Tracing PC's on corporate network with netsend disabled

[Cerdito]

Not sure if this is the right from for this...

In my company we occasionally have to trace PC's with viruses. We used to just do an "nbtstat" and it would show the name of the user logged onto the PC. This is what we used to see:

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
SERIAL-123 <00> UNIQUE Registered
WORKGROUP <00> GROUP Registered
SERIAL-123 <03> UNIQUE Registered
SERIAL-123 <20> UNIQUE Registered
JOE_BLOGGS <03> UNIQUE Registered

Unfortunately the Windows Messenger service has been disabled as part of global policy.
This means we can no longer see the "JOE_BLOGGS <03>" Netbios name. We now see this:

NetBIOS Remote Machine Name Table

Name Type Status
---------------------------------------------
SERIAL-123 <00> UNIQUE Registered
WORKGROUP <00> GROUP Registered
SERIAL-123 <20> UNIQUE Registered

To compound this, the <00> & <20> PC names that show up when we do this are just serial numbers (also part of global policy).

Can anyone suggest another way we could remotely see who is logged on at a specific PC?

 

[linney]

Does the Security log in the Event Viewer give you any information?

 

[Andyleates]

Have you tried psloggedon.exe which is in the pstoolkit from

http://www.sysinternals.com

Andy Leates MCSE CCNA MCP+I