Use CMD to return the logged in user of a remote computer

Introduction

Use this command to determine who is logged into a computer of an already known IP address or Computer name.

Works for Windows 7. (others unknown, probably good for win8 and vista)

Steps (2 total)

1

Step 1 Open the Required Rule in Windows Firewall

You will need to open the Inbound port for "Remote Administration (RPC)" AND\OR "Remote Service Management (RPC)". Alternatively you can open a elevated command prompt and run "Netsh Firewall set service type = RemoteAdmin mode = Enable" (or you can use disable). The netsh command will open the firewall rules for "Remote Administration (NP-in)" "Remote Administration(RPC)" and "Remote Administration(RPC-EPMAP)" 

http://technet.microsoft.com/en-us/library/cc738900(v=ws.10).aspx

If working in a domain environment be sure to enable these firewall rules for the domain inbound rules. If home environment adjust accordingly.

2

Open Command Prompt and run;

"wmic.exe /node:(computername or ip address) computersystem get username"

If you are returned an error of RPC server unavailable. Check that step one was completed successfully.

Conclusion

Our computer naming system is not useful when trying to determine who is logged on. And when I am hunting for "licenses" for a specific program we use that only allows X amount of people I find that I can never tell who is logged into the computer and who should have the license based on computer name alone.

Using this will now allow me to check which computers have an active license and then I can manually map that name to a user name.

Other WMIC commands: http://technet.microsoft.com/en-us/library/bb742610.aspx

From <http://community.spiceworks.com/how_to/40336-use-cmd-to-return-the-logged-in-user-of-a-remote-computer>