In Symantec Endpoint Protection Manager (SEPM): for SEP 12.1 clients, the logged on user ("Logon user or Computer") field is not reflecting the currently logged on user, but rather the last user that has opened the SEP console on the machine.
In case where it is a new SEP installation the "Logon user" field will with high probability reflect the user that installed the SEP client- "administrator" in most cases. "Logon user" name does not change after another user logs on the computer. The change is only reflected if the newly logged on user opens the SEP console on client. This issue occurs regardless of the communication mode set (Push/Pull).
In case no user is logged on the machine, the "Logon User" field in SEPM will reflect the last logged on user. This is default behavior and is expected.