Awinkel -
NBTSTAT will return ip address, session info and MAC address. MDuiker is using the variable $LoggedOnTo for the users workstation. So, executing NBTSTAT -a <workstation id> will return the NetBIOS remote machine name table. Entry <03> in the display should be the user logged onto to the workstation. If no 'O3' entry no one logged into (likely only missing with NT/2K, but I have not tested).The trick will be pulling the info for entry '03' from your output file and using it. CJ or Bryce - any good ideas?
Bill
