In our small company network sometimes an unknown windows workgroup appears.

I'm know the name of this workgroup but have no further information about this. I do not have admin rights in the network, but have admin rights on my machine.

What's a good way to find out more about this group? For example the IP addresses of connected computers and information in which segment of the network the workgroup appeared?

I can see this workgroup from a windows 7 pro installation, but not connect to it.


To see what systems are in the workgroup, from a command prompt you could issue the command net view /domain:workgroup where workgroup is the name of the workgroup. It doesn't matter that it is a workgroup rather than a domain, the command should still show the members of the workgroup. If you want to know the IP addresses associated with each name you see, you could use a tool such as Bopup Scanner, which is free, to scan the local area network (LAN). It will show names and IP addresses for systems it finds as well as MAC addresses.

The MAC address can identify the manufacturer of the network interface controller (NIC) in the system, which sometimes can provide a clue to help identify the device. Once you have the MAC address, you can look up the manufacturer for the NIC at a site such as Vendor/Ethernet/Bluetooth MAC Address Lookup and Search or MAC Address / OUI Lookup. The first 6 characters of the MAC address can identify the manufacturer, so if I see a MAC address that begins with f8:bc:12, I can conclude that the system is a Dell system.

Without access to network switches in the network, though, you may have difficulty pinpointing an exact location for the device on your network if the network has many switches or wireless access points, if the systems are using wireless connectivity. The MAC address may or may not help you in determining whether the system is connecting by a wired or wireless connection. If the manufacturer only makes wired or wireless interfaces, it may help.

To gather further information on the systems, you could scan them with a tool such as Nmap, which can identify which network services are running on scanned systems and guess the operating system in use on a scanned system by the way that system responds to network traffic. It may not be able to precisely identify the operating system, e.g., it may show several possibilities for a version of Microsoft Windows, which you could infer from the fact that a system is telling other systems on the network that it is part of a workgroup. For instance, it might report "Running: Microsoft Windows 2008|7|Phone|Vista". But sometimes that can provide valuable clues about a system. Nmap has both a command line interface an a graphical user interface (GUI) through Zenmap. Nmap will also display the MAC address for the scanned system and tell you the manufacturer of the NIC.

Note: if your network administrator has deployed an intrusion detection system (IDS) on the inside of the local area network, your Nmap scan may trigger alarms on the IDS.

  • thanks for the detailed instructions. I will test this the next time this unknown group appears again. – 576i Aug 2 '15 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.