How to Find a Username from an IP Address in Command Prompt

You can find the username associated with an IP address on your local network by using the nbtstat command in Command Prompt. This tool queries NetBIOS information — a naming system that Windows uses to identify computers and users on a network — and returns the username linked to that IP. The command works only for devices currently connected to your network, not for random IP addresses on the internet.

The process takes about 30 seconds and requires only that you know the IP address you want to look up. If you do not already have the IP address, you can find it using ipconfig or arp -a first, then use that address with nbtstat.

Key Takeaways

  • The nbtstat command retrieves the username for an IP address on your local network, but only if that device is currently connected.
  • The command syntax is nbtstat -a [IP address], typed into Command Prompt with administrator privileges.
  • Results show the NetBIOS name, username, and computer name — the username appears in the leftmost column of the output table.
  • This method works only on local networks; it cannot retrieve usernames for IP addresses on the public internet.
  • If nbtstat returns "Host not found," the device is offline, blocked by a firewall, or does not support NetBIOS queries.

Opening Command Prompt with Administrator Rights

The nbtstat command requires administrator privileges to run. Click the Windows Start button, type cmd into the search box, then right-click "Command Prompt" and select "Run as administrator." A dialog box will ask for permission — click "Yes" to proceed.

Once Command Prompt opens, you will see a black window with a blinking cursor. The title bar should say "Administrator: Command Prompt" to confirm you have the right permissions. If it does not, close this window and repeat the process, making sure to right-click and select "Run as administrator."

Running the nbtstat Command with an IP Address

Type the command exactly as shown: nbtstat -a 192.168.1.100, replacing 192.168.1.100 with the actual IP address you want to look up. The space between -a and the IP address is required. Press Enter.

Command Prompt will pause for a moment while it queries the device. If the device is online and responds, you will see a table with several rows of information. The username appears in the leftmost column of the table, usually in the first few rows. Look for an entry that is not all capital letters — that is typically the username. Entries in all capitals (like COMPUTERNAME or WORKGROUP) are the computer name and domain, not the username.

Reading the nbtstat Output Table

The output shows three columns: the NetBIOS name (leftmost), a two-digit code (middle), and a status (rightmost). The username is the entry in the leftmost column that appears in mixed case or lowercase — for example, "jsmith" or "marcus.chen" rather than "DESKTOP-ABC123." If you see multiple entries, the one without a code like <20> or <00> is usually the logged-in user.

If the output shows only capital letters and computer names, the device may not have a user currently logged in, or it may not broadcast usernames over NetBIOS. This is common on newer Windows systems or devices configured to block NetBIOS queries for security reasons.

What to Do If nbtstat Returns "Host Not Found"

This message means Command Prompt could not reach the IP address. The device may be offline, the IP address may be incorrect, or a firewall may be blocking NetBIOS queries. Double-check the IP address by using arp -a to list all devices currently connected to your network, then try nbtstat again with the correct address.

If you are certain the IP address is correct and the device is online, the device owner may have disabled NetBIOS for security. In that case, nbtstat will not work, and you will need to contact the device owner directly or use your router's admin panel to see connected devices and their hostnames.

Finding an IP Address Before You Use nbtstat

If you do not already know the IP address of the device, type arp -a into Command Prompt to see a list of all devices currently connected to your network. This command shows the IP address, physical address (MAC address), and type for each device. Find the device you are looking for — you may recognize it by its MAC address or by process of elimination — then use that IP address with nbtstat.

Alternatively, if you know the computer name of the device, you can use nbtstat -a [computer name] instead of an IP address. This works the same way but requires you to know the device's hostname rather than its IP.

Why nbtstat Works Only on Local Networks

NetBIOS is a naming protocol designed for local area networks — the devices in your home or office connected to the same router. It does not work across the internet because public IP addresses do not respond to NetBIOS queries. If you try to use nbtstat on an IP address from a website or a remote server, you will always get "Host not found," even if the address is valid.

This is by design: NetBIOS was never intended to expose usernames across the internet. If you need information about a remote server or website, you would need different tools and would typically need permission from the server owner.

Frequently Asked Questions

Can I use nbtstat to find usernames on the internet?

No. nbtstat only works on your local network. IP addresses on the public internet do not respond to NetBIOS queries, so the command will return "Host not found" for any address outside your network.

What if the device is offline?

nbtstat requires the device to be powered on and connected to the network. If the device is offline, you will see "Host not found." Turn the device on, wait a few seconds for it to connect, then try the command again.

Does nbtstat work on Mac or Linux?

nbtstat is a Windows-only command. Mac and Linux use different tools to query network information. On Mac, you can use nbtstat if you install it via Homebrew, but the syntax and output may differ slightly.

Why do I see multiple usernames in the nbtstat output?

A device may show multiple entries if several users have logged in recently or if the system has cached NetBIOS names. The currently logged-in user is typically the entry without a code like <20> or <00>, or you can check the device directly to confirm.

Is using nbtstat a security risk?

nbtstat queries information that the device broadcasts on the local network by default. It is not a hack or intrusion — it is reading data the device is already sharing. However, if you are concerned about your own device being queried, you can disable NetBIOS in your network settings to prevent others from seeing your username this way.