Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How can I determine who is logged on to a remote Windows XP computer from Linux? I do not have administrator access on the domain or on the remote computer.

I can do it from a separate Windows computer using PsLoggedOn -L \\computer from PsTools

I've tried using nmblookup -A remotecomputer, but I only see entries for the computer and the domain, not a <03> entry for the user.

I've also tried running PsLoggedOn under wine; I get an error:

Connecting to Registry of \\computer.company.com...
fixme:reg:RegConnectRegistryW Connect to L"computer.company.com" is not supported.

I started looking into winexe, but it looks like I would need administrative rights on the remote computer to get it working.

share|improve this question
    
With your current answer, How can you determine which of the HKEY_USERS of the computer are currently logged on ? I tried on my network with an AD, but the net rpc registry command doesn't give me a correct output : Keyname = d__(+ Classname = Modtime = Thu, 12 Oct 4461634 12:03:12 CET This is all the output I have. –  Dolanor Sep 19 '12 at 8:36
    
I don't know enough about the net rpc registry command to speculate why it would give such garbage output... I recommend you start a new question about it. –  Justin Sep 19 '12 at 12:08
    
I've found the problem. Red Hat linux, with an old hidden in the forest samba net tool which doesn't work with our AD/network/windows. I tested on a VirtualBox with ubuntu 12.04, and the net rpc registry works just fine. Thank you ! –  Dolanor Sep 19 '12 at 13:54

3 Answers 3

up vote 4 down vote accepted

I found how to do this using Samba on the Linux computer.

I installed and configured Kerberos and Samba to access the domain. I modified /etc/samba/smb.conf, /etc/krb5.conf, and /etc/hosts. I then used some net commands from a script (net is a command-line interface to Samba):

net rpc registry enumerate 'HKEY_USERS' -S xpcomputer.ad.company.com -U 'username@AD.COMPANY.COM%password'

giving a list of the security identifiers for the users that are currently loaded in the registry:

Keyname   = .DEFAULT
Modtime   = Thu, 02 Dec 2010 14:31:14 EST

Keyname   = S-1-5-19
Modtime   = Thu, 02 Dec 2010 14:31:16 EST

Keyname   = S-1-5-19_Classes
Modtime   = Thu, 02 Dec 2010 14:31:16 EST

Keyname   = S-1-5-20
Modtime   = Thu, 02 Dec 2010 14:31:16 EST

Keyname   = S-1-5-20_Classes
Modtime   = Thu, 02 Dec 2010 14:31:16 EST

Keyname   = S-1-5-21-8915387-325552579-1798637320-4573
Modtime   = Fri, 03 Dec 2010 22:53:39 EST

Keyname   = S-1-5-21-8915387-325552579-1798637320-7772
Modtime   = Wed, 08 Dec 2010 07:51:26 EST

Keyname   = S-1-5-21-8915387-325552579-1798637320-7772_Classes
Modtime   = Wed, 08 Dec 2010 07:51:26 EST

Keyname   = S-1-5-18
Modtime   = Thu, 02 Dec 2010 14:31:14 EST

I then run the net ads sid command to lookup active directory entries based on the user SID. This might only work for domain users; I'm not sure if it works for users logged on using a local account. It seems that if there are multiple SIDs, the only one that works is the one that has a corresponding "_Classes" entry.

net ads sid 'S-1-5-21-8915387-325552579-1798637320-7772' -W COMPANY -U 'username@AD.COMPANY.COM%password'

This gives some errors, but still results in printing the user's entire Active Directory information. It is fairly slow, possibly due to the errors, so I might cache the SID-to-username mapping.

[2010/12/08 10:03:00,  0] libads/kerberos.c:882(create_local_private_krb5_conf_for_domain)
  create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/run/samba/smb_tmp_krb5.HpBqKJ. Errno Permission denied
[2010/12/08 10:03:02,  0] libads/kerberos.c:882(create_local_private_krb5_conf_for_domain)
  create_local_private_krb5_conf_for_domain: smb_mkstemp failed, for file /var/run/samba/smb_tmp_krb5.BCzT0T. Errno Permission denied
Got 1 replies

objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: [Lastname], [Firstname]
sn: [Lastname]
c: US
physicalDeliveryOfficeName: ...
telephoneNumber: ...
...(many more  fields)...
mailNickname: FLastname
...

The mailNickname field contains the user name (at least for the users I have tested so far).

share|improve this answer

I found this question while looking for a solution to the exact same problem. Staring with Justin's answer above I finally came up with this bit of Perl. $Comp is the name of the computer we wish to interrogate.

$Res = `/usr/bin/net rpc registry enumerate 'HKEY_USERS' -S $Comp -U 'user\@domain\%password' | /bin/grep _Classes`;
 # For this application we're only interested in one entry and don't care if there are more
$Res =~ /= (.+)_Classes/;
$Sid = $1;
$Res = `/usr/bin/net ads sid -W domain -I IP_address_of_DC -U 'user\@domain\%password' "$Sid"`;
$Res =~ /sAMAccountName: (.*)/;
$User = $1; # The user logon ID
$Res = `/usr/bin/net ads search "(sAMAccountName=$User)" -U 'user\@domain\%password'`;
$Res =~ /displayName: (.*)/;
# The user's display name, which is what we're after
$Name = $1;

If speed is an issue, as it was for Justin, check to ensure the realm and workgroup settings are correct in smb.conf.

share|improve this answer

Are you able to install software on the remote computer?

If so, you can install the Opsview agent, (nagios client) from here: http://www.opsview.com/downloads/opsview-agents that will allow you to query any of the MS performance counters.

I'm not sure if logged on users is available as a performance counter, but if it is, then this could work for you.

share|improve this answer
    
Unfortunately, I'm not able to install software on the remote computer. It is very tightly controlled since it is used to interface with some specialized equipment. –  Justin Oct 28 '10 at 14:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.