Does anyone know how the "LastSeen" field of the UserTracking Table in CiscoWorks is derived?
It depends on the version of Campus Manager and how the entries are discovered by UT. In all versions of Campus, if an entry is found during the UT acquisition cycle, the last seen time reflects the time at which the acquisition ran (local to the server).
In CM 5.0 and higher, if an entry is found via the Dynamic User Tracking process, then the last seen time is calculated based on the timestamp within the MAC address notification trap in relation to the time the switch was booted which is obtained via Campus Data Collection. This method, while technically correct on paper, can lead to problems where the last seen time may appear to be in the future. To that end, I filed CSCsl44916 to simplify this algorithm.