Windows·65,589 discussions

DHCP IP addresses to logon names?

Locked

Hi. I need to know what the logon name is of a user that has received an IP address through my DHCP server. Is there a way to tell which IP is being used by a logon name? Windows 2000 network is what I have. Thanks.

Topic

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

download the utility nbtscan
you can quickly scan a subnet for the names and IP’s of everyone logged on
http://tinyurl.com/k1jk

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

look in the the DHCP allocations tab, and find ot what the host name is, and then use nbtsts to find out who is logged on at that machine.

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

Here is how I would handle this. There are a variety of ways, though, but this is my way.

Get the IP addresses the DHCP server has allocated. Then run the following command for each IP address:

nbtstat -A “IP_ADDRESS”

That will query the remote NetBIOS table on the machine. YOu will get something like this:

NetBIOS Remote Machine Name Table

Name Type Status
———————————————
MYMACHINE <00> UNIQUE Registered
MYDOMAIN <00> GROUP Registered
MYMACHINE <03> UNIQUE Registered
MYMACHINE$ <03> UNIQUE Registered
MYMACHINE <20> UNIQUE Registered
JOE <03> UNIQUE Registered

Ok, reading NetBIOS codes. What fun! The <03> code is the one you will want. That is the code for the Messenger Service (which handles NET SEND messages). This code will be listed for the machine name AND for the logged-in username, since you can send a NET SEND message to a machine OR a user account.

So, in my above example, my machine is called MYMACHINE. Yes, it is listed several times, but only 1 time with the <03> code ( the MYMACHINE$ is used by Windows as the real machine name, which requires its own <03> code; this is how NetBIOS works. Weird, eh?)

And the other <03> must be my logged on user name, JOE.

Voila! You found me!

MAC Address = 00-10-B5-BC-EC-AD

Reply To: DHCP IP addresses to logon names?

In reply to Reply To: DHCP IP addresses to logon names?

So, you can use this method to see who is logged into a machine.

hope this helps

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

Another thing you can try. Look in Computer Management under active shares. It will show the computer name and user name. Sort by the user name, find the user you want and look at their computer name. Ping their computer name and you will see the IP address for that computer.

Good luck,

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

The problem you ask is a bit confusing me. Why? Because IP is refering to the computer level – not user level. W2K is multiuser environment, so on the same machine can log a lot of users but the IP is the same for that machine.

Here the simplest way:
ping -a x.y.z.w – and you’ll have the computer name showed in the reply.

It’s a bit confusing if you have computers named different than the username in your network. But I presume that you are interested about which computer is logged on then rather the user.
Also you can check the DNS records in the reverse lookup zone to see every IP to NAMES.(if you have reverse lookup zones configured).
Also you can download lanetscan utility from the internet (it’s free) and you can input to scan the whole range of IP addresses. You’ll get more then you are asking using this very good program.

Reply To: DHCP IP addresses to logon names?

In reply to Reply To: DHCP IP addresses to logon names?

I am back with another good tool: psloggedon.exe which is part of pstools. You can download them from internet. There are 10 (I think) very good tools for administrators tasks.

Reply To: DHCP IP addresses to logon names?

In reply to DHCP IP addresses to logon names?

All of the answers I recieved were good ones. Our company uses a naming convention that is dependent on the position that the computer is assigned to. Therefore, the IP address refers to the machine name but does not tell us the name of the user who is currently logged onto that particular machine. A pain, but something we have to live with.

So, the responses that used the nbtscan utility helped us out. The little program utility that works with this was helpful.

[Author]

Replies