Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Windows 7 computer that is sharing several folders & files. I also have several other computers that access those shares, and they all have the same username.

Is there any method in which I can see which of the computers has a particular file open (instead of users)?

I know I can use the Shared Files MMC Snap-In, but that only shows the username. When more than one computer has the same user, that information isn't very helpful.

share|improve this question
    
You might try file access auditing: social.technet.microsoft.com/Forums/windows/en-US/…. I'm not sure what data it logs, but it is worth a shot. –  MaQleod Mar 4 at 0:12

2 Answers 2

up vote 3 down vote accepted
+100

Most of the share monitoring tools indicate the IP address, which is enough to identify the computer. If your DHCP server (or router) does not always allocate the same IP address to the same MAC address, you will need to pass to static IP addresses in your network.

Below are three free monitoring tools chosen from the 7 tools in the article
7 Ways to Monitor Shared Folders For Who Modified or Deleted Files.

NetShareMonitor
Free but attention to refuse all adware offers during the installation.
Its usage is described in detail in How to Monitor Access to your Shared Windows Folders/Files

NetShareMonitor image

ShareWatch

ShareWatch image

System Tray Share Monitor
Double click on the tray icon will show a small bar of the user and IP address connected to your shared folder. Double click on the user name will bring up another window showing the files currently being accessed.

System Tray Share Monitor image

share|improve this answer
    
System Tray Share Monitor works wonderfully. I've used ShareWatch and it sometimes doesn't report correct info. Thanks! –  ϺОŞΣŞ Apr 2 at 13:26

If you are willing to live with only knowing which share was connected and but not which specific file in the share is being accessed the MMC snap-in does show the computer information if you go to the Sessions view.

enter image description here

You also can get the info from WMI via the following powershell query (you must be running powershell as an administrator for it to work)

Get-WmiObject -Class Win32_ConnectionShare  -Namespace root\cimv2 | Group-Object Antecedent | fl

The connected pc name is in the generated output after the Win32_ServerConnection.ComputerName=, it would only take a few more filters to filter the correct section out and return just that, if I have the time tomorrow I will update the post with it (unless someone with better powershell-fu wants to update it for me before then).

share|improve this answer
    
Which version of Windows are you using? My Windows 7 doesn't have the "Computer" column, which is probably the reason behind this post. –  harrymc Apr 1 at 7:40
    
Windows 7 enterprise, however I found out how to get the info via WMI and have a powershell query. Updating now. –  Scott Chamberlain Apr 1 at 7:43
    
I now found my "Computer" column too. –  harrymc Apr 1 at 7:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.