Is it possible to match IP Address with Usernames?

[Adam1V]

Our server is set to DHCP and the ips recently renewed, so im not sure who has what ip anymore.

I had 7 attempts from an internal ip address trying to access the server (failed attempts).

I know the IPs havent changed over night, so im wondering how i might be able to match up whos using what ip address from the server?

Is this possible?

Adam

[John Veteran]

Maybe with Active Directory. What are they trying to access on your server? A file share? A web page?

[metalguy90]

go to the Computer Management console, connect to the server, and you can see what sessions and files are open.

in session, this will tell you the user and what IP they are coming from.

[brand]

-Last logged on username reg key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ string: DefaultUserName

-VBScript to query currently logged on user

[brand]

quick solution:

after making a hidden share name loggedonusers$ and giving domain users write access:

logon script:

pushd \\server\loggedonusers$\
echo %username% > %hostname%.txt
popd

test it out. this will give you a bunch of txt files with names of the hostnames containing the username.

if you want to spend some time on it, you can make a database and make a vbscript search and replace the username versus hostname in a recordset.

You can also look into querying AD as logs will show who authenticated from where.

[MazX_Napalm]

Lan Spy. Freeware. It can poll at lot of info, but you can decide what info you want before polling the network.

[Joel]

In the DHCP console, it tells you which computer has which address.

[brand]

oh yea:

1) pslogged to query a pc.

2) use WMI (the Win32_ComputerSystem object, UserName property)

2b) use WMIc. make a batch file as follows: %%1 is the first argument. /node specifies the system. So the command syntax would be WHATEVER.BAT targethostname. This property only contains the user that is logged on at the system. It will not contain all users who are logged on to a term server; but only at the Console.

wmic /node:%%1 computersystem get username

[Adam1V]

wow, alot of different suggestions there, i actually found an easier way :)

Opened up my AVG antivirus network installer, and scanned the domain to see what packages are installed, it lists the PC name and IP address. thanks for the info though guys

[Joel]

This was easier than looking in your DHCP console for the leases? :blink:

[bobbba]

  Joel said:

This was easier than looking in your DHCP console for the leases? :blink:

Gotta agree :yes:

[HDW-mobile]

hmm...

Start --> run --> CMD --> NETSTAT and see the list... netstat can see the group list ect

old trick still works...

NETSTAT or NET see for any help (type behind NETstat /help)

[mastermate]

how about:

NBTSTAT -A ipaddress