {

// var ci = this.getCmdbRecord(); //See I have commented this API and used current below

  var line = output.split("\n");

  current.u_username= line[2];

  },

Regards,

Vivek

Based on the impact hit like, helpful or correct