Finding currently Logged on user From Enterprise Console

Question

Hi,

Does anyone know of a way to find out the currently logged on username of windows computers running Sophos A/V that are registered against an Enterprise Console?

I'm trying to find an easy way to identify the user when a virus is detected as "NT Authority\SYSTEM"

Thanks,

Karl

This thread was automatically locked due to age.

jak · Accepted Answer

Hi, There is a field in the database called LastLoggedOnUser.  It is based on the last time a status message was returned to the management server from the endpoint so it may not be 100% accurate but if computer to user is a 1-1 mapping then it should be good enough. sqlcmd -E -S .\sophos -d SOPHOS52 -Q "SELECT Name, LastLoggedOnUser from ComputersAndDeletedComputers WHERE Name='[COMPUTERNAME]'" Where: .\sophos is a local SOPHOS names SQL Server instance SOPHOS52 is the name of the "Core" database: see:  http://www.sophos.com/en-us/support/knowledgebase/17323.aspx Replace [ COMPUTERNAME ] with the name of the computer. Regards, Jak :40091