Discovery: how to get last logged in user from remote PC ?

[stryker129]

Is there a way to do that through Discovery?

Any hints would be appreciated.

Thanks

[VivekSattanatha]

Hi Ivan,

OOB ServiceNow will discover the current logged in user while discovering the device. It will use OOB Windows - OS Information probe and that contains this wmi path -Win32_ComputerSystem.UserName to discover the user.

If you want to see people who logged in last time then you need to write a custom probe. I have tried this PowerShell script and it showed the list of users logged in last time.

Get-WmiObject -ComputerName $computer -Credential $cred -Class Win32_UserProfile -Filter "Special='False'" | select @{Name='UserName';Expression={Split-Path $_.LocalPath -Leaf}}, @{Name='LastUsed';Expression={$_.ConvertToDateTime($_.LastUseTime)}}, PSComputerName | sort LastUsed -Descending

Through new sensor, you need to parse the first user from the result.

Regards,

Vivek

Based on the impact hit like, helpful or correct

[stryker129]

Vivek, thanks for your input,

Your script works from Powershell.

Can you please clarify how and whehe this script should be executed in ServiceNow?

I've a MID-server and I need to collect data from all computers beyond MID server.

So where should I paste this PowerShell script in ServiceNow platform?

Thanks in advance.

[VivekSattanatha]

Hi Ivan,

First, you need to create a new probe to get the result and a sensor to process the results. If this is for Windows Computer then you need to add the probe into Windows classification - Windows

Regards,

Vivek

Based on the impact hit like, helpful or correct

[stryker129]

Yes, I've done with the same scenario: added new probe to "Trigger probes" tab.

My question is: what is next? How and where shoul I paste script for getting logged in users?

And yes, all PCs are under Windows platform.