SCCM Last Logged On User: Query for All Systems

A straightforward SCCM WQL query to list every machine in your environment alongside the last user who logged onto it, with no prompts — useful as a base query you can filter or trim down depending on what you actually need to see.

The query

select
SMS_R_System.LastLogonUserName,
SMS_R_System.Name,
SMS_R_System.SMSAssignedSites,
SMS_R_System.Client,
SMS_R_System.IPAddresses,
SMS_R_System.IPSubnets,
SMS_R_System.MACAddresses,
SMS_R_System.OperatingSystemNameandVersion,
SMS_R_System.ResourceDomainORWorkgroup,
SMS_R_System.LastLogonUserDomain,
SMS_R_System.AgentName,
SMS_R_System.AgentSite,
SMS_R_System.AgentTime,
SMS_R_System.SNMPCommunityName,
SMS_R_System.SystemRoles,
SMS_R_System.SMSUniqueIdentifier,
SMS_R_System.ResourceId,
SMS_R_System.ResourceNames,
SMS_R_System.ResourceType,
SMS_R_System.NetbiosName
from
SMS_R_System

This brings back a lot of columns by design — network details, agent info, site assignment, and so on — alongside the last logon information. If you only need the basics, trim the SELECT list down to just LastLogonUserName and Name (or NetbiosName) for a much simpler result set.

Related variants

If you’d rather be prompted for a specific username and get back just that user’s machine, or prompted for a NetBIOS name to look up the last logged-on user for one specific machine, those are variations on this same base query with a WHERE clause and prompt added — worth building as separate saved queries in the console if you use them often, since prompted queries are handy for quick one-off lookups from the console UI itself.

Still Current on Configuration Manager 2603 (Updated for 2026)

This query’s underlying SMS_R_System class and its columns are unchanged on the current Configuration Manager release (2603). If the query comes back with an empty or stale LastLogonUserName for a machine you know has been used recently, check that machine’s Heartbeat Discovery and Active Directory User Discovery cycles — a stale hardware/discovery scan is the most common reason this column doesn’t reflect reality, not a fault with the query itself.

Resources

• Find system by Last Logged on User Query for SCCM
• Find last logged on user by NetBIOS name
• Browse our Windows Admin Toolkit picks on Amazon