Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I find user name(of the local machine) of the last logged on user on a remote system. Is there any command or script we can use? I am able to capture IP address of the local machine of the user but not the username. Please suggest.

share|improve this question
The "local machine" does not have a "user name". Do you want the name of the user account that last logged in? – Daniel Andersson Apr 4 '12 at 11:07
It is not very clear which system you control - the local or the remote? It seems that you control what you call "remote system", and you call "local" what is local for the user, is that true? If so, it should be vice-versa. If not, I didn't understand. – lupincho Apr 4 '12 at 12:45
Hi Daniel and Lupincho, What I meant by local machine is the machine from which the user initiated the remote desktop connection, I want to capture users account details(username/userid) on that machine. I am able to capture IP address of the machine from which users have logged in and the id used to log in to the remote machine, but what I want is users account info on the system from which he initiate remote desktop connection. – Megha Apr 19 '12 at 7:30
@Megha: Then you are asking for data that only resides on the connecting party's computer. You can only get this data if the person gives consent, which concerns the Ident protocol mentions among the answers. If not, getting this information, since it is not needed to log in remotely and thus not given by their clients, is probably even illegal if taken to the extreme (breaking in to another computer to gain information). – Daniel Andersson Apr 19 '12 at 8:19
What OS? Linux/Mac/Windows? – brndr Sep 3 '15 at 11:50

After the user has logged out, or if you don't know all four pieces of information listed below, there is no way to find out the username.

While the connection is active, and if you also know both local and remote TCP addresses and ports, and if the user has an Ident server running (common with IRC users, but almost nobody else), then you could connect back to the Ident server on that user's computer, and request the information about a particular connection. For example:

← 3584,80
→ 3584,80:USERID:WIN32,UTF-8:grawity
share|improve this answer
thanks for your reply. It could be both while the connection is active or even after the connection is disconnected to know the last logged user. I am able to capture both local and remote IP. I am not sure if user has an ident server but probably not. so is thr any way using scripting and playing around registry files?? – user126536 Apr 4 '12 at 12:11

Username is an operating system-specific concept, not a network-specific concept. The IP tells you what machine but you'd have do some in-depth analysis to glean a username from captured traffic, and it's possible you won't be able to. There are likely many grey-hat and black-hat tools that do (Cain/Abel, something like that?)

One simple way in Windows is to log on to this system as Administrator (use Sysinternal's psexec if you know an admin login, and want to do it without actually being at the machine or making it look like you are logging in), go to C:\Users, and sort by last modified date. The last logged in user should have the most recently modified files. This would probably work for Linux as well.

share|improve this answer

protected by JakeGould Oct 8 '15 at 0:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.