Forum Discussion
Log Analytics Query for computer last login/active date and time
Hi, I am looking for a query where I can get last login/active date and time for computers in a separate column. I am already using the below query for windows update WaaSDeploymentStatu...
That table doesn't contain that data, so are you looking for a JOIN to a table that does, something like
WaaSDeploymentStatus
| where UpdateCategory == "Quality" and TimeGenerated > ago(60d)
| summarize updateInfo = arg_max(ReleaseName, DeploymentStatus, DetailedStatus, DetailedStatusLevel, ExpectedInstallDate) by Computer
| join (
SecurityEvent
| where EventID == 4624 // 4624 - An account was successfully logged on
| summarize LastHeatbeat = arg_max(TimeGenerated, *) by Computer
) on Computer
| project updateInfo , LastHeatbeat