1

How can I find user name(of the local machine) of the last logged on user on a remote system. Is there any command or script we can use? I am able to capture IP address of the local machine of the user but not the username. Please suggest.

5
  • The "local machine" does not have a "user name". Do you want the name of the user account that last logged in? Apr 4, 2012 at 11:07
  • It is not very clear which system you control - the local or the remote? It seems that you control what you call "remote system", and you call "local" what is local for the user, is that true? If so, it should be vice-versa. If not, I didn't understand.
    – lupincho
    Apr 4, 2012 at 12:45
  • Hi Daniel and Lupincho, What I meant by local machine is the machine from which the user initiated the remote desktop connection, I want to capture users account details(username/userid) on that machine. I am able to capture IP address of the machine from which users have logged in and the id used to log in to the remote machine, but what I want is users account info on the system from which he initiate remote desktop connection.
    – Megha
    Apr 19, 2012 at 7:30
  • @Megha: Then you are asking for data that only resides on the connecting party's computer. You can only get this data if the person gives consent, which concerns the Ident protocol mentions among the answers. If not, getting this information, since it is not needed to log in remotely and thus not given by their clients, is probably even illegal if taken to the extreme (breaking in to another computer to gain information). Apr 19, 2012 at 8:19
  • What OS? Linux/Mac/Windows?
    – brndr
    Sep 3, 2015 at 11:50

2 Answers 2

1

Run "quser" from Cmd. If you want to look into JSMITHPC, run "quser /server:JSMITHPC". I just tested from Windows 10 as a domain admin.

0

Username is an operating system-specific concept, not a network-specific concept. The IP tells you what machine but you'd have do some in-depth analysis to glean a username from captured traffic, and it's possible you won't be able to. There are likely many grey-hat and black-hat tools that do (Cain/Abel, something like that?)

One simple way in Windows is to log on to this system as Administrator (use Sysinternal's psexec if you know an admin login, and want to do it without actually being at the machine or making it look like you are logging in), go to C:\Users, and sort by last modified date. The last logged in user should have the most recently modified files. This would probably work for Linux as well.

1
  • 1
    The "last modified date" trick in Windows 7/8/10 is not reliable, particularly when people stay logged in for long periods, or the Switch User function is used. I used to think so also, but the specific datum "Last modified date" on the C:\Users\JSmith folder does not always change when JSmith logs in. Dec 27, 2016 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .