Here’s a quick tip on why some of the data in reports based on SystemConsoleUsage may be missing in SMS 2003:
Issue: Reports based on the SystemConsoleUsage class do not show all data, although the data is actually being collected.
Cause: Data stored under SystemConsoleUsage comes from the Local Security Database and information in the Local Security database is saved only when a user logs off. This can also occur if the information written in the audit logs get over-written due to the rollover period being too small.
Resolution: To cover both of these scenarios, make sure that the users log themselves off their workstations before they leave, this would make sure all data is saved in WMI. If the rollover period is too short, you could try extending the roll over period of the event logs so as to accommodate more events.
J.C. Hornbeck | Manageability Knowledge Engineer