是否可以查询特定域用户当前登录的 IP 地址（或计算机名称）列表？
是否可以查询域用户当前登录的域计算机的IP地址（或机器名）列表？
问题“使用或登录用户名Windows 中没有域” 很接近，只是我想找到相反的情况。
由于我缺乏对 Active Directory 内部结构的了解，我询问了这种可能性。 我的直觉是，Active Directory 只知道域用户上次进行身份验证的时间（可能是在哪里），并且不跟踪当前会话或注销。
任何提供此解决方案的语言都是可接受的答案，但 .NET 解决方案是首选。 更重要的是，我想知道这是否可能。
Is it possible to query a list of IP addresses (or machine names) of domain computers that a domain user is currently logged into?
The question "Getting logged on user’s name with or without domain in Windows" comes close, only I want to find the opposite.
I ask about the possibility due to my lack of knowledge concerning the internals of Active Directory. My gut feeling is that Active Directory only knows when (and possibly where) a domain user was last authenticated, and doesn't track current sessions or log-offs.
Any language that provides this solution will be an acceptable answer, but a .NET solution is preferred. More importantly, I'd like to know if this is even possible.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不相信只有一个地方可以获取这些信息。 您可以找到用户上次登录的时间以及通过 AD 进行身份验证的 DC，但问题是，当您登录时，第一个响应的 DC 是进行身份验证的服务器。 然后，该 DC 将此信息记录到其事件日志中，该事件日志驻留在每个主机上而不是中央系统中。 您可以从这些链接中查看更多相关信息：
http://support.microsoft.com/kb/175062
和
http://www.tartoos.com/HomePage/Rtable/ComputerSchool/ Networking/Net41.htm 所以话虽这么说，我想您可以从用户帐户的lastLogonTimestamp AD属性中获取最后一次登录，然后从域中的所有DC查询事件日志以找出它是哪个DC对他们进行身份验证以及来自什么系统。 但是所有这些只会告诉最后登录的系统......并不是他们可以登录的所有系统。 再次，您可以将这些结果与可以从 DC 事件日志中提取的注销时间进行比较...但这实际上似乎是一个重大的矫枉过正的努力，并且您会更好地编写记录了这些事件的登录/注销脚本到一个中央报告系统，您可以将其用于将来使用。
这是另一种选择，您可以查询 WINS 服务器来轮询用户的登录信息，这应该返回它认为用户登录的系统，请参阅这篇文章了解如何执行此操作：
http://www.visualbasicscript.com/m_56230/tm.htm
基本上命令是：
“NETSH WINS SERVER \\WinsServerName SHOW NAME UserName 03”如果您使用某种资产/系统管理软件，例如 Desktop Authority、Altiris 等，那么您可能会更幸运地探索桌面代理记录此信息的位置信息，因为他们通常也会将此信息记录到某些 SQL 表中。
I don't believe that there is a one place inwhich this information can be obtained. You can find out the last time a user logged on and what DC authenticated from AD, but the problem is that when you login the first DC to respond is the server which authenticates with. that DC then logs this info to its eventlog, which resides on each host and not in a central system. You can see more about this from these to links:
http://support.microsoft.com/kb/175062
and
http://www.tartoos.com/HomePage/Rtable/ComputerSchool/Networking/Net41.htm SO that being said I guess you could get the last login from the lastLogonTimestamp AD property from the user account and then query the eventlog from all of the DC's in the domain to find out which DC it was that authenticated them and from what system. BUt all of this will only tell the last lgged on system....not all of teh systems that they could be logged into. Again you could compare these results to the logoff times which can be pulled from the DC eventlogs...but really this seems to be a major overkill endevor, and that you would have better luck writing a logon/logoff script which had these events logged to a central reporting system which you could use for future use.
Here is another alternative, you can query your WINS server to poll the logon information that it has for a user, which should return back the system inwhich it believes they logged into, see this post for how to do this:
http://www.visualbasicscript.com/m_56230/tm.htm
basically the command is:
"NETSH WINS SERVER \\WinsServerName SHOW NAME UserName 03"if you are using some sort of asset/system management software such as Desktop Authority, Altiris, etc. then you may have more luck exploring where the desktop agents log this information because they usually log this information also into some SQL table(s).