Locating a Stolen PC

Exchange does not log MAC addresses. Even if it did, since you don't know the one from your computer, it wouldn't do you much good.

Searching for a computer name is not going to do you much good either. Unless computer names are assigned, there would not be anything to stop someone else from using the same name (other than the fact that duplicate names can cause problems on the network). I don't think you would have much of a case with the campus police just because you found a computerwith the same name.

Even if you did find a computer with the same name or with your MAC address (if you knew it), tracking either of these to a specific physical location would be almost impossible. At best, if your campus network used differentphysical subnet for each dorm, you might be able to track it to a given building, but that's all.

I'm sorry, but you are pretty much out of luck.

The manufacturer might be able to tell you the MAC, especially if it was imbedded on the motherboard.

Network switches maintain lists of MAC addresses attached to each of their ports. I don't know how your campus network is set up. If it was wired recently there might be a single user jack on each switch port so that would lead you directly to the connected device. The only problem is that there are likely to be a lot of switches to check. Sometimes each switch port serves a floor or group of rooms. That would narrow the search a little.

Looking to see what devices were connected to your room's switch won't help. The switch only maintaines the MAC addresses for a few minutes after the connection is broken.

There are a few products designed to get a stolen laptop to contact a security service when they are reconnected to the network. This won't help you now but might help you in the future. There are also some handy devices that let you lock your laptop to an immovable object.

If you have had Brand Name computer, look for your papers, may be you have "proof of purchase", you may have some serial numbers, like CPU, motherboard, hard drive or even NIC MAC address. I know that new Intel CPUs has Serial Numbers, but I don't really know if it's possible to read it remotely. But in this case you may just check computer physicaly and prove that it's your computer.

If you have MAC address, only way to track it - check LAN Switch where this computer is connected. MAC address in the packet is changed every time when IP packet crosses any router. So, it has only "local value". But if you have IPX protocol in your network, you may see MAC addresses for all computers in the network, since it's part of IPX address.

One more way is to check new computer if it matches to configuration you have had. But it depends on what OS is installed, how it's configured, if it allows to have remote access, etc. But again, easiest way is to look for new computers in your network and check them physically. And hear for rumors (social engenering).

Good luck.

If there was a DHCP server on your network and it logs MAC address you may have some luck. Do the following:
1. If you remember an IP Address that used in the pass and you remember the date you used it get the MAC from the DHCP log and goto step 32. If you don't remember an IP Address or you don't remember a date: On exchange check the IP address of the last time you loged on using your old computer. From the DHCP log obtain the MAC address. Goto step 3
3. Ask your sysadmin if they can moniter the ports on their switches. If they can try obtaing the MAC address from the switch that way you will even know to which port it is plugged in. To narrow down your search check the DHCP log if that MAC is currently logged on. If your sysadmin doesn't want to moniter the Switch than at least check when the user is logged on on the DHCP server and try hunting thru the rooms (thru the subnet you should be able to narrow it down to specific floors/buildings).

Usually when you get to college you have to register your computer on the network with ResNet, and they take the manufacturer of your network card as well as the MAC address. If that is the case at your school, once you've fingered a few machines you feel could be yours, you should be able to go to the admin, find out which IP they are using, then match the MAC either to their account or yours...also if you said it has XP on it, if you bought it brand name, the Administrator accounts password is blank OEM. C$ is a default administrative share, you could connect to it and view/change everything on the drive. you could load a program such as dameware http://www.dameware.com and remotely control the machine to run any of the system propertywindows - hardware monitor, dxdiag, msinfo32 etc. Make sure you have made a statement to campus police first about the physical description of your case, and any parts/peripherals that you know about.

good luck!!

nick