Export (0) Print
Expand All

SMS_SystemConsoleUser Client WMI Class

System Center

Updated: October 28, 2009

Applies To: System Center Configuration Manager 2007, System Center Configuration Manager 2007 R2, System Center Configuration Manager 2007 R3, System Center Configuration Manager 2007 SP1, System Center Configuration Manager 2007 SP2

The SMS_SystemConsoleUser class is a client Windows Management Instrumentation (WMI) class, in Configuration Manager, that defines usage data about users, based on the Windows security event log.

noteNote
For this class to gather usable data, the Auditing of Logon/Logoff policy must be turned on for each computer.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties.


Class SMS_SystemConsoleUser
{
      DateTime LastConsoleUse;
      UInt32 NumberOfConsoleLogons;
      String SystemConsoleUser;
      UInt32 TotalUserConsoleMinutes;
};

The SMS_SystemConsoleUser class does not define any methods.

LastConsoleUse
Data type: DateTime

Access type: Read only

Qualifiers: None

The last date and time when the user logged off from the console.

NumberOfConsoleLogons
Data type: UInt32

Access type: Read only

Qualifiers: None

The total number of logons recorded in the system security event log for the specific user.

SystemConsoleUser
Data type: String

Access type: Read only

Qualifiers: [key]

The user name for the user logged on to the console.

TotalUserConsoleMinutes
Data type: UInt32

Access type: Read only

Qualifiers: None

The total number of console logon minutes recorded in the system security event log for the user.

This class gathers information about a specific user from the system security event log by using logon and logoff events. When a logon event is found, the associated logon ID is used to search for a matching logoff event. If more than one logoff event is found for a specific logon, then the last logoff event is used to calculate the amount of time that the user was logged on. This is because it is possible to issue more than one logoff request before the system actually performs the logoff action. If a matching logoff event cannot be found, the next shutdown event or logon event is used in place of a logoff event. If none of these can be found, the latest entry in the security log is used.

noteNote
Only interactive logons are acknowledged by this class.

Some security logs can roll over frequently, or they can extend for several years. The time polled for this class is limited to the last 90 days.

Runtime Requirements

Development Requirements

Show:
© 2014 Microsoft