How to ID the physical location of a PC in a network?

I have been asked to physicly locate a few PC's (since I cant RDP into them to change the settings that need changed). I got lucky on one of the machines, it has Win XP installed. When I RDP into the machine it tells me the user that is currently logged on, which I can then find in the buidling.

However I have 4 machines that run newer versons of windows (Vista/7), and that software does not give this info as easily.

Anyone have an idea how to locate these machines? All I have are IP's and computer names.

My other option is to get here an hour before anyone else to ensure I can remote it. While its a logical/easy solution, that would also mean fighting traffic at rush hour which I would rather avoid.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

zxshockaxz

Does your company not have some sort of pc naming convention that might help you identify where they might be?

networker050184

Find the MAC address from the IP and then trace out the switchport. Hopefully you have switchport to jack mappings available.

ptilsen

If you have access to switches, you can view connected MAC addresses, and in doing so determine to which switch and port the device is connected. However, this assumes you have managed switches and can relatively easily get a physical port location from a switch port.

Edit: Networker beat me to it.

--chris--

Thank you guys, Ill do this.

Yes they have a name convention, but the previous support guy(s) didnt follow it. This allowed some PC's to have duplicate names (example: ABC101 and ABC101a). Im trying to remove the duplicates and assign there own uniqe name as well as sort the PC's and devices into there own respective subnets. The latter will take more learning and time, but its on the table.

And yes, I beleive we have switchport to jack mappings. Im 90% certain thats what I have on my desk anyhow.

BobbyDC

Use powershell? If you have admin rights...

$computer = Read-Host "Enter the computer name: "

Get-WmiObject win32_computersystem -computername $computer | select -property username

I use this a lot to find who is currently logged on a machine.

Qord

You can find who's logged on by using psloggedon from SysInternals or by scripting to get the owner of the explorer.exe process.

Here's a quick powershell that will get you the owner of the explorer process:

(Get-WmiObject Win32_Process -ComputerName name-of-remote-computer | ?{ $_.ProcessName -match "explorer" }).getowner() | Select-object "User"

Edit: Bobby beat me to it. That's what happens when you click "reply" and walk away.

eansdad

No one mentions the easiest way...Disable the account and see who screams....Why go searching when you can make them come to you?

or you could use powershell to see who is logged in and go from their. Depends on your mode I guess.

PurpleIT

There are plenty of good answers already, but you can also try to browse c$\users\ and see what profiles are on the machine.

--chris--

Power shell stuff is very new to me, I'll have to do some reading on it plus I have yet to get the address for the server and login cress.

I was encouraged by a coworker to start booting users via RDP but only after running it by my boss....and he's out today. I chuckled a bit thinking about that.

tstrip007

I use a free program called lansweeper. Integrates with AD so I can search by username (or pc name) and it will tell me the pc's the user has logged onto starting with most recent. Install took like 5 min, highly recommend.

SouthSeaPirate

--chris-- wrote: »

Power shell stuff is very new to me, I'll have to do some reading on it plus I have yet to get the address for the server and login cress.

I was encouraged by a coworker to start booting users via RDP but only after running it by my boss....and he's out today. I chuckled a bit thinking about that.

Same here. No powershell experince.

If you're just looking at a machine here and there, I recommend using eventvwr and connect to remote machine. Then see the security logs and find the most recent 'Logon' catagory that doesnt have you as the user that logged in. From there, call the user and politely ask their location. If you're new, it wouldnt hurt to briefly explain what you're doing (in very simple terms).

--chris--

I am remoting in and booting users. I sent an email out, then talked to the managers of the departments. The accountants looked like I was telling them I was going to set their hair on fire. The marketing guys/gals all basically had a communal smoke break when I told them, and the sales people quietly looked around lol.

santaowns

That's not best practice, people's could lose data that way. God forbid you kick off someone important like a vp. You really should use some of the above solution before being brute and kicking people off. Imagine if you cause someone to lose something they can't reproduce, that will be your fault and you would be subject to the repercussions.

DevilWAH

Booting a user off should never be a solution unless they are doing some thing bad, or you have the express agreement to do so. You can't be sure a user has received an email and as was demonstrated a few weeks ago when a enginner misstyped a PC name and rebuilt a directors PC over the network. You could cause loss of work on a mammoth scale!!

A few hours of work and using some thing like

Switch Port Mapping Tool to get the swithport to IP mappings in bulk.

then the powershell script bellow to map IP to user.

and you can do it all with out any interference to the users.

networker050184

I agree 100% with DevilWAH. Booting users may be the easiest way, but the easiest way may not always be the best. You could have easily found out the same information without disrupting the users. The less people have IT messing with their stuff the better for you in the long run even if it means a bit more work on your part.

DevilWAH

A tool such as op util from managed enginee (Google it

) will do the whole thing in one go, and if you have the switchport to physical location you can add then in to.

It's about £600 to monitor 1000 ports, and there are better tools around. But it can tell you history of where user logins, history of port status. And if you set up the right snap settings you can even bring up and disable ports through it.

Oh and it does IP address managment. Like I say it's only an entry level tool but is a good trouble shooting tool.

remember, the only times users think of IT is when we interact with them, we can't complain of them moaning if the only time this happens it is disruptive. Users often think of IT as the dark arts. But I like to been seen as the white wizard. It's like looking after a child. If you want to take something from the, or give them an injection. Make sure you have a lolly or sticker in the other hand!

--chris--

@ Networker and DevilWAH, all good points and valuable learning. @Everyone who has offered help (including the last two), I think I should offer a brief explanation on my part. I took those two ideas above (powershell and using switch port mappings to MAC addresses) to my coworker (who is my mentor/counselor here) and my direct boss (who is VP). My coworker said no, just use IP addresses and look up the last logins in the AD. I tried that, but all the results were erroneous. My coworker got busy and was unable to help me, meanwhile the VP was asking me to get it done. I told him of the two ideas above, he said to have my coworker teach me. I took those directions back to my coworker, he said no way and told me to just boot the users after informing the managers of what was going to happen and answering any questions from the users. I sent out an email with an non-technical explanation of what was going to happen and kept it short and to the point. I gave everyone a 10 minute window of when I would be doing this and advised that any work be saved prior to this window. TL;DR my hands were tied but if I knew how big of a "no-no" this was I would have fought it a little more. Sorry about the massive paragraph, my keyboards "ENTER" keys have ceased to function today. Again, thank you everyone for the advice. Its not lost on me, I will be going over this stuff in my home lab.

Qord

--chris-- wrote: »

...my hands were tied but if I knew how big of a "no-no" this was I would have fought it a little more...

Just because it's not best practice doesn't mean it can't be done that way. If that's what was needed to get the job done, then that's it. This is a prime example of not being in a position to do things in the most optimal way, and you did all you could for doing it with minimal impact to staff and operations.

--chris--

Qord wrote: »

Just because it's not best practice doesn't mean it can't be done that way. If that's what was needed to get the job done, then that's it. This is a prime example of not being in a position to do things in the most optimal way, and you did all you could for doing it with minimal impact to staff and operations.

This is a legitimate fear I have. I'm a bit worried that I am learning a lot of things, but it may not be following best practices...aka bad habits that could make me look ignorant/un-educated to potential employers down the road.

QHalo

Booting users first is a bad habit and should only be done in the direst of situations. Using powershell, or a sweeping application or trying to gain access via methods that don't disturb the customer anymore than necessary are better methods. There's no best practice for this, only common sense which states don't bother users unless you have to. The less users know, the better. They only ask questions and turn mole hills into mountains because they probably don't understand what you're really asking.

DevilWAH

By all means if you take a number of solution to management and they don't chose the optional one, then that's there choice.

I always say say there's no right or wrong way to do things, just good and bad, or better and worst. If it gets the job done and management are happy them good on you. Just maybe suggest you sort out a better solution for if you are in the same situation again.