The User Logon Reports provides deep insights into user login behavior across your organization’s devices and domain controllers. These reports are essential for auditing user activity, identifying anomalies and ensuring proper access controls.
Whether you’re a system administrator monitoring usage, an IT security analyst performing audits or a compliance officer reviewing access logs, this suite of reports offers the visibility you need.
1. Computers Without Any User Logon
This report lists devices that have no record of any user login since the agent was installed. It helps identify unused or idle assets that may need attention, repurposing, or decommissioning.
Use Cases:
- Detect inactive or unassigned systems.
- Reclaim underutilized hardware.
- Audit compliance for device provisioning.
Key Fields:
- Device Name
- Last User Logged On
- Days Since Last Logon
- Agent Last Contact Time
- Domain Name
- OS Name
- Service Pack
- OS Version
- Last Boot Time
- IP Address
- Device Type
- MAC Address
- Platform
2. Computers with Active User Sessions
Displays all computers where at least one user is currently logged in. This report shows real-time user sessions and session counts on each machine.
Use Cases:
- Track who is currently logged in to which machine.
- Detect unauthorized or concurrent sessions.
- Monitor shared device activity.
Key Fields:
- Device Name
- Domain Name
- User Logon Count
- Logged-On User Name
- Logon Time
- IP Address
- Device Type
- MAC Address
- Platform
3. Currently Logged-In Users
Shows a user-centric view of all currently logged-in users across devices.
Use Cases:
- Understand current user distribution.
- Audit concurrent logins across multiple systems.
- Monitor high-privilege or shared account usage.
Key Fields:
- User Name
- Domain Name
- Concurrent Logon Count
- Logged-On Device
- Last Logon Time
- IP Address
- Device Type
- MAC Address
- Platform
4. User Logon Reports from Domain Controllers
Provides a summary of user logons captured by each domain controller. Useful for auditing logon traffic at the AD infrastructure level.
Use Cases:
- Analyze domain controller logon loads.
- Detect suspicious logon surges from specific controllers.
- Ensure logon events are correctly replicated across controllers.
Key Fields:
- Domain Controller Name
- Domain Name
- User Logon Count
- Unique User Logon Count
- IP Address
- Device Type
- MAC Address
5. User Logon History
Tracks historical logon activity of each user across all devices, including timestamps and durations.
Use Cases:
- Investigate user activity during security incidents.
- Identify patterns of excessive or abnormal access.
- Audit login hours and behavior for compliance.
Key Fields:
- User Name
- Domain Name
- User Logon Count
- Logged-On Device
- Last Logon Time
- Last Log Off Time
- Logon Duration
- Logon Type
- IP Address
6. User Logon History by Computer
Shows the user login history for each device. This system-centric view helps track who accessed which devices and when.
Use Cases:
- Detect shared usage of individual computers.
- Monitor changes in workstation assignments.
- Identify possible unauthorized access.
Key Fields:
- Device Name
- Domain Name
- User Logon Count
- Last Logged-On Username
- Last Logon Time
- Last Log Off Time
- Logon Duration
- IP Address
- Device Type
- MAC Address
- Platform
7. User Logon History on Domain Controllers
Lists user logon sessions specifically recorded by domain controllers, including duration and timestamps.
Use Cases:
- Validate AD-based logon activity.
- Support incident investigation timelines.
- Correlate with centralized security logs (SIEMs).
Key Fields:
- Domain Controller Name
- Domain Name
- Logon User Name
- Last Logon Time
- Last Log Off Time
- Logon Duration
- IP Address
- Device Type
- MAC Address
Pro Tips
- Use filters (e.g., by username or device type) to narrow down specific queries.
- Schedule automated exports for regular audits.