Client Management Suite

Hi:

First of all, we are using CMS 7.1 SP2. Now, my current nightmare ;)

I'm getting crazy trying to find how to show information of the user using an application.

In the Evt_Application_Start table there is a field named "UserGuid", which is as the name says, a Guid. The issue is that I cannot imagine to with table/view I must link this field so I can get information about the user that used the application metered.

In  both the AeXAMInventory.txt and AeXProcessList.txt files (in <install path>\Altiris agents\) appears the information of the user that launched each process, and in a NSE file I captured, it seems to send the information with the user, but I cannot seem to imagine where this information is saved.

I found a view (vUGUserAccount) with information from users, but if i link the fields Evt_Application_Start.UserGuid and vUGUserAccount._ResourceGuid I get no results.

Any help will be welcome.

Thanks:

     Falquian

Hi Falquian

You can use different tables for User, here something for the start (you can check which table you want to get the userinformation, because they have different. So I let them all in for reference --"u, ac, gu" )

SELECT a._eventTime,

a.PID,a.[Policy Name],

a.[Start Date],

a.[Command Line],

a.Denied,a.FilePath,

u.Name,

gu.[Display Name],

(ac.Domain + '\' + ac.UserId) as [Username]

FROM [Symantec_CMDB].[dbo].[Evt_Application_Start] as a

LEFT JOIN [Symantec_CMDB].[dbo].[RM_ResourceUser] u on a.UserGuid = u.Guid

LEFT JOIN [Symantec_CMDB].[dbo].[Inv_Global_Windows_Users] ac on a.UserGuid = ac._ResourceGuid

LEFT JOIN [Symantec_CMDB].[dbo].[Inv_Global_User_General_Details] gu on a.UserGuid = gu._ResourceGuid

Hope this helps

Cheers

Patrick

Patrick:

Thanks for providing this query, but more than half of the lines I get in my test environtment do not get any user name.

I hope that there is an easier way of getting the user name that have used an application.

Regards:

       Falquian

Falquian

Then maybe the primary user (this on per month basis) is the right thing for you?:

SELECT a._eventTime,

a.PID,a.[Policy Name],

a.[Start Date],

a.[Command Line],

a.Denied,a.FilePath,

u.Name,

gu.[Display Name],

(ac.Domain + '\' + ac.UserId) as [Username],

(pu.domain + '\' + pu.[user]) as [Primary User]

FROM [Symantec_CMDB].[dbo].[Evt_Application_Start] as a

LEFT JOIN [Symantec_CMDB].[dbo].[RM_ResourceUser] u on a.UserGuid = u.Guid

LEFT JOIN [Symantec_CMDB].[dbo].[Inv_Global_Windows_Users] ac on a.UserGuid = ac._ResourceGuid

LEFT JOIN [Symantec_CMDB].[dbo].[Inv_Global_User_General_Details] gu on a.UserGuid = gu._ResourceGuid

LEFT JOIN [Symantec_CMDB].[dbo].[Inv_AeX_AC_Primary_User] pu on a._ResourceGuid = pu._ResourceGuid

They are related directly to the computer resource (not to the userguid)

Cheers

Patrick