The following information is provided as a reference in how Primary User calculation works based on recent 8.x versions.
ITMS 8.1 and later
How is the Primary User information captured?
The process for determining the Primary User is multi- tiered. SMA monitors user login and logoff and stores every user session information into AeXUserMonitorLog.xml once the session is logged off. AeXUserMonitorLog.xml file is stored in the install directory of the Symantec Management Agent. This log contains a list of all user logon durations within the last 28 days. When user logs in or logs off SMA sends Evt_AeX_Client_LogOn NSE to the server.
The Symantec Management Agent uses this file to calculate who the primary user is for the client computer.
The following registry key controls the days that primary user is calculated on, this key is set to 28 by default:
For each <log> entry inside the AeXUserMonitorLog.xml file, if the date and time for the utc_lastloggedon are older then 28 days then Altiris Agent will remove these entries from the log file so that primary user will not be calculated based on these old records.
The durations recorded inside the AeXUserMonitorLog.xml are in seconds, and the time is calculated in UTC.
Below is an example of a log entry in the AeXUserMonitorLog.xml file:
<Log utc_lastloggedon="2018-09-11 19:18:14 -6:00" utc_year="2018" utc_month="9" utc_day="16" duration="398289" userID="MyDomain\John_Doe"/>
How is the primary user calculated?
The algorithm is quite simple:
Which registry location and values are used for calculating primary user?
|Key||Type||Value (some as example)||Description|
|PrimaryUserRecordDays||REG_DWORD||0x1c||Sets 28 day limit, can be changed at any time. No SMA restart is needed|
|PrimaryUser||REG_SZ||altiris\jdoe48||Holds the currently selected primary user|
Can the "PrimaryUserRecordDays" value be edited to 14 days globally?
The user can change it via the registry (done on each machine). The user could run a task on all the agents that change the registry to the desired value.
How are these tables used?
|dbo.Inv_AeX_AC_Primary_User||filled by basic inventory info|
|dbo.Evt_AeX_Client_LogOn||filled by logon/logoff NSE sent by agents|
Symantec Management Platfrom (SMP) Server provides an inventory class that lets you know who the primary user is on your Symantec Management Agent-enabled computer.
This class is called “AeX AC Primary User” and is found in the Resource Manager by clicking on the Inventory tab. The Inv_AeX_AC_Primary_User table is the storage for the AeX AC Primary User data class.