I had a question today regarding why a query showing the last logged on user was not returning the correct value.
Now this is a site that I am responsible for so I know there is nothing wrong with it. :o)
I had a quick look at the query, and found the answer straight away, I wonder why I have not seen this blogged before, or perhaps I have just missed it.
The query in question was accessing the User_Name0 field in the v_R_System view.
In case you are not aware v_R_System.User_Name0 is only updated during the last Network Discovery or Heartbeat Discovery.
So I always recommend using v_GS_COMPUTER_SYSTEM.UserName0 as this is updated when hardware inventory runs.
Now most places run their hardware inventory more frequently than their Network or Heartbeat discovery, hence my recommendation.
I was having to explain the diferences between how these two user name fields get updated only last Friday. In fact, it doesn't help that a NULL entry is placed in the field if the heartbeat discovery or hardware inventory is run when no user is logged on!
This simple query can be used as a demonstration of Dave's predicament if HW inventory is run while a user is logged off:
select vrsys.netbios_name0, vrsys.user_name0, vgscs.username0
from v_r_system AS vrsys
join v_gs_computer_system AS vgscs on vgscs.resourceid = vrsys.resourceid
where vgscs.username0 is null
If you've got an SMS 2003 SP3 site with Asset Intelligence installed and the SMS_Def.mof configured correctly, then you could also consider using the v_GS_SYSTEM_CONSOLE_USER view to find which user has used a console session the most/longest. (I don't have a SCCM installation in front of me to check the SCCM view name).