Locate a User

I often need to quickly determine which machine a user is logged on to. Because I prefer the command line, I use the Microsoft Windows NT Server 4.0 Resource Kit's Winscl utility.

Winscl lets you specify a WINS server and perform a query against that server. You can query a username to determine which computer the user is logged on to. Winscl requires that you're using WINS for internal name resolution. To query a username, go to a command prompt and enter

C:>winscl T

You'll see the following output:

Address of Nameserver to contact--

Enter the WINS server's IP address in X.X.X.X format. Winscl will output the menu. To override the menu display, enter

Command -- nome

Next, enter the following query string:

Command -- qn  1 03 0

where qn is the command to query the database, username is the NT username you want to search for, the value 1 means to include the 16th bit (i.e., the data type of the record you're looking for), the value 03 is the hexadecimal value of the data type you're searching for, and the value 0 makes the search non-scope sensitive.

Winscl will then output the name of the machine the user is logged on to. The last field in the output contains the IP address of the host that the user is logged on to. Keep in mind that because WINS records can be as much as an hour out of date, the information might not be current. To exit Winscl, enter

Command -- EX

—Sandor Welfing
[email protected]