Finding PC w/ IP

[Turbo91Bird]

On my network, I am trying to find a PC. I have the IP, type of OS, Computer Name, but how do I find out what e-mail address that IP uses and any information that would narrow it down to a username? Any help would be appreciated. Thanks

[doctorgonzo]

Do you control the network? Does your network have DHCP, or are the IP addresses statically assigned? Does each computer have a separate hostname? I would first try looking at the DHCP table if you have access to it. Finding an e-mail address that goes with the IP address is going to be harder; you might be able to match up the IP address to an e-mail address by searching the headers of e-mails from that address, but if you use any kind of central mail server probably not.

What do you need this information for?

[Statica]

Originally Posted by Turbo91Bird On my network, I am trying to find a PC. I have the IP, type of OS, Computer Name, but how do I find out what e-mail address that IP uses and any information that would narrow it down to a username? Any help would be appreciated. Thanks

Your question is vague. So you have the IP, OS and computer name .. what username and email address are you trying to get out? For example, I could be on a network and use a hotmail address - it isn't related to anything else about my IP, OS or any such details.

[Turbo91Bird]

That person on the network has been browsing the internet A LOT (ebay, downloading music, etc...) and all I have is an IP and computer name but I want to find out where that machine is actually located in the building and if I had a username they use to log into the machine or an e-mail address, then I could figure it out.

I have control of the network, it does have DHCP.

[doctorgonzo]

What kind of network do you have? Windows Server? Peer-to-peer? Do you have a server that is handing out IP addresses, or are they coming from a router? Also, is the IP address that is accessing the internet static? Does your DHCP setup have a table of IP addresses and the corresponding MAC addresses to hand out the same IP address to the same host?

From the sounds of it, it's going to be difficult to track down the name without actually going to each computer. You may want to reconsider how you name your computers. Either name the computers after the user who uses them, or if that doesn't work, then name the computer after its physical location. As you've found out, when all you have is an IP address of 192.168.0.151 and a computer name of "XHVROSZ", that's not helpful.

You could also just block those sites and ports and see who complains. I'd definitely block the P2P filesharing ports, there is no legitimate use for that in a business environment.

[Turbo91Bird]

Its a windows server network. The IPs are not static. I think from now on in the comments section I am just gonna put the name of the person who owns the machine. I already blocked the P2P port as well. I guess I just didn't think the "comment" of descripition part was all that important at the time but I will run thru all the machines and change that so I don't run into this problem in the future.

[doctorgonzo]

I'm not all that sure that the "Computer Description" will be seen, but I'm not in a Windows server environment so I'm not sure. You could always create some kind of inventory tracking Excel spreadsheet that matches up whatever computer names you have to a user. Or, if you're a data junkie like me, you can do both.

[Turbo91Bird]

Originally Posted by doctorgonzo I'm not all that sure that the "Computer Description" will be seen, but I'm not in a Windows server environment so I'm not sure. You could always create some kind of inventory tracking Excel spreadsheet that matches up whatever computer names you have to a user. Or, if you're a data junkie like me, you can do both.

Yeah, at my old job we kept mac addy, ip, name, tag, hardware, os, etc.. on every machine in an excel sheet of inventory. Took forever to do but once it was done it was nice to have.
And with Windows Server, every computer on the network has a "Comments" section where you can write in whatever u want about that pc so you can organize things better on your network. I am gonna do that from now on with the name. I think my IP hunt won't be worth it until I do name change.

[glc]

Run a Belarc Advisor report on each machine locally, print them out, and put them in a looseleaf binder.

[Turbo91Bird]

That looks like a great product but it is for personal use only and not for corporate use. So if I wanted to use that at my workplace, I would have to buy a license.

[mairving]

Originally Posted by Turbo91Bird Yeah, at my old job we kept mac addy, ip, name, tag, hardware, os, etc.. on every machine in an excel sheet of inventory. Took forever to do but once it was done it was nice to have. And with Windows Server, every computer on the network has a "Comments" section where you can write in whatever u want about that pc so you can organize things better on your network. I am gonna do that from now on with the name. I think my IP hunt won't be worth it until I do name change.

You can't keep track of IP addresses if you are using DHCP. The comments section is mostly used for browsing the network in Network Neighborhood. The comments show up in parentheses.

You can also use an old DOS trick. Go out to the command prompt, an type in nbtstat -a (name of machine) or nbtstat -A (IP Address). This will give you all kinds of info, Netbios names, logged on user, MAC address and other stuff.

Plenty of other ways to obtain the information. You can connect to Administrative Tools/Computer Management, and view any sessions that are going on on that computer.

Another thing to do is to connect to that computer, provided you have admin access via the \\computername\c$ in the explorer address bar. This will show you the C drive on that machine. Go into Documents and Settings and see what users are listed provided you don't use roaming profiles. It would be pretty easy to see which profile has oodles of data in it as well.

[mairving]

I forgot that you can create a login script (.bat) that will log user and machine, IP address, time logged in, etc into a .txt file. It makes it a bit easier looking here than in the event viewer.

Still other utilities can pull this info out of your log files.

[Floppyman]

If you have the IP you should be able to find the MAC address of the machine somewhere in your DHCP setup. Once you have that, and if you are managed switches, you should be able to find what port the machine is on and trace the port to the corresponding location. HTH

[Turbo91Bird]

Cool, thanks guys.