0

I am an administrator on a server that accepts RDP connections. When the client connects I know the client's computer name. Using netstat I can determine which connections have been established for RDP.

The ping command and variants only work if I ping by IP address; however, the command will not return a hostname. If I ping by hostname the command will always fail. The nslookup command always fails on both the hostname and the IP address. The nbstat command is not available on the machine.

Question
If I have both he hostname and the IP address how do I match them to each other?

Command line tools, programming solutions in C# or a combination of both are all viable options.

  • Are all of these PCs connecting to your remote desktop server on a LAN? Or are they public computers? – Wesley Dec 18 '15 at 21:49
  • All the computers are connected via LAN. – Dodzi Dzakuma Dec 18 '15 at 21:53
  • What is the authoritative DNS server on the LAN? – Wesley Dec 18 '15 at 21:53
  • That would be a domain controller. However, the RDP sever and the domain controller are not the same. – Dodzi Dzakuma Dec 18 '15 at 21:54
  • 3
    The question to ask is, why isn't your DNS working? – Michael Hampton Dec 18 '15 at 22:06
1

Identify the DNS server being used by nslookup. If you or your company own / operate the DNS server you can add the host names and IP addresses required.

If you are not in control of DNS, the best solution would be to setup your own local DNS server and add each host.

A quick but dirty solution would be to add each host to the servers hosts file.

Checking hosts file / common windows DNS issues: relevant technet link

|improve this answer|||||
  • As stated before, the information from nslookup and other tools are being redacted for security purposes. However, for auditing purposes I need to generate an accurate list of hostnames and IP addresss. Is there anyway to match them up hostnames with IP addresses if I have both? I even have the port numbers that computers are connected to. – Dodzi Dzakuma Dec 21 '15 at 14:17
0

The simple answer is that all of the standard tools you'd use to perform this are broken. You should be able to do the following steps.

First, open up nslookup.

C:\Users\wesley>nslookup
Default Server:  some.server.tld
Address:  1.1.1.1

Second, make sure you're looking to the Active Directory domain controller that's authoritative for your domain:

> server [server hostname or IP address here]
Default Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Third, query the hostname of the PCs you want to know more about:

> hostname.tld
Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Fourth, get a response back:

Non-authoritative answer:
Name:    hostname.tld
Address:  3.3.3.3

Fifth, if there is a reverse lookup zone, and there often is in an Active directory domain, you can use nslookup with an IP address:

C:\Users\wesley>nslookup 3.3.3.3
Server:  dodzi.dzakuma-server.tld
Address:  2.2.2.2

Name:    hostname.tld
Address:  3.3.3.3

If none of that works, then there are much deeper problems that need to be researched and fixed.

|improve this answer|||||
  • I've done your solution and get a response similar to *** domain-controller.domain.local can't find hostname: Non-existent domain. I have confirmed that we are connected to the correct domain controller. I am attempting to create an accurate audit of computer systems using RDP services. I'm attempting to automate it so that the audit is always accurate, but I believe my company has turned off some functionality for security purposes OR I'm having trouble because I am on a different domain that has a trust relationship with the domain I am trying to poll. – Dodzi Dzakuma Dec 22 '15 at 15:07
  • @DodziDzakuma They may have disabled automatic DNS registration for computers that get DHCP leases from the Domain Controllers. Or perhaps computers don't get DHCP from the Domain Controllers at all. Something has been done that is very non-standard and it's causing the problems you're seeing. Looks like you might not be able to solve this until someone fixes the problem. – Wesley Dec 22 '15 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.