I suspected that net send uses net-bios names. With a little research and a lot of trial and error, I created a function. It would be helpful, in the future, if you posted a link to other threads where you have asked the same question so that we don't have to start from scratch.
Code:
#include <winsock2.h>
#include <windows.h>
#include <stdio.h>
#include <nb30.h>
#if defined(_MSC_VER)
#pragma comment(lib, "wsock32.lib")
#pragma comment(lib, "Netapi32.lib")
#endif
/*
* This function attempts to find a logged-on user on the local network.
* It uses net-bios names registered by the messenger service to perform the lookup.
*
* Requirements:
* - The messenger service must be running on the target machines.
* - The user name must not contain non-ascii characters or be longer than 16 characters.
*
* Paramaters:
* - szUser: The user name to look up.
* - szMachine: A buffer in which to return the net-bios machine name where
* the user is logged-on. This buffer must be at least NCBNAMSZ + 1
* characters in size. Upon return the machine name can be passed
* to the gethostbyname function to obtain its IP address.
* - cchMachine: The size of the szMachine buffer.
*
* Returns:
* A non-zero value upon success. Zero on failure. GetLastError() can NOT be called
* to obtain a reason code.
*
* Note:
* This function is intended for use when you don't have administrator privileges
* on the target machines. If you do, use NetServerEnum and NetWkstaUserEnum instead.
*/
BOOL FindUserOnNetwork(LPCSTR szUser, LPSTR szMachine, UINT cchMachine)
{
NCB ncb;
BYTE buf[sizeof (ADAPTER_STATUS) + (255 * sizeof (NAME_BUFFER))];
ADAPTER_STATUS* pStatus = (ADAPTER_STATUS*) buf;
NAME_BUFFER* pNames = (NAME_BUFFER*) (pStatus + 1);
int cchUser = lstrlenA(szUser);
int i = 0;
BOOL bFound = FALSE;
if (cchMachine > 0)
szMachine[0] = '\0';
/* Check arguments. */
if (cchUser > NCBNAMSZ ||
cchMachine < NCBNAMSZ + 1)
return FALSE;
/* Net-Bios Reset. */
ZeroMemory(&ncb, sizeof(ncb));
ncb.ncb_command = NCBRESET;
ncb.ncb_lana_num = 0;
Netbios(&ncb);
if (NRC_GOODRET != ncb.ncb_retcode)
return FALSE;
ZeroMemory(&ncb, sizeof(ncb));
/* Make a space padded net-bios name. */
memset(ncb.ncb_callname, ' ', NCBNAMSZ);
memcpy(ncb.ncb_callname, szUser, cchUser);
/* The last character in a net-bios name registered
* by the messenger service is 0x3. */
ncb.ncb_callname[NCBNAMSZ - 1] = 0x03;
/* Retrieve the net-bios adapter status for the given net-bios name. */
ncb.ncb_command = NCBASTAT;
ncb.ncb_lana_num = 0;
ncb.ncb_buffer = buf;
ncb.ncb_length = sizeof(buf);
Netbios(&ncb);
if (NRC_GOODRET != ncb.ncb_retcode)
return FALSE;
for (i = 0; i < pStatus->name_count; i++)
{
if (!(pNames[i].name_flags & GROUP_NAME) &&
(pNames[i].name[NCBNAMSZ - 1] == 0x00))
{
lstrcpyA(szMachine, pNames[i].name);
bFound = TRUE;
}
#if defined(DEBUG)
printf("Flags: 0x%02x\nType: 0x%02x\nName: %.16s\n\n",
pNames[i].name_flags, pNames[i].name[15], pNames[i].name);
#endif
}
/* Remove trailing spaces. */
for (i = lstrlenA(szMachine) - 1; i >= 0 && szMachine[i] == ' '; i--)
szMachine[i] = '\0';
return bFound;
}
int main(void)
{
WSADATA wsad;
CHAR buf[NCBNAMSZ + 1];
struct hostent* host;
struct in_addr addr;
FindUserOnNetwork("USER1", buf, sizeof(buf));
printf("Machine name: %s\n", buf);
WSAStartup(MAKEWORD(2, 2), &wsad);
host = gethostbyname(buf);
if (host != NULL)
{
memcpy(&addr.S_un.S_addr, host->h_addr_list[0], sizeof(ULONG));
printf("IP Address: %s\n", inet_ntoa(addr));
}
getchar();
return 0;
}