How to use Log Analytics Workspace to identify Personal VM's which are not in use from last 30d

Question

We want to identify and delete personal VM's which do not have any logins from their assigned users

jasonmasten · Answer

Hi PuneetAg_. This isn't exactly what you asked for but figured it could help. I wrote a solution to help a customer remove session hosts in a personal host pool automatically based on their desired expiration in days: https://github.com/jamasten/RemoveExpiredAvdPersonalSessionHosts/tree/main

Be sure to test the code on test host pool and validate the results before implementing in production. If you run into any problems, please post an issue on my repo.

kidd_ip · Answer

PuneetAg_&nbsp;Last logon is :&nbsp;SecurityEvent| where TimeGenerated &gt; ago(30d)| where EventID in (4624) // An account was successfully logged on.| summarize count(), arg_max(TimeGenerated, *) by EventID, Activity , Computer, LogonTypeName, Account

Forum Discussion

How to use Log Analytics Workspace to identify Personal VM's which are not in use from last 30d

2 Replies

Resources