Lookup to get user information for HTTP incidents

[Migration User]

Has anyone written a script that can lookup the user of a machine for HTTP incidents?

I want to be able to see who was on the machine when the incident was created.. and do an AD lookup.

Thanks

[DLP Solutions]

I have written a few different scripts on this..

1. That does an nslookup of the IP address and returns the laptop name. The laptop name has the users name in it. So I strip it out and do an LDAP lookup with it.
2. That runs a powershell command of logged on user and I strip out the domain name out and do an LDAP lookup with it. (this only works on PC's and as long as there is ONLY 1 logged in user. You need to download the psloggedon.exe from Microsoft and put in the right directory.

They are both VBS scripts that are called to the UI.

Here are the script settings:

stdin=true
stdout=true

script.1.command=c:/windows/system32/cscript.exe
script.1.custom.args=/nologo,D:/Vontu/protect/plugins/scripts/Hostlookup.vbs
 

Attachment(s)

hostlookup.vbs_.txt   2 KB 1 version

powershell lookup.txt   2 KB 1 version