0
Completed

Inactive or Stale Accounts Report

jcrossley 2 years ago updated by Rishikesh Gajul (Product Manager) 2 years ago 9

Most security audits require us to be able to report on any stale or inactive user accounts. Having the ability to find this info and report on this is critical.

Hi,

Can you elaborate more on this please? An example or a use case would be helpful.

We give our customers a CW Control account, so they can access their machines remotely. Some customers use Control for temporary remote access, others use it every day. We need to know when these users have stopped using Control so that we don't have a bunch of unused accounts that have access to client computers.
The Colonial Pipeline hack was caused by hackers getting access to an unused account nobody realized was still enabled, and without the ability to audit when a user last logged in, we are blind to this same threat. 
I would think this would be a fairly simple report to incorporate, and would benefit every customer greatly. 

Thank you for reaching out on this to get more info. Appreciate your follow-up! 

Completed

Thanks for the detailed info on the request.

You need to install 'Report Manager' from the Extension Marketplace and run it to get the required report. There are some default reports you can use to get the data. For more info please read this article.

There isn't a reports for this there, and working with support, they said there isn't a way to get this data from the reporting. Unless you have a way, the support team does not. 

This is what I tried. I generated report via 'Session Connection Example'. It showed me users who have been using my account. With this I could easily locate inactive users and delete them if needed.

Please show the example you are using. There are no pre-made reports with this info, and any custom report doesn't have the required fields. I have worked with three different ConnectWise support reps who also have said this info is not available either, so you if can access this data, I would love for you to share the what the report looks like under the "Edit Report" view. 

Under Review

I think you are using 'Report' page to get the data. If yes, please download and install 'Report Manager' extension and then try below. This is what I tried to fetch out the report.

And the result I got:


Hope this helps !!

You were absolutely correct. I was using Reports, even though I had Reports Manager installed. I didnt realize Report Manager is in a different location. 
One last thing on this, similarly to your example, it appears to only pull a couple of days of logs. I am sure this is due to the default log retention time in Control. Can Control handle retaining logs for 365 days, and if so, what specific event logs contain the information needed? 
Thank you for pointing me in the right direction though on where to get this data. Hopefully Control can retain data for more than 30 days without affecting things, which is what Support is saying. If not, then the stale accounts report wouldnt be as useful. Thank you Rishikesh

Completed

Right, its pulling right from the database, so if maintenance has been performed actions beyond X days will not appear in the report. You can adjust the db maintenance but we recommend keeping it as small as possible.

Performance may become an issue for larger databases. For more info visit Db page.