[Dshield] Windows 2000 - Who's logged in?

Ed Truitt ed.truitt at etee2k.net
Thu Nov 21 02:02:26 GMT 2002

If you are on a Windows box, you can use the "nbtstat -A <IP address of
target>" and look for  <0> UNIQUE.  There may be more than one, the machine
name likely will be one entry, the other(s) more than likely will be the
name(s) of the logged-in user(s).

If you are *nix, you may be able to find something out from the Samba client
programs - but I don't know enough about them to speak with authority.

Ed Truitt
PGP fingerprint:  5368 D25E 468C A250 9833  CCD6 DBAE 9C25 02F9 0AB9

"Note to spammers:  my 'delete' key is connected to YOUR ISP.
 Also, if you send me UCE, I reserve the right to post your spew
on my Web site, with the appropriate color commentary, so that
others may have a good laugh at your expense."

----- Original Message -----
From: "Wayne Beckham" <wbeckham at yahoo.com>
To: <list at dshield.org>
Sent: Wednesday, November 20, 2002 11:41 AM
Subject: [Dshield] Windows 2000 - Who's logged in?

> Is there anyway to determine who's logged in at a particular IP address
> in Win2K?  We have web-content monitors that identify a particular IP
> address, but not the user.
> I understand, of course, that it may not *actually* be the user the
> account is assigned to, but one thing at a time.
> - WB
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:

More information about the list mailing list