Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

UDT Active Directory WMI Namespace for User Login Time

I am curious what WMI namespace and WMI class UDT uses when accessing a Active Directory domain controller when trying to track username information?

Reason I ask is when we track username information all our "Most Recent Login Times" are over a year old and I suspect I have a WMI problem on my DC's. It doesn't appear to be root\cimv2 - Win32-UserProfile because that just pulls logged in users on the local DC and not actual domain logins with workstation information.

any ideas?

-b

Find more posts tagged with

wmi_namespace

udt_user_display

WMI

Accepted answers

All comments

ctopaloglu

I have the same problem. I suggest you to open a case to Solarwinds. Then please share the results. I know I did this lots of times.

Bahlkris

Done, I'll report back any findings.

**EDIT1

I got a ticket open and setup a test case. We have LEM onsite and our server team put the LEM client on all our DC's and my desktop. I shutdown and rebooted, logged in and LEM caught the whole thing. UDT shows no change to the login times. Sent those files over to support. Something is clearly amiss.

Bahlkris

, are you by chance 2008r2 native? And do you see any 4768 or 4769 events on your domain controller security logs?

ctopaloglu

Yes we are using w2008r2 as well. We can see 4769 and 69

Bahlkris

We aren't on this end, I am having my AD guys look at auditpol to get those events added. If you are seeing those ID but your UDT is still wrong I would probably open a ticket. We may have different issues, or you just may be ahead of me.