Find User to Computer

[Guest]

I know I can find a computer to a user, but is there a way to find a user to a computer. Most of the time, I know the user name, but need to know the computer they are logged on to.

[cmccullough]

Re: Find User to Computer

Unfortunately there's no way to determine the computer when you have a username. What you can do is select your computers in the right window, then right-click and choose View Logged on User. When this is finished you can copy it to the clipboard and paste into Excel. Once in Excel you can sort or search for specific users. Do that in the morning or at the start of the week and you can have a general idea of where each user is.

[Guest]

Re: Find User to Computer

Another idea is to view the Security log of your domain controllers with Hyena and sort for event ID 680, and [domain name]\ on the user field. Once you find the user name open the entry and it shows the source workstation or IP.

To script this or for a quick command-line I find the Microsoft Log Parser to be pretty good as you can write SQL-like queries directly against remote event logs.

[Trammel]

Re: Find User to Computer

Copy this in a notepad and save as a vbs file.
<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">'************* Begin Script Here *********
'================================================= =========================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalSCRIPT(TM)
'
' NAME: FindUser.vbs
'
' AUTHOR: Joel Thoreson , USAALS / AEPCO
' DATE : 5/6/2003
'
' COMMENT: Finds a user on the domain.
'
'================================================= =========================

Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
Dim WshNetwork : Set WshNetwork = WScript.CreateObject("WScript.Network")
Dim objArgs : Set objArgs = WScript.Arguments ' create object with collection
Dim fso : Set fso = WScript.CreateObject("Scripting.FilesystemObject")
Const ForReading=1, ForWriting=2


If objArgs.Count >= 1 Then
strUserName = objArgs(0) 'assign the passed user name to a variable
Else 'quit the script, no variable given, or too many variables passed
strUserName = InputBox("Enter the loggon of the individual you wish to query",,WshNetwork.UserName)
If strUserName = "" Then WScript.Quit
End If

If IsNull(strUserName) OR strUserName = "" Then WScript.Quit

OutputFilePath = "c:\ip1.txt"

' Flush the cache
WshShell.Run "cmd /c nbtstat.exe -R", 2, False
WScript.Sleep 1000
' Send a message to the user
WshShell.Run "cmd /c net send " & strUserName & " User locator message.", 2, True
WScript.Sleep 1000
' check the local machines cache, looking for UNIQUE
WshShell.Run "cmd /c nbtstat.exe -c | find ""UNIQUE"" > " & OutputFilePath, 2, True
WScript.Sleep 1000

On Error Resume Next

Dim objFile : Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)
Dim strIPAddress : strIPAddress = Trim(Mid(objFile.ReadLine,42,15)) 'read the line

' Nobody home
If Err.Number <> 0 Then
WshShell.Popup "User '" & UCASE(strUserName) & "' is most likely not logged on anywhere.", 8, "User not found"
objFile.Close
fso.DeleteFile(OutputFilePath)
WScript.Quit
End If
objFile.Close

WshShell.Run ("cmd /c nbtstat.exe -A " & strIPAddress & " > " & OutputFilePath)
WScript.Sleep 1000

Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)

Do While objFile.AtEndOfStream <> True
aline=Trim(objFile.Readline) 'read a line
SearchString = "<20>" '20 says file sharing is installed and enabled. See Below!!
MyPos = Instr(1, aline, SearchString, 1) ' A textual comparison starting at
If MyPos <> 0 Then
strComputerName = Trim(Left(aline, (MyPos-1)))
MsgBox "Machine Name: " & strComputerName
End If
Loop

objFile.Close
Set objFile = Nothing
fso.DeleteFile(OutputFilePath)

' when running nbtstat, these are the codes
'00 Base computer name and Workgroups
'01 Master Browser
'03 Message Alert service (name of logged in user)
'20 Resource Sharing `server service` name
'1B Domain master-browser name
'1C Domain controller name
'1E Domain/workgroup master browser election announcement
'**************** End Script Here *********
</div></div>