Is there a way to query Active Directory for the user logged onto a give IP Address?: Active Directory

by: mkline71Posted on 2009-08-23 at 01:39:48ID: 25161817

Not that I know of; there is no IP address attribute that you can query using an LDAP query.

Maybe use a logon script to record the IP address and put it in a text file, but that wouldn't be used for an LDAP query either.

Thanks

Mike

by: stefanxPosted on 2009-08-23 at 01:43:05ID: 25161825

How about if I query the reverse DNS to give me the PC name - is there any connection between the PC name and the user that is logged onto it?

by: bluntTonyPosted on 2009-08-23 at 01:44:51ID: 25161832

Unfortunately, AD doesn't hold this info.

The nearest you could get would be to interrogate each and every DC's security event logs and look for the last succesful logon attempt for the user, then parse the source workstation IP address from the data in that event log.

Or you could use WMI to connect to a machine by IP address and get the logged on user. A vbscript example i here: http://blogs.msdn.com/alejacma/archive/2008/03/04/how-to-get-the-logged-on-user-with-wmi-vbscript.aspx

You may be able to use this to figure out how to interrogate WMI with PERL. Unfortunately don't know much in the way of PERL so couldn't comment. May be worth adding the PERL zone to this question.

But with regards to using LDAP - this isn't possible as the information doesn't exist in AD.

Tony

by: bluntTonyPosted on 2009-08-23 at 01:48:15ID: 25161847

Sorry Mike - must refresh!

stefanx - no, there is no dynamic data stored in AD that tells you what user is logged on where. Not in AD. DC's record events when users log on to machines, so you can query their event logs, but this wouldn't be LDAP, you would need to use WMI.

A more direct approach would be to interrogate the actual machine in question and fnd out the logged on user.

by: Chris-DentPosted on 2009-08-23 at 01:59:39ID: 25161886

Scriptomatic can write Perl code if you do end up going down the WMI route :)

http://www.microsoft.com/downloads/details.aspx?FamilyID=09dfc342-648b-4119-b7eb-783b0f7d1178&displaylang=en

If there's a need to track this kind of thing you may consider setting up a logon / logoff script to capture it, interrogating files created by that is far quicker and easier than WMI. There are quite a few variations on that, personally I use a minor variation of this one:

http://msmvps.com/blogs/kwsupport/archive/2005/02/24/36942.aspx

If it must be server-side and nothing on the client this article describes how events are logged in the Security log:

http://technet.microsoft.com/en-us/library/bb742436.aspx

That can be painful if you have anything more than a couple of DCs.

Chris

by: bluntTonyPosted on 2009-08-23 at 04:50:55ID: 25162267

As Chris stated, a good way would be to create a logon/off script to track this.

Another option to a text file might be to keep this info in AD, then you could query this data in your PERL script via LDAP.

For example, employeeID and employeeType are typically not used, and are not shown in ADUC. If this is the case for you, you could have a login script similar to the below. This writes a space-delimited string of the IP addresses of the machine the user is logged on to to 'employeeID'. Then in your PERL script you would use an LDAP filter similar to this:

(&(objectClass=user)(objectCategory=person)(employeeID=*192.168.0.1*))

(Obviously in your script you would build this filter as a string and insert the required IP address between the wildcards)

By creating a similar logoff script which clears employeeID, you can track who is currently logged on to what machine just by performing this query.

For this you would also have to delegate 'SELF' the right to read/write the attribute in question, which can be done easily with the delegation of control wizard in ADUC.

Tony

Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set objIP = CreateObject("Scripting.Dictionary")
Set colAdapters = objWMI.ExecQuery("SELECT * FROM Win32_NetworkAdapterConfiguration Where IPEnabled=True")
 
'Get a space delimited string of the IP addresses on the local machine
For Each adapter In colAdapters
 	For i = LBound(adapter.IPAddress) To UBound(adapter.IPAddress)
 		If Not adapter.IPAddress(i) = "0.0.0.0" And Not objIP.Exists(adapter.IPAddress(i)) Then objIP.Add adapter.IPAddress(i), adapter.IPAddress(i)
 	Next
Next
 
For Each key In objIP.Keys
	strIPs = strIPs & objIP(key) & " "
Next 
 
'Write this string to employeeID against the current user
Set objAD = CreateObject("ADSystemInfo")
Set objUser = GetObject("LDAP://" & Replace(objAD.UserName,"/","\/"))
objUser.employeeID = strIPs
objUser.SetInfo
 
Set objUser = Nothing
Set objAD = Nothing
Set objWMI = Nothing
Set objIP = Nothing
Set colAdapters = Nothing

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:

Select all Open in new window

by: snusgubbenPosted on 2009-08-23 at 08:10:49ID: 25162903

We got Cisco works at work that have a utility where you type the username and his IP pops up or visa verca.

I have no clue what the cost is.

http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps2425/white_paper_c11-469745.html

SG

by: stefanxPosted on 2009-08-23 at 11:50:35ID: 31619333

Thanks to everyone that took the time to answer this question. Even though it would have been great if someone said "Sure, here is how you do it", if it's not in AD then it's not in AD ;)

Question

Is there a way to query Active Directory for the user logged onto a give IP Address?

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Active Directory

Active Directory

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press