How The FlexNet Inventory Agent Gathers Last Logged On User Details

The FlexNet Inventory Agent collects details about the last logged-on user account from multiple sources on a managed device. Understanding the order and logic used to gather this information helps you interpret inventory results and troubleshoot discrepancies.

Data sources for last logged-on user

The agent retrieves the last logged-on user by checking the following sources:

• Win32_NetworkLoginProfile WMI class
  The agent first identifies the most recent logon using instances of the Win32_NetworkLoginProfile WMI class.

To verify this value, run the following PowerShell command with local administrator rights:

Get-WMIObject Win32_NetworkLoginProfile | Select Name, LastLogon

NOTE: This source is used only when the LastLogonWMIEnabled agent preference is set to true (default). This capability was introduced in FlexNet Inventory Agent version R2.4 (2022). 

• Registry entry
  If the WMI query does not return results, the agent checks the following registry key to identify the last logged-on user account:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\LastLoggedOnUser

• Win32_ComputerSystem WMI property
  If neither of the previous sources returns a value, the agent retrieves the currently logged-on user account from the Win32_ComputerSystem.UserName WMI property.

To verify this value, run the following PowerShell command:

Get-WMIObject Win32_ComputerSystem | Select UserName

IMPORTANT: The value returned when you run these commands manually may differ from what the inventory process reports. This difference occurs because manual execution runs at a different time and under a different user context than the inventory collection process.