SCCM Last Logged On User: Query for All Systems

A straightforward SCCM WQL query to list every machine in your environment alongside the last user who logged onto it, with no prompts: useful as a base query you can filter or trim down depending on what you actually need to see.

The query

select
SMS_R_System.LastLogonUserName,
SMS_R_System.Name,
SMS_R_System.SMSAssignedSites,
SMS_R_System.Client,
SMS_R_System.IPAddresses,
SMS_R_System.IPSubnets,
SMS_R_System.MACAddresses,
SMS_R_System.OperatingSystemNameandVersion,
SMS_R_System.ResourceDomainORWorkgroup,
SMS_R_System.LastLogonUserDomain,
SMS_R_System.AgentName,
SMS_R_System.AgentSite,
SMS_R_System.AgentTime,
SMS_R_System.SNMPCommunityName,
SMS_R_System.SystemRoles,
SMS_R_System.SMSUniqueIdentifier,
SMS_R_System.ResourceId,
SMS_R_System.ResourceNames,
SMS_R_System.ResourceType,
SMS_R_System.NetbiosName
from
SMS_R_System

This brings back a lot of columns by design, network details, agent info, site assignment, and so on, alongside the last logon information. If you only need the basics, trim the SELECT list down to just LastLogonUserName and Name (or NetbiosName) for a much simpler result set.

Related variants

If you’d rather be prompted for a specific username and get back just that user’s machine, or prompted for a NetBIOS name to look up the last logged-on user for one specific machine, those are variations on this same base query with a WHERE clause and prompt added: worth building as separate saved queries in the console if you use them often, since prompted queries are handy for quick one-off lookups from the console UI itself.

Still Current on Configuration Manager 2603 (Updated for 2026)

This query’s underlying SMS_R_System class and its columns are unchanged on the current Configuration Manager release (2603). If the query comes back with an empty or stale LastLogonUserName for a machine you know has been used recently, check that machine’s Heartbeat Discovery and Active Directory User Discovery cycles: a stale hardware/discovery scan is the most common reason this column doesn’t reflect reality, not a fault with the query itself.

Resources

• Find system by Last Logged on User Query for SCCM
• Find last logged on user by NetBIOS name
• Browse our Windows Admin Toolkit picks on Amazon