I have specific situation. I want to get MAC address from a remote computer, which is not in domain. I know the hostname and IP address of the remote computer. The IP Address of my computer is and the remote computer IP is

I've tried:

arp -a <remote IP Address>
No ARP entries found.

nbtstat -n <remote hostname>
Host not found.

getmac /s <remote IP Address>
ERROR: The RPC server is unavailable.

Is it possible to get the MAC address of the remote system from the command line, powershell or something else? Which conditions need to be set? Thank you.

  • ipconfig /all ? – SpacemanSpiff Jul 25 '12 at 12:45
  • Have you tried just arp -a with other parameter? – ott-- Jul 25 '12 at 13:01
  • ott, which parameter is also useful to get mac address? – culter Jul 27 '12 at 6:46
  • @culter Better late than never. I meant arp -a without other parameters. – ott-- Sep 17 '15 at 21:34

10 Answers 10


nmap will return the MAC address as well as just about anything else you'd like to know.

If you have admin access to the machine, powershell & wmi are both very useful in getting remote diagnostics. They both have extensive documentation at technet.microsoft.com

edit: this assumes a windows machine, which from the looks of it, this might not be.

  • 2
    He did tag the question with Windows and Powershell... – gWaldo Jul 25 '12 at 15:20
  • 1
    true, but based on the return values I'm not convinced the target is Windows. Could just be locked down, nmap -v -A would be helpful. – jhayes Jul 25 '12 at 15:28
  • 1
    The computers are windows based, but there is nmap for windows and it works fine. Nmap was the only tool that works in this situation. Thank you. – culter Jul 27 '12 at 6:54

MAC addresses are Ethernet things, not Internet things. A computer need not even have a MAC address. The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you. And you'd have no way to know it was giving you the correct information.

If the two of you are in the same Ethernet LAN, you can just ping the computer and then look in your ARP table. Otherwise, you would have to ask a computer in the same Etherent/Wifi LAN.

  • Please explain the downvote so I can improve the answer. – David Schwartz Jul 25 '12 at 12:48
  • 2
    Because there are at least a dozen ways to get the MAC address of a remote computer using tools like psexec, PowerShell with Get-WMIObject or Invoke-Command, wmic, etc. – MDMarra Jul 25 '12 at 12:49
  • 1
    @MDMarra: That's why I said "The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you." – David Schwartz Jul 25 '12 at 12:50
  • 3
    @gWaldo: I stand by both of them. There's a computer right behind me that has a fractional T1 connection and no other network interfaces. It has no MAC address but Internet connectivity. And please, tell me how you could tell if a remote computer was telling you a correct MAC address rather than a nonsense one. – David Schwartz Jul 25 '12 at 13:25
  • 3
    I agree that a MAC isn't a requirement for IP connectivity when you're not using Ethernet - this is absolutely correct, but saying that you can't trust what WMI returns as the MAC is a bit farfetched. If you're going to take an edge stance like that, you should defend it in detail and not just expect people to accept your minority view as truth. How is it possible to configure a Windows client so that a WMI query returns a value for the MAC address that's different than the one that the network stack uses for the same NIC? – MDMarra Jul 25 '12 at 14:02

You can get it from WMI, and any language that can read WMI will be able to access it. VBScript, JScript, Perl, Python, and Powershell can all be used to get to it.

Since you asked specifically Powershell, here's an example from http://www.neolisk.com/techblog/powershell-getmacaddressofanyremoteip:

param ( $Computer , $Credential )
#to make it work without parameters
if($Computer -eq $null) { $Computer = $env:COMPUTERNAME }
#program logic
$hostIp = [System.Net.Dns]::GetHostByName($Computer).AddressList[0].IpAddressToString
if($Credential) {
    $Credential = Get-Credential $Credential
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -Credential $Credential -ComputerName $Computer
} else {
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -ComputerName $Computer 
return ($wmi | where { $_.IpAddress -eq $hostIp }).MACAddress
  • 1
    I cant get it work. When I add name of computer into $computer, the output is nothing. – culter Jul 27 '12 at 6:52

yep. The easiest way should be just doing a ping and then check the ARP table

If you're more into actually getting stuff inventoried and reported I would suggest havoing a look at the free software from Spiceworks ( http://www.spiceworks.com ) to set upp constant monitoring and always havce your information easily available about your entire enivorenment.

I've used it for years and it works great on LAN.

It does have some issues with sending inventories ocf sofwtare to remote sites though, haven't really figured out why yet but apart from that, I highly recommend it .

  • Thanks to finland, my favorite country full of great metal bands;) I'll check that. – culter Jul 27 '12 at 6:57

If you know name of computer easies way will be:

$strComputer ="ComuterName"
$colItems = Get-WmiObject -Class "Win32_NetworkAdapterConfiguration" -ComputerName $strComputer -Filter "IpEnabled = TRUE"
ForEach ($objItem in $colItems)
    write-host "IP Address: " $objItem.IpAddress[0]  "Mac: " $objItem.MacAddress

More advanced script which can take any machine by IP or hostname:

$device = ""
if ( $device | ? { $_ -match "[0-9].[0-9].[0-9].[0-9]" } )
    echo "Searching MAC by IP"
    $ip = $device
    echo "Searching MAC by host"
    $ip = [System.Net.Dns]::GetHostByName($device).AddressList[0].IpAddressToString
    $ping = ( new-object System.Net.NetworkInformation.Ping ).Send($ip);

    $mac = arp -a $ip;

    ( $mac | ? { $_ -match $ip } ) -match "([0-9A-F]{2}([:-][0-9A-F]{2}){5})" | out-null;

    if ( $matches )
    } else 
      echo "MAC Not Found"

MAC is OSI Layer 2 - you won't get it directly when there is any Layer 3 hop in between - and for securtity reasons all protocols to query such data should not be allowed in anything beyond one's LAN...


While what is above is a bit over complicated, if you have no entries found after a ping then you need to enable routing and remote access in services, it probably is disabled. Then goto a command prompt and issue a arp -a to see your cache, use arp -a <IP> for that machine mac address.

  • Sorry, what do you mean by "what is above"? If you're referring to another answer, please be more specific since your answer may appear by itself or in a different order. – Andrew Schulman Apr 10 '15 at 15:19
  • 1
    Just look at the lengths to which this topic goes. All that is needed is arp -a <IP> and AHAW responded with code. while nice just over complicated. – ChrisW Apr 10 '15 at 17:28
  • My point is just that "above" is meaningless when your answer may appear by itself, or in an unknown order with other answers. Please be more specific. – Andrew Schulman Apr 10 '15 at 17:53

You could try this :

nbtstat -A

You will get the remote mac address in the (pretty verbose) generated response.


"nmap -v -A [host name/IP address]" might be your best choice; UNIX OS for the client might have it natively available; but nmap is also available for Windows clients as well...

  • The catch with nbtstat is that it only works for remote Windows machines - not 100% sure; it also requires some digging on the command syntax as well... – Jaro Sep 17 '15 at 21:32
  • Also, the "getmac /s [hostname/IP] can be used only on those remote Windows targets that have RPC enabled, are available to you remotely, and you also have remote admin rights on the system. – Jaro Sep 17 '15 at 21:35
  • Some other network scanners (Nessus, Nexpose, Metasploit) might also be able to report this data for you as well... – Jaro Sep 17 '15 at 21:36
  • Welcome to server fault! If you want, you can edit your answer after you create it to add additional content - this looks a lot better than comments. – Falcon Momot Sep 17 '15 at 23:44

I know question was for none domain systems however for those that may stumble on this looking for domain computer examples below is a quick and easy way to do it.

in windows you can just do the following

    $c = "computername" 
    Invoke-Command -ComputerName $c -ScriptBlock {


simply runs a basic command prompt command on a remote system and returns the data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.