locked
which user?which computer? RRS feed

  • Question

  • Hi,

    I’m running windows 2003 and clients are xp sp3,is there any way too find out which user log in on which computer?

    thanks

    Tuesday, December 22, 2009 6:48 PM

Answers

  • There is no good way to tell. AD does keep track. You can use logon and logoff scripts to write information to a shared file and use this to tell which user last logged into (and perhaps is still logged into) a given computer. I have example logon and logoff (also startup and shutdown) scripts that log information linked on this page:

    http://www.rlmueller.net/Logon5.htm

    Another option is to query a server for sessions, but this is not reliable (sessions come and go depending on user activity on the server), and is only practical if there are just a few servers. For example:

    Option Explicit
    
    Dim objDC, objSession
    
    Set objDC = GetObject("WinNT://MyServer/LanmanServer")
    For Each objSession In objDC.Sessions
        Wscript.Echo objSession.Name
        Wscript.Echo objSession.User
        Wscript.Echo objSession.Computer
    Next
    The computer is often identified by IP address. A final option is to enable auditing, but the resulting logs are large and difficult to parse.

    Richard Mueller
    MVP ADSI
    • Marked as answer by Bruce-Liu Wednesday, December 30, 2009 6:45 AM
    Tuesday, December 22, 2009 10:10 PM

All replies

  • There is no good way to tell. AD does keep track. You can use logon and logoff scripts to write information to a shared file and use this to tell which user last logged into (and perhaps is still logged into) a given computer. I have example logon and logoff (also startup and shutdown) scripts that log information linked on this page:

    http://www.rlmueller.net/Logon5.htm

    Another option is to query a server for sessions, but this is not reliable (sessions come and go depending on user activity on the server), and is only practical if there are just a few servers. For example:

    Option Explicit
    
    Dim objDC, objSession
    
    Set objDC = GetObject("WinNT://MyServer/LanmanServer")
    For Each objSession In objDC.Sessions
        Wscript.Echo objSession.Name
        Wscript.Echo objSession.User
        Wscript.Echo objSession.Computer
    Next
    The computer is often identified by IP address. A final option is to enable auditing, but the resulting logs are large and difficult to parse.

    Richard Mueller
    MVP ADSI
    • Marked as answer by Bruce-Liu Wednesday, December 30, 2009 6:45 AM
    Tuesday, December 22, 2009 10:10 PM
  • Hi Mahyar,

    This is not possible as richard mentioned. If you know the FQDN then you can query the registry to pull up the information.

    I find utilites which populates clients along with their ipaddress eg: Hostname to Ipaddress

    Wednesday, December 23, 2009 2:28 AM
  • Hello Mahyar,

    Among other features, UserLock monitors user sessions in realtime and let you know who is connected, from which workstation(s), for how long, etc.

    Best,

     


    François Amigorena President & CEO IS Decisions (Security Software) http://www.isdecisions.com
    Thursday, September 30, 2010 2:23 PM
  • Thanks Francois,
    Saturday, October 2, 2010 10:10 AM