Is it possible to find a specific user on the domain? For example, if I want to know which machine(s) a particular user is logged into, is there a way to find them, with only the user id?
Announcement
Collapse
No announcement yet.
Finding Users...
Collapse
X
-
Re: Finding Users...
Here you go. Save below as a vbs file.
'************* Begin Script Here *********
'================================================= =========================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalSCRIPT(TM)
'
' NAME: FindUser.vbs
'
' AUTHOR: Joel Thoreson , USAALS / AEPCO
' DATE : 5/6/2003
'
' COMMENT: Finds a user on the domain.
'
'================================================= =========================
Dim WshShell : Set WshShell = WScript.CreateObject("WScript.Shell")
Dim WshNetwork : Set WshNetwork = WScript.CreateObject("WScript.Network")
Dim objArgs : Set objArgs = WScript.Arguments ' create object with collection
Dim fso : Set fso = WScript.CreateObject("Scripting.FilesystemObject")
Const ForReading=1, ForWriting=2
If objArgs.Count >= 1 Then
strUserName = objArgs(0) 'assign the passed user name to a variable
Else 'quit the script, no variable given, or too many variables passed
strUserName = InputBox("Enter the loggon of the individual you wish to query",,WshNetwork.UserName)
If strUserName = "" Then WScript.Quit
End If
If IsNull(strUserName) OR strUserName = "" Then WScript.Quit
OutputFilePath = "c:\ip1.txt"
' Flush the cache
WshShell.Run "cmd /c nbtstat.exe -R", 2, False
WScript.Sleep 1000
' Send a message to the user
WshShell.Run "cmd /c net send " & strUserName & " User locator message.", 2, True
WScript.Sleep 1000
' check the local machines cache, looking for UNIQUE
WshShell.Run "cmd /c nbtstat.exe -c | find ""UNIQUE"" > " & OutputFilePath, 2, True
WScript.Sleep 1000
On Error Resume Next
Dim objFile : Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)
Dim strIPAddress : strIPAddress = Trim(Mid(objFile.ReadLine,42,15)) 'read the line
' Nobody home
If Err.Number <> 0 Then
WshShell.Popup "User '" & UCASE(strUserName) & "' is most likely not logged on anywhere.", 8, "User not found"
objFile.Close
fso.DeleteFile(OutputFilePath)
WScript.Quit
End If
objFile.Close
WshShell.Run ("cmd /c nbtstat.exe -A " & strIPAddress & " > " & OutputFilePath)
WScript.Sleep 1000
Set objFile = fso.OpenTextFile(OutputFilePath, ForReading)
Do While objFile.AtEndOfStream <> True
aline=Trim(objFile.Readline) 'read a line
SearchString = "<20>" '20 says file sharing is installed and enabled. See Below!!
MyPos = Instr(1, aline, SearchString, 1) ' A textual comparison starting at
If MyPos <> 0 Then
strComputerName = Trim(Left(aline, (MyPos-1)))
MsgBox "Machine Name: " & strComputerName
End If
Loop
objFile.Close
Set objFile = Nothing
fso.DeleteFile(OutputFilePath)
' when running nbtstat, these are the codes
'00 Base computer name and Workgroups
'01 Master Browser
'03 Message Alert service (name of logged in user)
'20 Resource Sharing `server service` name
'1B Domain master-browser name
'1C Domain controller name
'1E Domain/workgroup master browser election announcement
'**************** End Script Here *********
Comment
-
Re: Finding Users...
Otherwise you can use this as a tool:
Save this as an .js file:
--------------------------------------
// Tommy Stromgren, 2005-06-21 (tommy_2tall (at) home.se)
var oShell = new ActiveXObject("WScript.Shell");
var oArgs = WScript.Arguments;
var User = oArgs(0).replace(/\/d/g, ""); // We do NOT want the switch /d to be sent to the "net send" command ( /d = send to
entire domain)
oShell.Exec("net send "+ oArgs(0) + " """);
WScript.Sleep(500); // It takes some time before the NetBIOS cache displays the name
var Cache = oShell.Exec("nbtstat -c").StdOut.ReadAll().replace(/\r/g,"");
var UserLine = Cache.slice( Cache.indexOf( User.toUpperCase() ) );
var UserLine = UserLine.slice( 0 , UserLine.indexOf("\n") );
var UserIP = UserLine.slice(37 , 52).replace(/\s/g,"");
var RemoteCache = oShell.Exec( "nbtstat -a " + UserIP ).StdOut.ReadAll().replace(/\r/g,"");
WScript.Echo(
"Empty "net send" message sent to: " + User.toUpperCase() +"\r\n" +
"Local NetBIOS cache entry:\r\n"+UserLine +"\r\n\r\n" +
"Registered NetBIOS Names on "+ UserIP +":"+ RemoteCache
);
-----------------------------
Create a tool and input:
wscript.exe //nologo "C:\path to file\Finduser.js" %E%
or
cscript.exe //nologo "C:\path to file\Finduser.js" %E%
for a commandwindow instead of popups.
Thanx Tommy_2Tall for the script ;D
Comment
-
Re: Finding Users...
I got an error with the JS file on line 8 character 8. Expected ;
Here is another method but the messenger service needs to be running on your systems for this to work.
Create a batch file
<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">@ECHO OFF
ECHO Trying to find the computer that the user is logged into...
NET SEND %1 "HelpDesk is looking for your computer -- Just Click OK"
NBTSTAT -c | find /i "%1" > usr.txt
FOR /f "tokens=4 delims= " %%i in (usr.txt) do set machineip=%%i
PING -a -n 1 %machineip% > ip.txt
TYPE ip.txt | find /i "Pinging" > ip1.txt
FOR /f "tokens=2 delims= " %%i in (ip1.txt) do set machinename=%%i
ECHO Username = %1
ECHO IP Address = %machineip%
ECHO Computer = %machinename%
ECHO.
PAUSE</div></div>
Then the command line should be something like this. note: I run it from a shared drive as I shared the tools with other admins.
<div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">\\servername\Scripts\HyenaTools\Scripts\wher eisuser.bat %E%</div></div>
You can change the pop up message displayed on the users computer by changing <div class="ubbcode-block"><div class="ubbcode-header">Quote:</div><div class="ubbcode-body">HelpDesk is looking for your computer -- Just Click OK</div></div>
[This message has been edited by Trammel (edited 06-21-2005).]
Comment
-
Re: Finding Users...
It seems like a few extra (unwanted) rows were created by the forum.
I'll make a new attempt at posting the correct code.
(The usage-instructions are the same as in Joker's post above)
// Tommy Strِmgren, 2005-06-21 (tommy.stromgren (at) scania.com)
var oShell = new ActiveXObject("WScript.Shell");
var oArgs = WScript.Arguments;
var User = oArgs(0).toUpperCase().replace(/\/d/g, "");
// Avoids accidental usage of the switch /d
//(/d = send to entire domain)
oShell.Exec("net send "+ oArgs(0) + " """);
WScript.Sleep(500); // It takes some time before the NetBIOS cache displays the name
var Cache = oShell.Exec("nbtstat -c").StdOut.ReadAll().replace(/\r/g,"");
var UserLine = Cache.slice( Cache.indexOf( User ) );
var UserLine = UserLine.slice( 0 , UserLine.indexOf("\n") );
var UserIP = UserLine.slice(37 , 52).replace(/\s/g,"");
var RemoteCache = oShell.Exec( "nbtstat -a " + UserIP ).StdOut.ReadAll().replace(/\r/g,"");
WScript.Echo(
"Empty "net send" message sent to: " + User +"\r\n" +
"Local NetBIOS cache entry:\r\n"+UserLine +"\r\n\r\n" +
"Registered NetBIOS Names on "+ UserIP +":"+ RemoteCache
);
Comment
-
Re: Finding Users...
Also if NBTSTAT doesn't do the trick, there is a great tool that will do this very fast. Additionally, it provides remote admin tools to instantly manage the list of computer(s) found. It's called User Locator by Motivate Systems. You can download it for free at www.MotivateSystems.com or the direct product page is at:
I use this tool everyday and recommend it to everyone!
Comment
Comment