App Control: What Determines Last Logged In Users?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How does the Agent determine the list of Last Logged In User(s) shown in the Console > Assets > Computers > Connection History?

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

The Agent queries the operating system for this list. This list is managed by the operating system, and in most circumstances the OS will not purge entries until the system is rebooted.

Additional Information

• On Windows this data is returned using LsaEnumerateLogonSessions. For each session the WTSConnectState is queried.
  • If the state is WTSActive, the session is reported to the Server.
  • If the state is WTSDisconnected, the user will not be reported.
  • When a user session logs off, Windows does not clear the WTSActive state, so the user will be reported.
  • When a user disconnects, Windows changes the state to WTSDisconnected, so the user will not be reported.