How to find out which user credentials were used to connect to a SMB share

Question

I am currently running a Windows 7 client with a mapped network drive Z: to \someserver\someshare, which I can see in explorer. How can I find out which user account was actually used to create this mapping?

So what I am asking for is: I already have a mapped network drive, but want to know afterwards which user was used to connect.

I can see in properties of course what server I am connected to, but not which credentials were actually used to connect to that share on a server. Is there a way using the net command, or something similar?

Answer 1

I already have a mapped network drive, but want to know afterwards which user was used to connect.

Try looking at the event logs for EventID 5140: A network share object was accessed:

5140: A network share object was accessed

Subject:

The user and logon session that accessed the share.

• Security ID: The SID of the account.
• Account Name: The account logon name.
• Account Domain: The domain or - in the case of local accounts - computer name. Logon ID is a semi-unique (unique between reboots) number that identifies the logon session. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

...

Examples of 5140

A network share object was accessed.

Subject:

   Security ID:  ACME-FR\Administrator
   Account Name:  Administrator
   Account Domain:  ACME-FR
   Logon ID:  0x74a739

Network Information:

   Source Address:  10.42.42.221
   Source Port:  65097

Share Name:   \\*\Dharma Initiative Protocols