Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was wondering if it was possible to see a particular logged-in domain user's IP address(es). I've done it in eDirectory, and I'm fairly sure you can't do it in early versions of Windows Server, but I heard it was possible in Server 2008. Ideally I'd like an LDAP query.

share|improve this question

2 Answers 2

If you audit logins on domain controllers then you could dig the IP out of the Event Logs on the individual DCs. But it's not in AD.

share|improve this answer

After we migrated from eDirectory to AD we struggled with this one. Each DC individually tracks the last address a user logged in from, but it isn't a replicated value. To get it you'll have to query every DC to get the list. I don't remember the attribute off the top of my head, unfortunately, I'll have to look it up. It didn't turn out nearly as useful as NetworkAddress was in eDir. Edit: I was wrong, what I was thinking of was the 'last login time' attribute. The network address is NOT stored in AD.

Currently we've punted on this one and given up on LDAP. I wrote a powershell script that parses the Security logs for login/logout/lockout events and populates the values into a database. LastLogin is tracked as part of this. Unlike NetworkAddress, this also gives a login history for the user which is very handy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.