Discovery: how to get last logged in user from remote PC ?

[stryker129]

Is there a way to do that through Discovery?

Any hints would be appreciated.

Thanks

[VivekSattanatha]

Hi Ivan,

I gave you the commands to find the last logged in user from the target device. It wont update anything in the servicenow table. You need to write Sensors to parse your probe results.

To know how to write sensors :

Discovery sensors

Example: create a custom sensor

Regards,

Vivek

Based upon the impact hit like, helpful or correct

[stryker129]

Hi Vivek,

Your Power-shell script work fine as per our requirements on Windows PC:

Get-WmiObject Win32_UserProfile -Filter "Special='False'" | select @{Name='UserName';Expression={Split-Path $_.LocalPath -Leaf}}, @{Name='LastUsed';Expression={$_.ConvertToDateTime($_.LastUseTime)}}, PSComputerName | sort LastUsed -Descending | Select-Object -first 1

In ServiceNow I created new Sensor:

new DiscoverySensor({   
   process: function(result) {   
       current.u_last_login = resultWin32_UserProfile.LastUser;   
   },   
         type: "DiscoverySensor"   
});

The question here: how can I use PS-script in ServiceNow? Where should I add keys from powershell script? Is key "LastUser" in correct place in my Sensor example?

Thanks a lot!

[VivekSattanatha]

Hi Ivan,

I am sharing you the sensor code also.

Probe command which I used is below, I wrote sensor based on this one so don't change it

Get-WmiObject -ComputerName $computer -Credential $cred -Class Win32_UserProfile -Filter "Special='False'" | select @{Name='UserName';Expression={Split-Path $_.LocalPath -Leaf}}, LocalPath, Loaded, @{Name='LastUsed';Expression={$_.ConvertToDateTime($_.LastUseTime)}}, PSComputerName | sort LastUsed -Descending

Sensor code for the above probe command

new DiscoverySensor({

  process: function(result) {

  if (gs.nil(result.output))

  return;

  this.parseOutput(result.output);

  },

  parseOutput: function(output) {

  var ci = this.getCmdbRecord();

  //var cisid = ci.sys_id;

  var line = output.split("\n");

  if(line.length >1)

  {

  var params = line[0].split(": ");

  if (params.length > 1 ){

  var new_usr = params[1];

  var usr = new GlideRecord('sys_user');

  usr.addEncodedQuery('user_name='+new_usr);

  usr.query();

  if(usr.next()) {

  ci.u_last_login = usr.sys_id;

  }

  }

  }

  },

  type: "DiscoverySensor"

});

Note: I have taken Last login field as Reference to the user table. so the last logged in user from the result must be matched with ServiceNow user table user ID field. Also, I tested with only a few machines and it worked for me. you need to test completely before you go for production.

Regards,

Vivek

Based on the impact hit like, helpful or correct

[VivekSattanatha]

Hi Ivan,

Did the sensor script worked for you?

Regards,

Vivek

[stryker129]

Hi Vivek,

Sorry for the delay.

As for sensor code - all is pretty clear.

But unfortunately I didn't understand where and how I should use your shell-script?

Is that WMI fields related tab?

Thanks.