I'm not a programmer, but I know a little batch programming:
Someone is connecting to my network with a PC that is running an app which is causing my Backup Exec Exchange job to fail. The network is a domain with two servers (192.168.0.3 & 0.7). This is an effort to track them down and eliminate that issue. I've tracked the issue to IP 192.168.0.103 but it appeared to be removed (like a laptop) or shut off. I support this site remotely so I can't go there quickly and hunt it down. This PC may also be using DHCP which makes the situation harder to track.
I wrote a quick batch file that runs on a Windows 2003 server to determine the workstation IP's currently connected to the network. I really need a list of all IP's (and PC names if possible) to determine when a specific IP is connected to the network. I'm not sure if it's using DHCP so that is why I'm also looking for the PC name.
I have three questions:
1. Will the Net Use command return all IP's currretly used on notes in the network?
2. How can I get the PC name included in the file at the same time?
3. Some PC's have been handed down from person to person and I don't have a good cross reference of PC name to user. Is there a way to capture the user's login name also?
Here is the initial batch file I created I'm running hourly through the Windows Task scheduler.
REM
For /f "tokens=1,2 delims=: " %%i in ('time /t') do set hr=%%i_%%j
For /f "tokens=2,3,4 delims=/- " %%i in ('date /t') do set mmddyy=%%i_%%j_%%k
FOR /f "tokens=2,3,4 delims=/- " %%i in ('date /t') do set ArchDate=%%i-%%j-%%k
REM
type daily_%ArchDate% >> c:\Log-test.txt
net use >> c:\Log-test.txt
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
My backup runs at 7 PM, so I'm assuming it's of of the remote empoyees that bring their laptop in and sometines leave it overnight. There must be someting running on it that interfere's with my Exchange backup. I need to track it down, identify the user and eliminate the interference.
I doubt it is an intruder but anything is possible.
On the DC, Go to Administative Tools...Domain Controller Security Policy.
In there, Navigate through Local Policies...Audit Policy. We use "Account Logon Events", "Logon Events", and "Object Access". This should cover those that may not be explicitly logging on also. For all three, Success and Failure should be audited.
If you use Group Policy, you'll have to make the settings changes there for the policy applied to your Domain Controllers, in the Computer Configuration section.
There shouldn't be an impact to your network with this change; the only other thing I would recommend doing is to open the Event Viewer, right-click the Security Event Log...Properties, and kick the "Maximum Event Log Size" up. Ours is 131072KB (128MB), your mileage may vary based on available disk space. Also make sure to "Overwrite Events As Needed" in those Property pages. Looking at my config as a reference, I actually need to increase my log size. We're 500ish computers though, so if you're a smaller environment, that number may work for you.
Business Accounts
Answer for Membership
by: LingerLongerPosted on 2009-08-15 at 08:48:46ID: 25105809
AngryIP will let you scan a network, and you can enable the option in it to also resolve hostname at the time of scan. It can't be scheduled, but you can run it during the expected time they are on the network, and you'll have the results pulled into it's console - http://www.angryziber.com/
If this is an Active Directory environment, is this rogue user connecting as a domain user? If so, you should turn up Auditing on the Domain Controllers, which will capture logon information in the Security Event Logs, which will include logon name and hostname. From there, you could even consider disabling that logon account, and waiting for the person to come forward to get back on the network... :)