Currently it doesn't appear that the last logged in Windows users is tracked in the change log. I am attempting to determine what users are accessing our various computers. Many of our computers are shared and I am hoping to capture last logged in users over time.
When I have created a query that includes the Windows.Username, every audit record simply displays the same entry. Audit_log.username is always blank but I don't think that is an audited value.
Currently only the "current" last logged in user is kept. I'll see if I can maybe make this work a la the 'system' table and track it. Maybe I'll move that field into the system table. Unsure, but I should be able to do something here. But as it stands, it is not tracked, only the latest is recorded.