Discover what workstations a user us connected to in a Windows AD Environment?

Question

I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD environment. At this point in time all I know is the username.

How can I discover the workstation name the user is connected to from only knowing the username?

i) I could export the AD security log and look for the users logon event, as the logon event captures the workstation name.

ii) Scan through all the IP's in my network and write a script like the below to get the username currently logged into IP x

for /f %%a in (IP.txt) do WMIC /NODE:%%a computersystem GET name, username 

Thanks.

Answer 1

Find out which computers in Active Directory a user is logged into.

This will find the user if they're logged in using the console or remotely using terminal services by examining the explorer.exe processes on all active directory machines. This script requires the free Quest ActiveRoles Management Shell for Active Directory snap-in: Located http://www.quest.com/powershell/activeroles-server.aspx

find full article here

Add-PSSnapin Quest.ActiveRoles.ADManagement -ErrorAction SilentlyContinue
$ErrorActionPreference = "SilentlyContinue"

# Retrieve Username to search for, error checks to make sure the username
# is not blank and that it exists in Active Directory

Function Get-Username {
$Global:Username = Read-Host "Enter username you want to search for"
if ($Username -eq $null){
    Write-Host "Username cannot be blank, please re-enter username!!!!!"
    Get-Username}
$UserCheck = Get-QADUser -SamAccountName $Username
if ($UserCheck -eq $null){
    Write-Host "Invalid username, please verify this is the logon id for the account"
    Get-Username}
}

get-username

$computers = Get-QADComputer | where {$_.accountisdisabled -eq $false}
foreach ($comp in $computers)
    {
    $Computer = $comp.Name
    $ping = new-object System.Net.NetworkInformation.Ping
    $Reply = $null
    $Reply = $ping.send($Computer)
    if($Reply.status -like 'Success'){
        #Get explorer.exe processes
        $proc = gwmi win32_process -computer $Computer -Filter "Name = 'explorer.exe'"
        #Search collection of processes for username
        ForEach ($p in $proc) {
            $temp = ($p.GetOwner()).User
            if ($temp -eq $Username){
            write-host "$Username is logged on $Computer"
        }}}}

Joe commented there:

Joe0126 - Dec 12, 2011 Replace: $computers = Get-QADComputer | where {$_.accountisdisabled -eq $false} With: $computers = Get-QADComputer -OSname 'Server' | where {$_.accountisdisabled -eq $false}

Answer 2

one thing to note is that "logged on" can mean a number of things in Windows OS:

1. it could be the user has connected to an SMB share
2. the user could be running a scheduled job at that time, but not logged on to the actual console/desktop etc
3. the user could be running a software patch/update remotely
4. or indeed, they are logged in.

I'm not a Windows admin (so haven't seen all the admin tools) but in the past i have written scripts like yours, except I used the nbtstat.exe application across a range of IP Addresses.

bear in mind that virtualised OS (using Terminal Services) have additional cli tools, in particular the "query session" cmd, see Windows TechNet article