c# - How to get hostname of the machine that the user logged in on? -

i hostname of machine enduser logged last. able user name, , last login directoryentry.

here code:

var dirs = new directoryentry("winnt://dcname"); foreach (directoryentry de in dirs.children) {     var user = string.empty;     var lastlogin = string.empty;     var lastlogoff = string.empty;      if (de.schemaclassname == "user")     {         user = de.name;          if (de.properties["lastlogin"].value != null)         {                                     lastlogin = de.properties["lastlogin"].value.tostring();         }         if (de.properties[lastlogoff].value != null)         {                                     lastlogoff = de.properties[lastlogoff].value.tostring();         }     } } 

how can hostname well? help.

directly, no, information not stored user in active directory.

however want still possible, if want accomplish need enable audit logon events on domain controller, record logon events in event log similar to¹

 account logged on.  subject:     security id:  system     account name:  win-r9h529rio4y$     account domain:  workgroup     logon id:  0x3e7 logon type:10 new logon:        security id:  win-r9h529rio4y\administrator     account name:  administrator     account domain:  win-r9h529rio4y     logon id:  0x19f4c     logon guid:  {00000000-0000-0000-0000-000000000000} process information:    process id:  0x4c0     process name:  c:\windows\system32\winlogon.exe network information:      workstation name: win-r9h529rio4y     source network address: 10.42.42.211     source port:  1181 detailed authentication information:      logon process:  user32      authentication package: negotiate     transited services: -    package name (ntlm only): -    key length:  0 

you can read event log domain controller in program , log can parsed out getting user logged in (account name) , logged in (workstation name). use lastlogin got example code approximate time search event log login audit event.

---

edit: other alternative solutions see this server fault question, answers variation of "have login script runs , records computer run on place".

---

^{1: example log taken https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4624}