User Access overview

UAL license option required

This query requires the UAL license option.

List Microsoft User Access Logging (UAL) per user, server and role.

Parameters

Name	Type	Description
Organizations	list	Select one or multiple organizations. The number in parantheses is the number of machines in the organization.
Role	list

Fields

Name	Type	Visible	Description
Organization ID	numeric	false	Internal ID that references the Organization entity (Foreign Key)
Organization	string	true	Name of the organization this entity is mapped to
Machine ID	numeric	false	Internal ID that references the Machine entity (Foreign Key)
Machine Guid	guid	false	A unique ID that can be used to link to this machine object by external applications
Machine	string	true	Distinct machine name. Use Column Chooser to show partial values such as Name or Domain of machines
Domain Name	string	false	Windows NETBIOS Domain Name
Machine Name	string	false	Machine name (computer name)
Virtual Machine	bool	false	True if this is a virtual machine
Operating System	string	false	Full name of the OS
Operating System Version	string	false	Additional version information about the OS
Operating System Build	string	false	Build number of the OS
Manufacturer ID	numeric	false	Internal ID that references the Manufacturer entity (Foreign Key)
Manufacturer	string	false	Normalized manufacturer information. See field 'Raw Manufacturer' for scanned information
Raw Manufacturer	string	false	Manufacturer of the machine as defined in WMI
Model	string	false	Model of the Machine as defined in WMI
Last Ual Scan	date	false	Time of the last imported User Access Logging scan on this machine. Null for machines that don't support UAL.
Last Ual Scan GUID	guid	false	GUID of the last imported User Access Logging scan on this machine. Null for machines that don't support UAL.
User Name	string	true	The user name on the client that accompanies the UAL entries from installed roles and products, if applicable.
User Access User ID	numeric	false	OctoSAM internal user ID if available
Product Name	string	true	Microsoft User Access Logging product name
Role Name	string	true	Microsoft User Access Logging role name
Role Guid	guid	false	Microsoft User Access Logging role GUID
First Seen	date	true	The date and time when a user first accesses a role or service
Last Seen	date	true	The date and time when a user last accessed a role or service
Activity Count	numeric	true	The number of times a particular user accessed a role or service
User Organization	string	true	Name of the organization this user is mapped to
User Organization ID	numeric	false	Internal ID that references the Organization entity (Foreign Key)
User ID	numeric	false	Internal ID that references the User entity (Foreign Key)
User Guid	guid	false	A unique ID that can be used to link to this user object by external applications
User	string	true	Distinct user name. Use Column Chooser to show partial values such as Login Name, Domain or Display Name of users
User Domain Name	string	false	Domain of the logged on user
User Login Name	string	false	Access
Display Name	string	false	DisplayName attribute from the directory service
User Principal Name	string	false	UserPrincipalName from the directory service
User Mail	string	false
Current Date Time	date	false	Date and time the query was run. For reference if you use and save query results.

Main entities referenced from this query

• Machine

• User

• UalUserAccess

• UalRole

Query information

Property	Value	Description
Query Guid	75292fe4-2f2b-47f3-b8e2-fdeac3678ef9	The internal id of the query. Must be unique
SupportsDesktop	true	If true, the query can be started from the OctoSAM Windows GUI
SupportsWeb	true	If true, the query can be started from the OctoSAM Web UI
LastUpdate	2025-09-10 17:27:37	Last change to this document
Build	1.11.6.94	OctoSAM build that last changed this document