PDA

View Full Version : User login lookup

zoomy942
08-22-07, 03:08 PM
So, in my citrix environment, i have this one stinkin' printer that keeps auto populating. It's connected to a PC called Note-Nursery, and i know there is a way to look at who is logged onto that machine using command prompt, but i cant remember how....

any of you know what im talking about?
DiscipleDOC
08-22-07, 03:34 PM
So, in my citrix environment, i have this one stinkin' printer that keeps auto populating. It's connected to a PC called Note-Nursery, and i know there is a way to look at who is logged onto that machine using command prompt, but i cant remember how....

any of you know what im talking about?
This should be in t he Network/Security forum, n00b. :p
lduguay
08-22-07, 03:41 PM
So, in my citrix environment, i have this one stinkin' printer that keeps auto populating. It's connected to a PC called Note-Nursery, and i know there is a way to look at who is logged onto that machine using command prompt, but i cant remember how....

any of you know what im talking about?
From sysinternals.com:
psloggedon \\Note-Nursery
evilghost
08-22-07, 03:43 PM
nbtstat -a Note-Nursery

If you have IP:

nbtstat -A a.b.c.d

Use the <03> value.
zoomy942
08-22-07, 03:49 PM
nbtstat -a Note-Nursery

If you have IP:

nbtstat -A a.b.c.d

Use the <03> value.

nbtstat.. thats the one.

i havent used it since i was in the AF and we had to watch for unauthorized pc's getting on the network.

thanks:) i feel like an idiot now that i remember what it is.

zoomy942 = n00b
evilghost
08-22-07, 03:51 PM
Always glad to help.
zoomy942
08-22-07, 03:53 PM
this is cute...
evilghost
08-22-07, 03:57 PM
Means it hasn't registered with WINS, just do this:

tasklist /S note-nursery /FI "USERNAME ne NT AUTHORITY\SYSTEM" /V
lduguay
08-22-07, 03:58 PM
Didn't you ask for "Who is logged on" \\note-nursery?
If so, nbtstat will get you nowhere...
evilghost
08-22-07, 04:00 PM
Didn't you ask for "Who is logged on" \\note-nursery?
If so, nbtstat will get you nowhere...

Of course it will, if it's registered with WINS the <03> value will indicate the logged in user.

http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/prork/pref_tts_pjtk.mspx

I've done it all the time.
zoomy942
08-22-07, 04:07 PM
Means it hasn't registered with WINS, just do this:

tasklist /S note-nursery /FI "USERNAME ne NT AUTHORITY\SYSTEM" /V

so i ran it, what am i looking for?
lduguay
08-22-07, 04:09 PM
OK, but, this is a lot easier (and does not require a WINS server)
http://www.microsoft.com/technet/sysinternals/Networking/PsTools.mspx
evilghost
08-22-07, 04:10 PM
so i ran it, what am i looking for?

The name of the logged in user, duh... Find a process running as the logged in user, like explorer.exe, to the left of the process name will be the username that is running that process.

No one may be logged in at the moment...
zoomy942
08-22-07, 04:14 PM
raise your hand if you want to hear a funny story...

so, i'm looking at the printout, and i find explorer.exe, and imagine my suprise when it shows me as the user. okay, i thinking, what the hell am i missing.

well, i have a tablet pc, but im running all of these tests on a different pc in the office...so, i check the pc name of the pc i am on, and bam...the mystery note-nursery pc is the one i am temporarliy logged into.

ugh. i am having a rough day:(
evilghost
08-22-07, 05:11 PM
At least you learned some cool tools like tasklist (if you didn't already know about it).