The PCs that are being probed are likely not set for WMI responses. As for why it works when the user logs in again, that is how IP to user mappings are made so that makes sense. In addition to WMI probing, (considering these appear to be failing) you can be monitoring other servers in the Windows domain (e.g. file maps. printers, exchange mail servers) so that you can maintain the mapping and the user does not have to log in to refresh the mappings To be able to maintain mappings as the user maps drives etc. enable "server session read" on the UserID agent and the UserID agentless on the firewall so even if WMI probes you may have success in maintaining the user to ip mappings without relying solely on when the users log in. HTH
... View more