Hi, i have tried using nlist to track a user from a his mac address, but the problem is it doesn't list the mac address it just prints 0 , why is that? is there any other solution that i can track down a user from his mac address? c:\>nlist user /a/b | find "mac address" but all the mac addresses listed are 0 Thanks

how about nbtstat -A ipaddress? It gives you the mac address if they are ms machines. You can see what the ip address is of the logged in user in nwadmin and their client properties.

yes, nbtstat will give me info about the mac address if i provide the ip address/hostname. But what i need is the ip address/hostname from the mac address. The mac address will always remain the same, and the ip address changes. Yes, you are right i can get the ip address of the all the active users but i wanted to track down users from their mac address.. not ip Thanks

Mac address and host name don't change even if you use dhcp. Instead to mac address why not use host name? I think Zenworks could give you that kind of info by quering the dynamic dns tables but otherwise I don't know. In windows and .net forums someone posted a script by which they could get the ipaddress by the mac address so you might want to search/post there.

Hostname does change depending on the location you are logged in from, and along with the changed hostname resolves to a different IP. The only way to keep track of a computer is the MAC. I couldn't find any script file that you were saying, but i have made my a batch file for that does the same thing. It will ping the network and fill up tyhe arp cache which you can then use to find the ip address, by arp -a | find "mac address" Here is the script that i made, if anyone requires to find the IP address from the MAC address @echo off :Start IF "%4"=="" GOTO Help SET thirdOctet=%1 SET thirdlimit=%2 SET fourthOctet=%3 SET fourthlimit=%4 IF "%5"=="" SET net1=131 SET net1=%5 IF "%6"=="" SET net2=162 SET net2=%6 IF "%7"=="" SET timeOut=100 SET timeOut=%7 GOTO IP :IP IF %fourthOctet% GEQ %fourthlimit% GOTO PART2 SET ipadd=%net1%.%net2%.%thirdoctet%.%fourthOctet% ECHO Processing %ipadd% GOTO PART1 :PART1 ping -n 1 %ipadd% -w %timeOut% > junk.del GOTO Update :Update SET /A fourthOctet=%fourthOctet%+1 GOTO IP :PART2 IF %thirdOctet% GEQ %thirdlimit% GOTO END SET fourthOctet=1 SET /A thirdOctet=%thirdOctet%+1 SET ipadd=%net1%.%net2%.%thirdOctet%.%fourthOctet% ECHO Processing %ipadd% GOTO PART1 :Help ECHO Usage : ECHO C_ARP 3rd_octet 3rd_limit 4th_octet 4th_limit [Optional 1st_octet] [Optional 2nd_octet] [Optional Timeout] ---------------- ECHO Example Usage 1 : ECHO C_ARP 145 147 1 255 ECHO will scan the ip ranges from 131.162.145.1 to 131.162.145.255 ECHO and 131.162.146.1 to 131.162.146.255 ECHO and 131.162.147.1 to 131.162.147.255 ECHO C_ARP 145 147 1 255 156 230 10 ECHO will do the same thing except that 131 will be replaced by 156 ECHO and 162 will be replaced by 230 ECHO the timeout will be 10 instead of 100 ECHO NOTE : ECHO The parameters 1st_octet, 2nd_octet and Timeout should be ECHO entered in sequence if you use it. ECHO ..................................................................... ECHO ABOUT THE BATCH FILE ECHO ..................................................................... ECHO I created this as i needed a way to get the ip address ECHO from the mac address, since the hostname changes ECHO depending from where you are logged in (ex, Carnegie or Library) ECHO This batch script pings all the ip addresses of the range of ECHO 131.162.third_octet.fourth_octet to 131.162.third_limit.fourth_limit ECHO This in effect fills the cache tables of your ARP, which you can ECHO then use to determine the ip address from the mac address you have!! ECHO Use arp -a to display your arp table and Use arp -d * to clear your arp cache --------------- ECHO DEVELOPED BY KHALSA ECHO CONTACT : 050188s@acadiau.ca ECHO When one door closes, another opens GOTO LETGO :END del junk.del arp -a > results.arp ECHO ARP table saved in file results.arp, Good luck !! :LETGO