How to Find User Name and IP address of users Logged on a Remote System

Question

How can I find user name(of the local machine) of the last logged on user on a remote system. Is there any command or script we can use? I am able to capture IP address of the local machine of the user but not the username. Please suggest.

Solution

Run "quser" from Cmd. If you want to look into JSMITHPC, run "quser /server:JSMITHPC". I just tested from Windows 10 as a domain admin.

Comments

[Daniel Andersson]

The "local machine" does not have a "user name". Do you want the name of the user account that last logged in?

[lupincho]

It is not very clear which system you control - the local or the remote? It seems that you control what you call "remote system", and you call "local" what is local for the user, is that true? If so, it should be vice-versa. If not, I didn't understand.

[Megha]

Hi Daniel and Lupincho, What I meant by local machine is the machine from which the user initiated the remote desktop connection, I want to capture users account details(username/userid) on that machine. I am able to capture IP address of the machine from which users have logged in and the id used to log in to the remote machine, but what I want is users account info on the system from which he initiate remote desktop connection.

[Daniel Andersson]

@Megha: Then you are asking for data that only resides on the connecting party's computer. You can only get this data if the person gives consent, which concerns the Ident protocol mentions among the answers. If not, getting this information, since it is not needed to log in remotely and thus not given by their clients, is probably even illegal if taken to the extreme (breaking in to another computer to gain information).

[brndr]

What OS? Linux/Mac/Windows?

[Christopher Hostage]

The "last modified date" trick in Windows 7/8/10 is not reliable, particularly when people stay logged in for long periods, or the Switch User function is used. I used to think so also, but the specific datum "Last modified date" on the C:\Users\JSmith folder does not always change when JSmith logs in.