Endpoint Insights
How to Query Asset Intelligence for Top Console User Details
Topics: Endpoint Insights
Here’s some background on how I came to write this blog post. In a recent forum post, someone mentioned that user details were not being displayed within a ConfigMgr report called Hardware 01 A – Summary of computers in a specific collection.
To begin with, there are two major steps that many people miss when troubleshooting why top console user details aren’t displayed in reports that are supposed to show these details. First, you need to ensure that AI data is enabled. Second, you also need to have the workstation logon audit policy enabled within AD as a GPO.
At a high level, here are the troubleshooting steps you should take when top console user details are not displayed in ConfigMgr reports:
· Ensure that AI data is turned on for collection by hardware inventory.
· Ensure that the computer logon audit policy is enabled.
· On each problem computer review the AI log file and InventoryAgent.log.
· Run WEBMTest or a PowerShell query to review each problem computer’s details.
This blog post will show you how to troubleshoot the top console user details of problem computers by using both WEBMTest and PowerShell to query the two AI classes that makeup top console user data.
Back to the forum post, it was confirmed that AI data was enabled. Next, by following the steps in a blog post that I wrote a few years ago, “Enable Workstation Logon Audit Policy in Order to Collect Top Console User Details,” it was confirmed that the workstation logon audit policy was also enabled. Next a review of the InventoryAgent.log and the AI log file, AssetAdvisor.log (see below), were both good.
In the AssetAdvisor.log, you will see references to the two WMI AI classes that makeup the top console user details. The two classes are: SMS_SystemConsoleUser and SMS_SystemConsoleUsage. As you can see from the log snip-it above, there were no errors and everything was successful.
How can we now find out what is listed within these two classes?
The first method to query the two AI classes will use WEBMTest and the second method will use PowerShell.
WEBMTest
First, make sure that you are an Administrator on the computer and open WEBMTest in elevated permission mode.
Click Connect…
Ensure that Namespace says rootcimv2sms and then click on the Connect button.
Click on the Enum Classes… button.
Select Recursive and click OK.
Browse to the SMS_SystemConsoleUsage class and then double-click on it.
Click on the Instances button.
Double-click on the object.
To make it is easier to read, select the Local Only check box. You’ll notice that for this computer (mine) the top console user is gartekgarth with a total console time of 5748 minutes. Also notice that there is the number, “1,” listed under TotalConsoleUsers. This confirms that there is only one user on this computer.
In this example, I applied the same steps, but on another computer. The results appear in the above screenshot. Notice in this screenshot that the number, “2,” is listed under TotalConsoleUsers. Who are they? Clearly you can determine from the screenshot that one of the users is asmiley, but who is the other one?
To uncover this information we need to look at SMS_SystemConsoleUser.
Using the same first four steps as before, instead of browsing to the SMS_SystemConsoleUsage class, I double-clicked on the SMS_SystemConsoleUser class.
Next, click on the Instances button.
Notice that there are two objects listed; one for asmiley and one for garth.
Quickly looking at both users (I double-clicked on each object) we can determine why asmiley is listed as the top console user. We can see that he has 42 logons with 95000+ minutes of console time whereas garth only has 4 logons with 42000+ minutes of console time.
PowerShell
There is a rumor that WEBMTest may be replaced by PowerShell. Pe
rsonally, I don’t think that will happen anytime soon. If this does happen, though, how do you gather the same details using PowerShell?
Lucky for you, I have a script! In order to get a better understanding of PowerShell (there’s a long story here that I won’t get into), I wrote a script to collect the same details as the WEBMTest steps. I started by searching the internet. Once I found the basic details that I needed, I pieced everything together to produce the script below.
No re-typing needed! You can simply download the PowerShell script from here.
Please note: this script will work with a local computer or a remote computer. It’s exactly the same as WEBMTest. I queried both classes at the same time to make it convenient.
The results look as follows:
I hope this all helps to explain how you can query the two WMI AI classes in order to check top console user details for a computer using both WEBMTest and PowerShell. Use whichever method you like, however, most of the time I stick with WEBMTest. It’s a personal preference!
If you have any questions, please feel free to contact me @GarthMJ.
