Re: Extracting the name of a logged in user on a remote w2k workstation

[benn]

The NT Admin section of Code Catacombs has a bunch of scripts (mainly contributed by idnopheq ) which not only grab the logged in users, but shows login times etc. as well. Not being an NT person, I couldn't tell you exactly how useful this could be, but it seems to me that system accounts would be likely to show a login time of "last reboot" (or soon after), whilst 'real' users would log in at some time after this.

In addition, there's lastlogin for NT/2K, which shows "the last logon date for each user in the local host's user database." Some combination of these would appear to allow you to deduce the currently logged-in user.

May it not also be possible to simply enumerate system accounts and remove them from your list?

HTH, Ben.

[Zenistar]

Thanks for the reply Ben, I have browsed through the scripts you mention and I have gained a few pointers.

The workaround im trying at the moment grabs a hash of all accounts logged into the pc and then grabs a list of all services with specific accounts that are not local system so that I can elimitate some accounts from the hash.

I was hoping that somone would have a 'nice' way around this. Perfect solution would be to grab %USERNAME% from the local enviroment variables, but this doens't seem possible.

Thanks again for your imput.

[Kanji]

Does my $username - $ENV{'USERNAME'}; not work for you? It should if %USERNAME% is an environment variable.

Update: D'oh! Managed to skip the 'remote' part of the question entirely...

    --k.

[Zenistar]

Yes that works to grab the USERNAME environment variable from the local machine but what about a remote pc?

It may be me just being thick and not be able to work something out (must get more sleep), sorry in advance if this is the case.