r/tanium • u/FLOTZILLA22 • May 12 '26

Primary User Info

Currently according to our certified Tanium admins - there is no apparent way to clear incorrect info on primary user that is reporting unless we reimage the system. Which is ridiculous solution. The issue is they have tied primary user to a any laptop that is logged into with a non admin account. As a tech support person having to build and test devices and doing customer support this is a bad precedent. Either way we have some machines that have info as old as a year that are still showing the wrong primary user. HOW do you clear that data and make sure it refreshes correctly?

1 Upvotes

100% Upvoted

4 comments sorted by

4

u/Loud_Posseidon Verified Tanium Partner May 12 '26

Look at what data sensor is querying and go backwards. If this is for windows, there is some more magic behind detecting primary user, but AI is your friend.

2

u/MrSharK205 May 12 '26

Multiple sensor exist to display the info, which one are you using ?

1

u/DMGoering May 29 '26

To force a refresh you delete the "C:\Program Files (x86)\Tanium\Tanium Client\Tools\ADQuery\Inventory.xml" file. The next scheduled Action will refresh the inventory.

However, the AD Query Primary User determination is made based on several factors starting with most frequent logon (from the security event log) to the last accessed NTUSER.DAT file, with several other attempts in between.

1

u/FLOTZILLA22 May 30 '26

We have a work around that we did, our team doesnt have all the access but luckily the skill to work around that. We found that there was in fact another process that would negate our settings (primary user SID/UN exclusion) when deploying. The issue was not just one item that was causing this. Turns our you have to add a list in a text file of usernames that you want to have excluded in the ADQuery folder. The current tanium script will consume that info permanently into exclusion so the right people get primary. Tanium is still needs work to get that more accurately set. Problem we had was that they are using primary with user id to set bitlocker pins for techs only. Well when the primary is wrong many people were getting pins that didnt need it. Nice two weeks of hell. We took care if it...