App Control: What Determines Last Logged In Users?
search cancel

App Control: What Determines Last Logged In Users?


Article ID: 286552


Updated On:


Carbon Black App Control (formerly Cb Protection)


How does the Agent determine the list of Last Logged In User(s) shown in the Console > Assets > Computers > Connection History?


  • App Control Console: All Supported Versions
  • App Control Agent: All Supported Versions


The Agent queries the operating system for this list. This list is managed by the operating system, and in most circumstances the OS will not purge entries until the system is rebooted.

Additional Information

  • On Windows this data is returned using LsaEnumerateLogonSessions. For each session the WTSConnectState is queried.
    • If the state is WTSActive, the session is reported to the Server.
    • If the state is WTSDisconnected, the user will not be reported.
    • When a user session logs off, Windows does not clear the WTSActive state, so the user will be reported.
    • When a user disconnects, Windows changes the state to WTSDisconnected, so the user will not be reported.