Understanding Primary User Calculation Methods in 8.x

Products

• IT Management Suite

Issue/Introduction

The following information is provided as a reference in how Primary User calculation works based on recent 8.x versions.

 

 

Environment

ITMS 8.1 and later

Cause

Customer Education

Resolution

QUESTION
How is the Primary User information captured?

ANSWER
The process for determining the Primary User is multi- tiered. SMA monitors user login and logoff and stores every user session information into AeXUserMonitorLog.xml once the session is logged off. AeXUserMonitorLog.xml file is stored in the install directory of the Symantec Management Agent. This log contains a list of all user logon durations within the last 28 days. When user logs in or logs off SMA sends Evt_AeX_Client_LogOn NSE to the server.

The Symantec Management Agent uses this file to calculate who the primary user is for the client computer. 
The following registry key controls the days that primary user is calculated on, this key is set to 28 by default:
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Inventory\PrimaryUserRecordDays
For each <log> entry inside the AeXUserMonitorLog.xml file, if the date and time for the utc_lastloggedon are older then 28 days then Altiris Agent will remove these entries from the log file so that primary user will not be calculated based on these old records.
The durations recorded inside the AeXUserMonitorLog.xml are in seconds, and the time is calculated in UTC.
Below is an example of a log entry in the AeXUserMonitorLog.xml file:

<?xml version="1.0"?>
-<UserLog>
<Log utc_lastloggedon="2018-09-11 19:18:14 -6:00" utc_year="2018" utc_month="9" utc_day="16" duration="398289" userID="MyDomain\John_Doe"/>
</UserLog>

 

QUESTION

How is the primary user calculated?

ANSWER
The algorithm is quite simple:

• AeXUserMonitorLog.xml stores the history of user sessions
• SMA calculate primary user prior to basic inventory update
• -- takes all the old sessions from XML, adjusts them to 28 day limit
• -- takes all the current sessions from Windows, adjusts them to 28 day limit
• -- sums up durations of all the sessions for each user and selects the user with the longest duration as the primary user

QUESTION 
Which registry location and values are used for calculating primary user?

ANSWER
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Inventory

Key	Type	Value (some as example)	Description
PrimaryUserRecordDays	REG_DWORD	0x1c	Sets 28 day limit, can be changed at any time. No SMA restart is needed
PrimaryUser	REG_SZ	altiris\jdoe48	Holds the currently selected primary user

 

QUESTION
Can the "PrimaryUserRecordDays" value be edited to 14 days globally?

ANSWER
The user can change it via the registry (done on each machine). The user could run a task on all the agents that change the registry to the desired value.

 

QUESTION
How are these tables used?

ANSWER

dbo.Inv_AeX_AC_Primary_User	filled by basic inventory info
dbo.Evt_AeX_Client_LogOn	filled by logon/logoff NSE sent by agents

Symantec Management Platfrom (SMP) Server provides an inventory class that lets you know who the primary user is on your Symantec Management Agent-enabled computer. 
This class is called “AeX AC Primary User” and is found in the Resource Manager by clicking on the Inventory tab. The Inv_AeX_AC_Primary_User table is the storage for the AeX AC Primary User data class.