Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 2974 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Finding currently Logged on user From Enterprise Console

ktremain

Hi,

Does anyone know of a way to find out the currently logged on username of windows computers running Sophos A/V that are registered against an Enterprise Console?

I'm trying to find an easy way to identify the user when a virus is detected as "NT Authority\SYSTEM"

Thanks,

Karl

:40077


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    There is a field in the database called LastLoggedOnUser.  It is based on the last time a status message was returned to the management server from the endpoint so it may not be 100% accurate but if computer to user is a 1-1 mapping then it should be good enough.

    sqlcmd -E -S .\sophos -d SOPHOS52 -Q "SELECT Name, LastLoggedOnUser from ComputersAndDeletedComputers WHERE Name='[COMPUTERNAME]'"

    Where:

    .\sophos is a local SOPHOS names SQL Server instance

    SOPHOS52 is the name of the "Core" database: see: http://www.sophos.com/en-us/support/knowledgebase/17323.aspx

    Replace [COMPUTERNAME] with the name of the computer.

    Regards,

    Jak

    :40091
Reply
  • 0

    Hi,

    There is a field in the database called LastLoggedOnUser.  It is based on the last time a status message was returned to the management server from the endpoint so it may not be 100% accurate but if computer to user is a 1-1 mapping then it should be good enough.

    sqlcmd -E -S .\sophos -d SOPHOS52 -Q "SELECT Name, LastLoggedOnUser from ComputersAndDeletedComputers WHERE Name='[COMPUTERNAME]'"

    Where:

    .\sophos is a local SOPHOS names SQL Server instance

    SOPHOS52 is the name of the "Core" database: see: http://www.sophos.com/en-us/support/knowledgebase/17323.aspx

    Replace [COMPUTERNAME] with the name of the computer.

    Regards,

    Jak

    :40091
Children
No Data