Viewing a device's usage

Depending on the permissions associated with your user role, the Usage page may not be available.

On a device's Usage page, you can see details about the following activities that occurred on a device:

User authentication events:
- Login: A user logged in to the device, either directly or remotely, by entering their username and password on the login screen.
- Logout: A user or system logged out of the device and all applications are closed.
- Unlock: A user unlocked the device, either directly or remotely, by dismissing the Lock screen (if applicable) and entering their password on the login screen.
- Lock: A user or system locked the device. The user is still logged in to the device and open applications are still running, but a username and password is required to unlock the device.
- Sleep: A user or system put the device in sleep mode. The user is still logged in to the device, but all actions are paused.
- Wake: A user or system wakes the device up from sleep mode.
- Shutdown: A user or system restarts or turns off the device.
On this page, these activities are presented as individual events with time stamps.

Login and Unlock are the only activities that apply to Chromebook devices.

Depending on the device's operating system, power settings, and the method used to power off the device, you may see different events. For example, when you restart a Windows device and unlock it with a password, Logout, Shutdown, and Unlock events are recorded. When you restart a Mac device and unlock it with a password, Shutdown and Login events are recorded.

When the device is restarted using a hard reset (the power button is held down to restart the device) the only a Login event is recorded.
Device Activity: usage of the device presented in minutes of activity during a 24 hour period

A Windows or Mac device is deemed to be in use if it is unlocked. Activity ceases when the screensaver shows, the monitor is powered off, or the device is locked or shut down.

A Chromebook device is deemed to be in use if the display is active (not dimmed). Activity ceases when the display is dimmed, or the device is sleeping, locked, or shut down.

Note that if a device shuts down unexpectedly, the most recent activity is saved.

The Usage page only applies to devices with an active Device Usage policy.

Data is available for device usage events that occur after the activation date of the Device Usage policy. After activating the policy, you'll need to wait at least a few days before you can see data on the Usage page. Also note the following:

To capture Logout and Lock activities, the device must be running Secure Endpoint Agent version 7.23 or higher.

To capture Sleep, Wake, and Shutdown activities, the device must be running Secure Endpoint Agent version 8.0 or higher.

Viewing device usage

Device usage data is uploaded on a daily basis at the start of each day (00:00 local device time A date and time expressed in a device's local time zone, as opposed to server time. In the console, local device time applies to usage data collected from devices, and the scheduling of some device action requests.).

To view device usage information for a device:

On any page that shows linked device identifiers in the first column of the results grid, such as the All Devices page in the Devices area, click the link for the device that you want to view. Summarized information about the device shows in the page header.
Click the Usage tab.

The page provides information, in grid format, about each Login, Logout, Unlock, and Lock event on the device. The information is aggregated by date (24 hour period).

The total number of minutes that the device's screen was unlocked during each 24 hour period shows as minutes of activity next to the date.

Click a date to view the events that occurred on that day. The section expands and the following information shows about each event:

Column	Description
Event Timestamp (Local Device Time)	The date and time (local time on the device) of the user event
Activity Type	The type of activity performed by the user Possible values are: Login Logout Unlock Lock Sleep Wake Shutdown Only Login and Unlock events apply to Chromebook devices.
BSSID	The MAC address of the wireless local-area network (WLAN) that the device was connected to when the event occurred The BSSID column is empty if the device had no WLAN connection when the event occurred. This column applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
SSID	The identifier or network name that uniquely identifies the wireless local-area network (WLAN) that the device was connected to when the event occurred The SSID column is empty if the device had no WLAN connection when the event occurred. This column applies to Windows and Mac devices only, and Location services must be enabled on the device. For more information about enabling Location services, see Window or Mac documentation.
Local IP	The local Internet Protocol (IPv4 and IPv6, if available) address of the device when the event occurred
Public IP	The public Internet Protocol (IPv4 and IPv6, if available) address of the device when the event occurred
Active Directory OU	The distinguished name of the Active Directory organizational unit that the device was associated with when the event occurred The distinguished name is read from right to left and includes the full path to the object. For example: CN=Mary Smith,OU=Employees,OU=Marketing,OU=Miami,OU=Sites,DC=ABC Company,DC=com This column applies to Windows and Mac devices only.
Username	The username associated with the activity

Depending on the device's operating system, power settings, activity type, and the method used to power off the device, some information may not be available. When this happens, No data appears in the Secure Endpoint Console console, and the field is empty when you export the data.

The results are sorted by Event Timestamp, in descending order. To sort the results by another column, click the applicable column header. To reverse the sort order, click the column header again. An icon indicates whether the list is sorted in ascending or descending order.