LDAP query logged in users via IP - active-directory

Question

Is it possible to connect to an LDAP/Windows Active Directory server as an admin (using bind) and then run an IP based query to see what user is logged into a Windows PC based on a particular IP? The IP would not be a hardcoded value or attribute.
Basically I am wondering if I can ask Active Directory what user is logged in when supplied an IP address.

Answer 1

Active Directory stores user logon history data in the event logs on domain controllers.
The event ID for a user logon event is 4624.
These events contain data about the user, time, computer and type of user logon.
Using LDAP query, we cannot fetch the username from the IP address.
Instead we can use PowerShell to query the logon event data and fetch the username with IP address.
# Find DC list from Active Directory
$DCs = Get-ADDomainController -Filter *
# Define time for report (default is 1 day)
$startDate = (get-date).AddDays(-1)
# Store successful logon events from security logs with the specified dates and workstation/IP in an array
foreach ($DC in $DCs){
$slogonevents = Get-Eventlog -LogName Security -ComputerName $DC.Hostname -after $startDate | where {$_.eventID -eq 4624 }}
# Crawl through events; print all logon history with type, date/time, status, account name, computer and IP address based on user logon IP address
foreach ($e in $slogonevents){
# Logon Successful Events
if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[18] -eq ”IPAdress”)){
write-host "Type: Remote Logon`tDate: "$e.TimeGenerated "`tStatus: Success`tUsername: "$e.ReplacementStrings[5] "`tWorkstation: "$e.ReplacementStrings[11] "`tIP Address: "$e.ReplacementStrings[18]
}}
Reference : Active Directory: How to Get User Login History using PowerShell - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com)