Identify the computer owning an IP address whose DNS record is ‘borrowed’ from an old computer

active-directorydomain-name-systemhostnameip address

I am in the process of clearing out old computer accounts from an Active Directory domain that I inherited responsibility for.

In this environment stale records are not removed from DNS so there are a lot of cases where a machine or device has ended up with a DNS record of something that left the network ages ago.

What this means is that a device that shows up as 'computer442' when I run nslookup is not necesarily computer442. And I need to know what the device actually is before I know it's safe to delete the computer account 'computer442' from AD.

For any that respond to a ping with 'reply from [my ip] destination host unreachable' I assume there is nothing there so I delete them. But some of them do respond to a ping so I know there's something there.

So far I've been trying these…

  • Try to browse to it – \\computer442\c$
  • Try to connect to it – mstsc /v:computer442
  • See if it is a web server = http://computer442
  • Use portqry.exe to query common ports.

In some cases none of these things help, but there is definitely something responding to the ping. So is there a way to identify it?

Best Answer

Im not here to spark a Windows Vs Linux Debate, but there is a utility called nmap which I find invaluable for such occasions. Happily its available for Windows too: http://nmap.org/book/inst-windows.html

As an example, this is running from my Linux workstation to my Windows XP VM:

 ~ $ sudo nmap -O 192.168.2.116
Starting Nmap 6.25 ( http://nmap.org ) at 2013-08-29 20:08 BST
Nmap scan report for 192.168.2.116
Host is up (0.00032s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 08:00:27:48:3A:2E (Cadmus Computer Systems)
Device type: general purpose
Running: Microsoft Windows XP
OS CPE: cpe:/o:microsoft:windows_xp::sp2 cpe:/o:microsoft:windows_xp::sp3
OS details: Microsoft Windows XP SP2 or SP3
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 3.11 seconds

As you can see It can (attempt) to use the MAC address to identify the make of the network card, or sometimes the device itself, although in this particular instance it hasn't been particularly successful! Its a VirtualBox VM! :D

None the less, check the ports section of the output and that makes it pretty clear that its an M$ box... okay it COULD be a linux box pretending to be a Windows box, but I'm assuming you know what OS's you have on your network.

Related Topic