WFBS-SVC associates the last logged-on user account on a specific protected endpoint. This allows you to monitor the activity of specific users. For example, when User A logs on to Endpoint X, WFBS-SVC associates Endpoint X with User A in the list. If User B logs on to Endpoint X, WFBS-SVC moves Endpoint X to User B in the list.  

If multiple endpoints use the default "Administrator" account, WFBS-SVC may display a long list of endpoints. associated with the "Administrator" account.

A user can still be seen even if no endpoints are associated but have a log detection.  

A user will automatically be removed from the list if this user no longer has associated endpoints and has no detection logs (60 days data retention).