Hello All, I am executing a query for Last logged on user name, it works fine. But few of the system i m seeing last logged on user as SYSTEM. I wanted to under why for some machines SYSTEM is showing as the last logged on User

First of all, last logged on user is the user that last logged on before the last hardware discovery cycle. It's therefore not necessarily the real last logged on user. If the configmgr client installed something in local system context (run with administrative rights) you will see SYSTEM as last logged on user.

Also as another alternative you can leverage console user potentially. Granted this is a SQL (not WQL) query below that you can use in a report but the same theme could be leveraged for a WQL formatted differently of course. So ensure Success Login Event Logs are being generated (security) to ensure console user logins are captured and Enable Asset Intelligence Console User to start gathering this information by right clicking on Asset Intelligence and selecting "Edit Asset Intelligence Reporting Class Settings". A hardware inventory will be required to pull this information so it could take a while. SELECT DISTINCT v_GS_SYSTEM_CONSOLE_USER.SystemConsoleUser0 as [User Name], v_GS_COMPUTER_SYSTEM.Name0 AS [Computer Name], v_GS_COMPUTER_SYSTEM.Model0 AS Model, v_GS_COMPUTER_SYSTEM.Manufacturer0 AS Mfg, v_GS_PC_BIOS.SerialNumber0 AS Serial, v_GS_COMPUTER_SYSTEM.NumberOfProcessors0 AS [# Processors], v_GS_PROCESSOR.NormSpeed0 AS [Processor Speed], v_GS_X86_PC_MEMORY.TotalPhysicalMemory0 AS Memory, v_GS_OPERATING_SYSTEM.Caption0 AS OS, v_GS_OPERATING_SYSTEM.CSDVersion0 AS [Service Pack] FROM v_GS_COMPUTER_SYSTEM INNER JOIN v_GS_SYSTEM_CONSOLE_USAGE ON v_GS_COMPUTER_SYSTEM.ResourceID = v_GS_SYSTEM_CONSOLE_USAGE.ResourceID INNER JOIN v_GS_SYSTEM_CONSOLE_USER on v_GS_COMPUTER_SYSTEM.ResourceID = v_GS_SYSTEM_CONSOLE_USER.ResourceID INNER JOIN v_GS_OPERATING_SYSTEM ON v_GS_SYSTEM_CONSOLE_USAGE.ResourceID = v_GS_OPERATING_SYSTEM.ResourceID INNER JOIN v_GS_X86_PC_MEMORY ON v_GS_OPERATING_SYSTEM.ResourceID = v_GS_X86_PC_MEMORY.ResourceID INNER JOIN v_GS_SYSTEM_ENCLOSURE_UNIQUE ON v_GS_X86_PC_MEMORY.ResourceID = v_GS_SYSTEM_ENCLOSURE_UNIQUE.ResourceID INNER JOIN v_GS_PROCESSOR ON v_GS_SYSTEM_CONSOLE_USAGE.ResourceID = v_GS_PROCESSOR.ResourceID INNER JOIN v_GS_PC_BIOS ON v_GS_PC_BIOS.ResourceID = V_GS_COMPUTER_SYSTEM.ResourceID