Need to know user name from computer name in AD

Question

Dear Respectable,

I have a computer name and IP address, i need to know which user is associated with that computer.

I tried to look into logon events e.g Event ID: 4624 etc, but there is only computername and ip. i couldn't find username there.

i don't have any third party tool like manageengine, so i am relying on windows powershell and eventviewer.

Can anyone advise how i can get user associated with that specific computer?

Thanks

Answer 1

You may need to add additional auditing options.

https://woshub.com/check-user-logon-history-active-directory-domain-powershell/

See also:

https://learn.microsoft.com/en-us/answers/questions/514049/get-loggedonuser-computername-to-all-computers

Your users aren't logging in with a local account, are they? That won't show up on your domain controllers.

Answer 2

Here's an example of getting those events:

$q = @'
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4624)] and EventData[Data[@Name='LogonType'] and (Data='2' or Data='7')]]
    </Select>
  </Query>
</QueryList>
'@

Foreach ($login in Get-WinEvent -FilterXml $q){
    $y = $login | Convert-EventLogRecord
    [PSCustomObject]@{
        LogonType = $y.LogonType
        SubjectDomainName = $y.TargetDomainName
        SubjectUserName = $y.TargetUserName
    }
}

This works on a local machine, you may need to make adjustments for working with the domain-level security logs.

The query looks for Interactive logons and "Unlock" type logons. Adjust the query to get the logon types you're interested in.

For your own sanity, it would be a good idea for you to install the PowerShell module PSScripTools and make use of the Convert-EventLogRecord. You don't have to, but without it you'll have to work with the XML found in the EventLorRecord you get back from the Get-WinEvent cmdlet.