Agent Client Collector gathers 'last used' data for Windows applictions which have not been launched by users<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Description Software usage reports contain "last used" timestamps for applications. For applications running on Windows OS hosts (e.g. OneNote) the last used timestamp may not reflect the last time the user launched the application. This typically occurs because background processes (synchronization, automatic updates, etc.) trigger Windows UserAssist registry updates, which ACC (Agent Client Collector) then captures as user activity. How ACC Collects "Last Used" Data on Windows ACC utilizes OSQuery to gather Windows software last used information through the following command: osqueryi.exe --config_path "" --json --logger_min_status 1 "select p.path, p.last_execution_time, p.count, u.username from users u CROSS JOIN userassist p on p.sid=u.uuid order by p.last_execution_time desc;" This command queries the Windows UserAssist table below, to retrieve the 'last_execution_time' values; "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist" For all applications which have a last_execution_time value in this table the data is extracted and returned in the check payload. There is no option to filter inside the check. Configuration Options and Limitations The ServiceNow instance provides filtering capabilities through the following methods; Reclamation Rules If a reclamation rule exists for the last_used_date metric for specific software it will persist the last_used_date into the corresponding [cmdb_sam_sw_install] record System Property Control lf there is not a Reclamation Rule present for the returned software, it checks the 'sn_acc_vis_content.disable_sam_reclamation_rules_for_licensable_softwares' system property When set to true and the product IS licensable: Persist the last_used_date into the corresponding [cmdb_sam_sw_install] record When set to true AND the product IS NOT licensable: Do not persist last_used_date When set to false: Do not persist last_used_date