Is it possible to query a list of IP address(es) (or machine name(s)) that are currently logged into by a specific domain user?

Question

Is it possible to query a list of IP addresses (or machine names) of domain computers that a domain user is currently logged into?

The question "Getting logged on user’s name with or without domain in Windows" comes close, only I want to find the opposite.

I ask about the possibility due to my lack of knowledge concerning the internals of Active Directory. My gut feeling is that Active Directory only knows when (and possibly where) a domain user was last authenticated, and doesn't track current sessions or log-offs.

Any language that provides this solution will be an acceptable answer, but a .NET solution is preferred. More importantly, I'd like to know if this is even possible.

Answer 1

I don't believe that there is a one place inwhich this information can be obtained. You can find out the last time a user logged on and what DC authenticated from AD, but the problem is that when you login the first DC to respond is the server which authenticates with. that DC then logs this info to its eventlog, which resides on each host and not in a central system. You can see more about this from these to links: http://support.microsoft.com/kb/175062 and http://www.tartoos.com/HomePage/Rtable/ComputerSchool/Networking/Net41.htm SO that being said I guess you could get the last login from the lastLogonTimestamp AD property from the user account and then query the eventlog from all of the DC's in the domain to find out which DC it was that authenticated them and from what system. BUt all of this will only tell the last lgged on system....not all of teh systems that they could be logged into. Again you could compare these results to the logoff times which can be pulled from the DC eventlogs...but really this seems to be a major overkill endevor, and that you would have better luck writing a logon/logoff script which had these events logged to a central reporting system which you could use for future use.

Here is another alternative, you can query your WINS server to poll the logon information that it has for a user, which should return back the system inwhich it believes they logged into, see this post for how to do this:

http://www.visualbasicscript.com/m_56230/tm.htm

basically the command is: "NETSH WINS SERVER \\WinsServerName SHOW NAME UserName 03"

if you are using some sort of asset/system management software such as Desktop Authority, Altiris, etc. then you may have more luck exploring where the desktop agents log this information because they usually log this information also into some SQL table(s).