Skip to content

MachineUserHistory

User logon history information.

erDiagram
    MachineUser ||--o{ MachineUserHistory : "MachineUserID"
    MachineUserHistory ||--o{ MachineUserHistoryViewClientInformation : "MachineUserHistoryID"
    MachineUserHistory ||--o{ MachineUserHistoryVolatileEnvironment : "MachineUserHistoryID"
    MachineUserHistory ||--o{ MachineUserHistoryWTSSessionInformation : "MachineUserHistoryID"
    MachineUserHistory ||--o{ WmiInstanceHistory : "MachineUserHistoryID"

Fields

Field Type Description
CitrixSession boolean True if the Scan was made in a Citrix terminal server context. Detection of Citrix not always reliable depending on scanner invocation.
Created datetime Date/Time this relation was created. This is not the scan time but usually the import time.
EntraIdDeviceId guid Entra ID device id
EntraIdIdpDomain string Entra ID identity provider domain
EntraIdJoinType string Entra ID join type for this machine or this user
EntraIdJoinUserEmail string Mail address used to join Entra ID
EntraIdTenantDisplayName string Display name for this Entra ID tenant
EntraIdTenantId guid Entra ID tenant id
EntraIdUserInfoUserEmail string Email from Entra ID join info user info
EntraIdUserInfoUserKeyId guid User id from Entra ID join info user info
EntraIdUserInfoUserKeyName string User key name from Entra ID join info user info
ID numeric Internal ID for the MachineUserHistory entity (Primary Key)
LocalAdministrator boolean True if the user was member of the machine's local Administrators group at time of logon
MachineUserID numeric Internal ID that references the MachineUser entity (Foreign Key)
MsftDirectAccess boolean True if the machine was connected to the network via Microsoft Direct Access at time of scan
OctoscanBuildInfo string Detailed build information of the scanner that scanned this machine to user relation
OfflineScan boolean True if this record was generated by an offline scan (OctoOffline)
RemoteSession boolean True if the user was in a remote session with the machine
Scan datetime Date/Time this machine to user relation was scanned
ScanGUID guid GUID of the scan file that scanned this machine to user relation
ScannedAsAdministrator boolean True if the scan run with Administrator privileges
ScannerBaseFolder string Path to a folder from where the scanner was started
ScannerTag string Command-line tag that was specified on the scan of this machine to user relation history record
SessionName string Session name of the terminal session

References

Column Name Referenced Table Description
MachineUserID MachineUser m:n relation between machines and users

Referenced by

Table Column Name Description
MachineUserHistoryViewClientInformation MachineUserHistoryID For VMware view client
MachineUserHistoryVolatileEnvironment MachineUserHistoryID Inventories the volatile environment per machine user scan
MachineUserHistoryWTSSessionInformation MachineUserHistoryID For remote terminal sessions, records the WTSSessionInformation, see WTSQuerySessionInformation MSDN documentation
WmiInstanceHistory MachineUserHistoryID Each entity is an instance of a class scanned in a particular MachineUserHistory context. This table together with WmiInstanceHistoryProperty holds historized WMI data for each scan. See WmiInstance for description of the columns.