I am looking through the SEP 12 Database Schema for where the User of the computer with the SEP client is listed.

For instance when we run the Computer Status report (Monitors > Logs > Log Type: Computer Status), we get a column that includes "User"

I would like to create an SQL query for an internal program that takes an IP address and returns the user.

Thanks.

See if any of these help:

https://www-secure.symantec.com/connect/forums/sql-querys-database

I always use this one

Symantec Endpoint Protection Manager 12.1.2 Database Schema

http://www.symantec.com/business/support/index?page=content&id=DOC6039

what you are looking for should be under SEM_Agent or inventory

You can do something like below:

SELECT [COMPUTER_NAME]

      ,[COMPUTER_DOMAIN_NAME]
      ,[CURRENT_LOGIN_USER]
      ,[CURRENT_LOGIN_DOMAIN]
      ,[IP_ADDR1]
  FROM [SymantecEndpointProtectionManager].[dbo].[SEM_COMPUTER]
  WHERE [IP_ADDR1] = 'DECIMAL VALUE'

Note that IP_ADDR1 field is a decimal representation of the IP address.

You wrote:

> I would like to create an SQL query for an internal program that takes an IP address and returns the user

It is probably easier to lookup the IP address and query for COMPUTER_NAME than IP Address or else you will have to incorporate IP_Address to decimal conversion and query for that (see http://www.ipaddresslocation.org/convertip.php for example).