Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I find user name(of the local machine) of the last logged on user on a remote system. Is there any command or script we can use? I am able to capture IP address of the local machine of the user but not the username. Please suggest.

share|improve this question
    
The "local machine" does not have a "user name". Do you want the name of the user account that last logged in? –  Daniel Andersson Apr 4 '12 at 11:07
    
It is not very clear which system you control - the local or the remote? It seems that you control what you call "remote system", and you call "local" what is local for the user, is that true? If so, it should be vice-versa. If not, I didn't understand. –  lupincho Apr 4 '12 at 12:45
    
Hi Daniel and Lupincho, What I meant by local machine is the machine from which the user initiated the remote desktop connection, I want to capture users account details(username/userid) on that machine. I am able to capture IP address of the machine from which users have logged in and the id used to log in to the remote machine, but what I want is users account info on the system from which he initiate remote desktop connection. –  Megha Apr 19 '12 at 7:30
    
@Megha: Then you are asking for data that only resides on the connecting party's computer. You can only get this data if the person gives consent, which concerns the Ident protocol mentions among the answers. If not, getting this information, since it is not needed to log in remotely and thus not given by their clients, is probably even illegal if taken to the extreme (breaking in to another computer to gain information). –  Daniel Andersson Apr 19 '12 at 8:19

3 Answers 3

After the user has logged out, or if you don't know all four pieces of information listed below, there is no way to find out the username.


While the connection is active, and if you also know both local and remote TCP addresses and ports, and if the user has an Ident server running (common with IRC users, but almost nobody else), then you could connect back to the Ident server on that user's computer, and request the information about a particular connection. For example:

← 3584,80
→ 3584,80:USERID:WIN32,UTF-8:grawity
share|improve this answer
    
thanks for your reply. It could be both while the connection is active or even after the connection is disconnected to know the last logged user. I am able to capture both local and remote IP. I am not sure if user has an ident server but probably not. so is thr any way using scripting and playing around registry files?? –  user126536 Apr 4 '12 at 12:11

You should be able to find this in the Events log, under security. There will be logon, logoff events which detail the username

share|improve this answer
    
@ Digital Biscuits:- I tried that but in case a person is logged in using a generic ID i am able to fetch that whereas what I am looking for is username/userid of the user on the machine from which he initiated the remote desktop connection. –  Megha Apr 19 '12 at 7:17
2  
Oh, I get what you're looking for now. I don't think that information is transmitted in the remote desktop protocol though. The only thing I could think of is maybe remote connect to the users' event log and check which user was logged on when the connection was initiated. Of course the computer would need to be on while you do this –  OAC Designs Apr 19 '12 at 10:51

Username is an operating system-specific concept, not a network-specific concept. The IP tells you what machine but you'd have do some in-depth analysis to glean a username from captured traffic, and it's possible you won't be able to. There are likely many grey-hat and black-hat tools that do (Cain/Abel, something like that?)

One simple way in Windows is to log on to this system as Administrator (use Sysinternal's psexec if you know an admin login, and want to do it without actually being at the machine or making it look like you are logging in), go to C:\Users, and sort by last modified date. The last logged in user should have the most recently modified files. This would probably work for Linux as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.