Need to find user

[roland63]

With an IP address in hand and a time, how can I find out user name and computer name?

We use N2H2 to block improper sites for our school district, once blocked, the user has the option to request the site be unblocked. This message is emailed to me. The information on the message is the blocked site url, the date and time of the request to unlock and their IP address.

I usually read the messages promplty and immediately nbtstat that IP address and find out immediately who is logged on and the name of the computer.

Today I didn't get to read one for over one hour and by that time the user had already logged off for the nbtstat returned with no info....

How can I find out in a log or somewhere the user's name and computer name that it was sent from? I have the IP address and time....

 

[itsp1965]

if ping -a <ipaddress> doesn't work for you (then again maybe not if NBTSTAT doesn't show anything), it maybe because the machine that tries to access your site is running a non-MS OS. If this came from the internet, then a better tool would be to use a whois server to track down the IP (try

http://www.dnsstuff.com/)

Hope this helps.

 

[roland63]

Here is the thing; this happened within our network.

Since I usually read these messages and am able to nbtstat and find out the location of the computer (due to the name in the network), I can find out immediately who is logged in and take action. Today along with the request to unlock the blocked site, came an interesting comment that calls for disciplinary action - this is a Jr. High and we promptly address these problems before they become rampant.

So I know this took place in this building (our network), I just need to know who was logged onto what pc....like I said, I have the time and the ip address...

Hope someone can help...

 

[itsp1965]

Do these computers obtain their IP addressing through DHCP? you can check which machine was the last one to obtain the IP address (assuming the lease is still active).
Do these users connect to a domain in your school or to indvidual PCs (you could check the event logs -- assuming you have auditing enabled to see who logged on the machine in question last)

 

[roland63]

Yes, we do use DHCP.

Here is the thing, everyone logs onto our domain but since this was a laptop, they get used from one period to the next. If it was just logged off, it should have retained the IP address. Since anyone can get any laptop they want, I need to know the name of the laptop and the user ID that logged on with that IP....