How can I find the Username from remote computer?

[A3_CbM_TYK]

How can I find the User Name of the currently logged user on a remote computer using the remote computer IP?

[DiGGiTY]

Go to the command line an type nbtstat -A <IP of remote computer>. This will return all of the NetBIOS names registered on the computer, one of which is the username.

[A3_CbM_TYK]

Thanks for the reply. I know this, but there are some computers in my local network that don't answer with username <03>. There is active user and if I check with NetWkstaUserEnum(), this function returns correct result. What is the correct way of doing this? Please help with information

[DiGGiTY]

Do you need something that will retreive the active user for many machines at once, or are you just looking to perform the command occassionally.

[A3_CbM_TYK]

The computers are logged on domain. I need to make a simple database with who is logged, and when logged in and out. If there is solution for one computer I will write software which will check the computers in background one by one.

[DiGGiTY]

Sysinternals has a command line tool that can return the locally logged on user (and more info as well). You can use this to create a text dumpfile and parse it to pull out the relevent data:

PsLoggedOn

You can determine who is using resources on your local computer with the "net" command ("net session"), however, there is no built-in way to determine who is using the resources of a remote computer. In addition, NT comes with no tools to see who is logged onto a computer, either locally or remotely. PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or a remote one. If you specify a user name instead of a computer, PsLoggedOn searches the computers in the network neighborhood and tells you if the user is currently logged on.

PsLoggedOn's definition of a locally logged on user is one that has their profile loaded into the Registry, so PsLoggedOn determines who is logged on by scanning the keys under the HKEY_USERS key. For each key that has a name that is a user SID (security Identifier), PsLoggedOn looks up the corresponding user name and displays it. To determine who is logged onto a computer via resource shares, PsLoggedOn uses the NetSessionEnum API. Note that PsLoggedOn will show you as logged on via resource share to remote computers that you query because a logon is required for PsLoggedOn to access the Registry of a remote system.

Installation

Copy PsLoggedOn onto your executable path and type "psloggedon".

PsLoggedOn works on NT 4.0, Windows 2000 and Windows XP.

Usage

usage: psloggedon [-?] [-l] [-x] [\\computername | username]

-l

Shows only local logons instead of both local and network resource logons.

-x

Don't show logon times.

\\computername

Specifies the name of the computer for which to list logon information.

username

If you specify a user name PsLoggedOn searches the network for computers to which that user is loggedon. This is useful if you want to ensure that a particular user is not logged on when you are about to change their user profile configuration.

[DiGGiTY]

Using code to perform the function might be easier... Here's a decent snippet.

'RegObj must be installed to run this script.

'http://msdn.microsoft.com/vbasic/downloads/addins/default.asp

'Author.Mike Ford.08.26.03

Dim rserver

const objKey = "\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"

const name = "DefaultUserName"

strComputer = Inputbox("Remote Computer?")

If strComputer = "" Then

WScript.Quit

End If

Set fso = WScript.CreateObject("RegObj.Registry")

Set connect = fso.RemoteRegistry(strComputer)

Set username = connect.RegKeyFromString(objKey).Values(name)

wscript.echo "The Last Logged on User was: " & username

[A3_CbM_TYK]

Why I can not use NetSessionEnum API? If this is the standart way to determine which user on which mashine is logged, I can use this api.

[DiGGiTY]

Go ahead and use that API. There are several ways to accomplish this task. I think doing it programmatically will be best.

[A3_CbM_TYK]

Can you help me with Network Management Functions, which functions I need to retrieve active remote usernames? The api has many similarly functions.