No announcement yet.

Find User to Computer

  • Filter
  • Time
  • Show
Clear All
new posts

  • Find User to Computer

    I know I can find a computer to a user, but is there a way to find a user to a computer. Most of the time, I know the user name, but need to know the computer they are logged on to.

  • #2
    Re: Find User to Computer

    Unfortunately there's no way to determine the computer when you have a username. What you can do is select your computers in the right window, then right-click and choose View Logged on User. When this is finished you can copy it to the clipboard and paste into Excel. Once in Excel you can sort or search for specific users. Do that in the morning or at the start of the week and you can have a general idea of where each user is.


    • #3
      Re: Find User to Computer

      Another idea is to view the Security log of your domain controllers with Hyena and sort for event ID 680, and [domain name]\ on the user field. Once you find the user name open the entry and it shows the source workstation or IP.

      To script this or for a quick command-line I find the Microsoft Log Parser to be pretty good as you can write SQL-like queries directly against remote event logs.


      • #4
        Re: Find User to Computer

        Copy this in a notepad and save as a vbs file.
        <div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">'************* Begin Script Here *********
        '================================================= =========================
        ' VBScript Source File -- Created with SAPIEN Technologies PrimalSCRIPT(TM)
        ' NAME: FindUser.vbs
        ' AUTHOR: Joel Thoreson , USAALS / AEPCO
        ' DATE : 5/6/2003
        ' COMMENT: Finds a user on the domain.
        '================================================= =========================

        Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
        Dim WshNetwork : Set WshNetwork = WScript.CreateObject("WScript.Network")
        Dim objArgs : Set objArgs = WScript.Arguments ' create object with collection
        Dim fso : Set fso = WScript.CreateObject("Scripting.FilesystemObject")
        Const ForReading=1, ForWriting=2

        If objArgs.Count >= 1 Then
        strUserName = objArgs(0) 'assign the passed user name to a variable
        Else 'quit the script, no variable given, or too many variables passed
        strUserName = InputBox("Enter the loggon of the individual you wish to query",,WshNetwork.UserName)
        If strUserName = "" Then WScript.Quit
        End If

        If IsNull(strUserName) OR strUserName = "" Then WScript.Quit

        OutputFilePath = "c:\ip1.txt"

        ' Flush the cache
        WshShell.Run "cmd /c nbtstat.exe -R", 2, False
        WScript.Sleep 1000
        ' Send a message to the user
        WshShell.Run "cmd /c net send " & strUserName & " User locator message.", 2, True
        WScript.Sleep 1000
        ' check the local machines cache, looking for UNIQUE
        WshShell.Run "cmd /c nbtstat.exe -c | find ""UNIQUE"" > " & OutputFilePath, 2, True
        WScript.Sleep 1000

        On Error Resume Next

        Dim objFile : Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)
        Dim strIPAddress : strIPAddress = Trim(Mid(objFile.ReadLine,42,15)) 'read the line

        ' Nobody home
        If Err.Number <> 0 Then
        WshShell.Popup "User '" & UCASE(strUserName) & "' is most likely not logged on anywhere.", 8, "User not found"
        End If

        WshShell.Run ("cmd /c nbtstat.exe -A " & strIPAddress & " > " & OutputFilePath)
        WScript.Sleep 1000

        Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)

        Do While objFile.AtEndOfStream <> True
        aline=Trim(objFile.Readline) 'read a line
        SearchString = "<20>" '20 says file sharing is installed and enabled. See Below!!
        MyPos = Instr(1, aline, SearchString, 1) ' A textual comparison starting at
        If MyPos <> 0 Then
        strComputerName = Trim(Left(aline, (MyPos-1)))
        MsgBox "Machine Name: " & strComputerName
        End If

        Set objFile = Nothing

        ' when running nbtstat, these are the codes
        '00 Base computer name and Workgroups
        '01 Master Browser
        '03 Message Alert service (name of logged in user)
        '20 Resource Sharing `server service` name
        '1B Domain master-browser name
        '1C Domain controller name
        '1E Domain/workgroup master browser election announcement
        '**************** End Script Here *********