0

I am an administrator on a server that accepts RDP connections. When the client connects I know the client's computer name. Using netstat I can determine which connections have been established for RDP.

The ping command and variants only work if I ping by IP address; however, the command will not return a hostname. If I ping by hostname the command will always fail. The nslookup command always fails on both the hostname and the IP address. The nbstat command is not available on the machine.

Question
If I have both he hostname and the IP address how do I match them to each other?

Command line tools, programming solutions in C# or a combination of both are all viable options.

6
  • Are all of these PCs connecting to your remote desktop server on a LAN? Or are they public computers?
    – Wesley
    Dec 18, 2015 at 21:49
  • All the computers are connected via LAN. Dec 18, 2015 at 21:53
  • What is the authoritative DNS server on the LAN?
    – Wesley
    Dec 18, 2015 at 21:53
  • That would be a domain controller. However, the RDP sever and the domain controller are not the same. Dec 18, 2015 at 21:54
  • 3
    The question to ask is, why isn't your DNS working? Dec 18, 2015 at 22:06

2 Answers 2

1

Identify the DNS server being used by nslookup. If you or your company own / operate the DNS server you can add the host names and IP addresses required.

If you are not in control of DNS, the best solution would be to setup your own local DNS server and add each host.

A quick but dirty solution would be to add each host to the servers hosts file.

Checking hosts file / common windows DNS issues: relevant technet link

1
  • As stated before, the information from nslookup and other tools are being redacted for security purposes. However, for auditing purposes I need to generate an accurate list of hostnames and IP addresss. Is there anyway to match them up hostnames with IP addresses if I have both? I even have the port numbers that computers are connected to. Dec 21, 2015 at 14:17
0

The simple answer is that all of the standard tools you'd use to perform this are broken. You should be able to do the following steps.

First, open up nslookup.

C:\Users\wesley>nslookup
Default Server:  some.server.tld
Address:  1.1.1.1

Second, make sure you're looking to the Active Directory domain controller that's authoritative for your domain:

> server [server hostname or IP address here]
Default Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Third, query the hostname of the PCs you want to know more about:

> hostname.tld
Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Fourth, get a response back:

Non-authoritative answer:
Name:    hostname.tld
Address:  3.3.3.3

Fifth, if there is a reverse lookup zone, and there often is in an Active directory domain, you can use nslookup with an IP address:

C:\Users\wesley>nslookup 3.3.3.3
Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Name:    hostname.tld
Address:  3.3.3.3

If none of that works, then there are much deeper problems that need to be researched and fixed.

2
  • I've done your solution and get a response similar to *** domain-controller.domain.local can't find hostname: Non-existent domain. I have confirmed that we are connected to the correct domain controller. I am attempting to create an accurate audit of computer systems using RDP services. I'm attempting to automate it so that the audit is always accurate, but I believe my company has turned off some functionality for security purposes OR I'm having trouble because I am on a different domain that has a trust relationship with the domain I am trying to poll. Dec 22, 2015 at 15:07
  • @DodziDzakuma They may have disabled automatic DNS registration for computers that get DHCP leases from the Domain Controllers. Or perhaps computers don't get DHCP from the Domain Controllers at all. Something has been done that is very non-standard and it's causing the problems you're seeing. Looks like you might not be able to solve this until someone fixes the problem.
    – Wesley
    Dec 22, 2015 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .