Daren Matthews

The challenge was to obtain all user IP addresses in order to locate them on the local LAN (i.e. to locate their switch port by checking arp caches and mac address-table entries in the usual manner).  Once located I needed to place them into a different vlan and then have the user reboot to obtain a new IP address.  How could I accomplish this remotely and by “stealth”. 

The answer came in an old-school batch file and the use of “pstools” on my local machine. I had a list of machine names only.  I used pstools “psexec” to obtain their IP address using ipconfig executed on the remote machine:

C:\Users\dmatthew\Desktop\pstools>psexec \\L00151309 ipconfig

PsExec v2.11 – Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals – www.sysinternals.com
[snip]
Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix  . :
IPv4 Address. . . . . . . . . . . : 172.23.25.32
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 172.23.25.254
[snip]

Now I had the IP address I located the user on the network and found their switch-port.  Before I made the change to the vlan on the port I used pstools to copy a batch file “switch-vlan.bat” to the users local machine:

psexec \\L00151309 echo f | xcopy /f /y “\\FS03\DSTGS Shared\Scratch\switch-vlan.bat” \\L00151309\c$

Now that the file is on the remote machine I then executed the batch file which contained a 15 second pause, during which time I made the vlan change.  Once the vlan was changed the batch file continued and had the remote machine release and renew it’s ip address and also to flush the DNS cache.

psexec \\L00151309 c:\switch-vlan.bat

The user is now on the new VLAN and has acquired a new IP address. Success!

This is the contents of “switch-vlan.bat” file, which is located on a server share accessible by all users:

@echo off
rem *** Sleep for 15 seconds ***
ping 1.1.1.1 -n 1 -w 15000 > nul
rem *** now continue ***
ipconfig /release
ipconfig /renew
ipconfig /flushdns