Skip navigation

JSI Tip 0508 - What workstation did UserName logon from?

If you are auditing logons (see tip 264), look in the security event log. If your protocol is TCP/IP, you can use the following method:

1. Open a command prompt (CMD.EXE).
2. Type: net send "UserName" "** auto-locator - do NOT respond. **"
3. type: nbtstat -c

 Name   Type   Host Address   Life \[sec\] 
 JENNIFER   <03> UNIQUE   ... 
 JSI0013   <03> UNIQUE   ... 

4. Locate the Type <03> record for UserName and record the Host Address.
5. Locate the other Type <03> record for that Host Address.

You can partially automate this with LOCATENM.BAT

@echo off
echo Usage: LOCATENM "UserName"
net send "%1" "** auto-locator - do NOT respond. **"
nbtstat -c>%TEMP%\LOCATENM.LOG
findstr /b /i /c:"%1" %TEMP%\LOCATENM.LOG
echo Type:

where LOCATEIP.BAT contains:

@echo off
findstr "%1" %TEMP%\LOCATEIP.LOG

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.