The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

List All Users That Have Logged Onto a Workstation (non built-in)

Description: List All Users on Workstation.

What The Data Shows: Useful to see if any local accounts created that aren't normal.

SQL:

Select
Username,
Description,
Directory 
FROM Users
WHERE GID <> "513";
2 Comments
esullivan
Carbon Black Employee

Hey @cstamand  appreciate your contribution!  We'll vet this submission and if it runs as expected we'll change this status of your query from Under Review to CB Approved.

Thanks again!

Ed Sullivan

tmccormack
Carbon Black Employee
Status changed to: Approved

Thanks @cstamand as always for your participation in our community. Nice query.