How can I find user name(of the local machine) of the last logged on user on a remote system. Is there any command or script we can use? I am able to capture IP address of the local machine of the user but not the username. Please suggest.
After the user has logged out, or if you don't know all four pieces of information listed below, there is no way to find out the username.
While the connection is active, and if you also know both local and remote TCP addresses and ports, and if the user has an Ident server running (common with IRC users, but almost nobody else), then you could connect back to the Ident server on that user's computer, and request the information about a particular connection. For example:
← 3584,80 → 3584,80:USERID:WIN32,UTF-8:grawity
Username is an operating system-specific concept, not a network-specific concept. The IP tells you what machine but you'd have do some in-depth analysis to glean a username from captured traffic, and it's possible you won't be able to. There are likely many grey-hat and black-hat tools that do (Cain/Abel, something like that?)
One simple way in Windows is to log on to this system as Administrator (use Sysinternal's
protected by JakeGould Oct 8 at 0:25
Thank you for your interest in this question.
Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?