How can I find out which computer in my local network is accessing a share?

I have a Windows 7 computer that is sharing several folders & files. I also have several other computers that access those shares, and they all have the same username.

Is there any method in which I can see which of the computers has a particular file open (instead of users)?

I know I can use the Shared Files MMC Snap-In, but that only shows the username. When more than one computer has the same user, that information isn't very helpful.

Moses

Posted 2014-03-03T20:56:42.770

Reputation: 10 813

You might try file access auditing: http://social.technet.microsoft.com/Forums/windows/en-US/e4fde600-dca2-4beb-8884-f0e6ffe891c1/logging-of-file-access-in-windows-7?forum=w7itprosecurity. I'm not sure what data it logs, but it is worth a shot.

– MaQleod – 2014-03-04T00:12:33.683

Answers

Most of the share monitoring tools indicate the IP address, which is enough to identify the computer. If your DHCP server (or router) does not always allocate the same IP address to the same MAC address, you will need to pass to static IP addresses in your network.

Below are three free monitoring tools chosen from the 7 tools in the article
7 Ways to Monitor Shared Folders For Who Modified or Deleted Files.

NetShareMonitor
Free but attention to refuse all adware offers during the installation.
Its usage is described in detail in How to Monitor Access to your Shared Windows Folders/Files

NetShareMonitor image

ShareWatch

ShareWatch image

System Tray Share Monitor
Double click on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double click on the user name will bring up another window showing the files currently being accessed.

System Tray Share Monitor image

harrymc

Posted 2014-03-03T20:56:42.770

Reputation: 306 093

System Tray Share Monitor works wonderfully. I've used ShareWatch and it sometimes doesn't report correct info. Thanks! – Moses – 2014-04-02T13:26:39.133

If you are willing to live with only knowing which share was connected and but not which specific file in the share is being accessed the MMC snap-in does show the computer information if you go to the Sessions view.

You also can get the info from WMI via the following powershell query (you must be running powershell as an administrator for it to work)

Get-WmiObject -Class Win32_ConnectionShare  -Namespace root\cimv2 | Group-Object Antecedent | fl

The connected pc name is in the generated output after the Win32_ServerConnection.ComputerName=, it would only take a few more filters to filter the correct section out and return just that, if I have the time tomorrow I will update the post with it (unless someone with better powershell-fu wants to update it for me before then).

Scott Chamberlain

Posted 2014-03-03T20:56:42.770

Reputation: 28 923

Which version of Windows are you using? My Windows 7 doesn't have the "Computer" column, which is probably the reason behind this post. – harrymc – 2014-04-01T07:40:36.130

Windows 7 enterprise, however I found out how to get the info via WMI and have a powershell query. Updating now. – Scott Chamberlain – 2014-04-01T07:43:09.613

I now found my "Computer" column too. – harrymc – 2014-04-01T07:44:34.330