You need to create a monthly report with all authenticated users on all devices.
 

The current Reporter and Web Security Service reporting templates do not support customized reporting other than the selectable criteria available on each report page.

Run an all-user report for the previous month and apply the User filter field that contains DOM\User (which indicates the user was authenticated).

Procedure

1. Log on to the WSS portal (https://portal.threatpulse.com).
2. Select Solution mode > Content Filtering > Reports.
3. Select New Forensic Report.
4. Filter When Date is Current Month(s) or When Date is Previous 1 Month(s).
5. Run the report.

NOTE: This is where to locate the access reports for all users within the specified period (for example: previous 1 month).

To filter only authenticated users with a domain name (for example, DOM\user):

1. Click Option.
2. Add Criteria.
3. User contains DOM.
4. Run the report.

The above to list includes only authenticated user; User field that contain the DOM\User.

1. To save the report, click Save As.
2. Define a report Name; for example: Domain DOM for last month.

To schedule running the report monthly:
Click Schedule.

With the above schedule, the report runs the first day of every month at 1:00 AM for the period of previous month with criteria above.

You can modify as long as the setting is available to select.
Add or remove criteria as necessary to achieve the results.

NOTE: For additional domains, create another report for the other domain name (for example: MOUNTAIN\Users); all other steps are similar.