find out which computer has opened a file on Servers network share

Question

I have a Windows Server 2008 and it shares a folder. Many clients access that folder and the inherit files. One client opens one dll file sporadically with mode rw, so after that no other client can load the dll.

Now I want to determine which client does it. All tools I found:

• openfile
• net
• sharewatch
• NetShareMonitor

doesn't show me the Network client which opens the file in rw mode.

I think it is the antivirus programm, but I need to know which client has the file opend.

Edit:

• The clients are windows machines
• All clients use the same user, so I can't determine the client with the username

Answer 1

This may be of use to you:

I can't be certain it's the same location on Server edition, but I accessed it through Win + X -> Computer Management -> System Tools -> Shared Folders -> Open Files

This lists each open file handle, its "Open Mode" (Read/ReadWrite) and the user. You can also close the file handle from this location.

Answer 2

We have been wanting to do this for years!

Today we spotted this utility:

https://www.nirsoft.net/utils/network_opened_files.html

Fantastic!

Edit:

You can use NetworkOpenedFiles from Nirsoft to determine which host has an open file on a Windows file share.

Answer 3

This is an old question, but nevertheless:

if you have PowerShell 4.0+ (which does not come with Windows Server 2008, you would have to update your PowerShell Version), you could use this:

Directly on the server:

Get-SmbOpenFile | where-object { $_.Path -like 'C:\foo\bar\*' }

from a RemoteMachine:

$cim = New-CimSession ServerName -Credential (get-credential)
Get-SmbOpenFile -CimSession $cim | where-object { $_.Path -like 'C:\foo\bar\*' }

Get-SmbOpenfile returns a list of all open files on the server, which we filter with where-object to only see the ones we're looking for.

This will return amongst other things the ClientComputerName which is the IP of the computer that has opened the file.

Here's an example output:

PS C:\WINDOWS\system32> get-smbopenfile -cimsession $cim | where-object { $_.Path -like 'D:\Daten\Transfer\*' }

    FileId       SessionId    Path                 ShareRelativePath ClientComputerName ClientUserName PSComputerName
    ------       ---------    ----                 ----------------- ------------------ -------------- --------------
    347355680805 348160786757 D:\Daten\TRANSFER\xy TRANSFER\xy       10.0.0.114         INTERNAL\xy    Server

If you then want to quickly see what's the hostname of the returned IP-Address, use:

[Net.DNS]::GetHostByAddress("10.0.0.114") | select -expand HostName