Untitled
unknown
plain_text
a year ago
412 B
4
Indexable
DeviceInfo | join kind=leftouter ( DeviceLogonEvents | summarize LastLogon = max(TimeGenerated) by DeviceId ) on DeviceId | join kind=leftouter ( Event | where EventID == 5156 // This event ID indicates drive mapping | summarize MappedDrives = make_set(RenderedDescription) by DeviceId ) on DeviceId | project DeviceName = DeviceName, LoggedOnUser = LoggedOnUserName, MappedDrives
Editor is loading...
Leave a Comment