powershellwindows-server-2008-r2smbnetwork-share

Monitor shared file access using PowerShell


Background

Using Windows' MMC's Shared Folders functionality I'm able to view any Open Files being accessed via shared folders. This gives me a static view; I'd like to write a script (ideally PowerShell) to monitor this share and log the information of who connects to what & when to file.

I'm running Windows Server 2008 R2, so sadly Get-SmbOpenFile isn't available.

Question

Is there a way to view all files open over a share in Windows 2008 R2 using PowerShell?


Solution

  • Use net file and net session instead:

    & net file | Where-Object {
        $_ -match '^(\d+)\s+(.*)\s+(\w+)\s+(\d+)\s*$'
    } | ForEach-Object {
        New-Object -Type PSObject -Property @{
            'ID'    = $matches[1]
            'File'  = $matches[2].Trim()
            'User'  = $matches[3]
            'Locks' = $matches[4]
        }
    }
    
    & net session | Where-Object {
        $_ -match '^(\S+)\s+(\w+)\s+(.*)\s+(\d+)\s+(\S+)\s*$'
    } | ForEach-Object {
        New-Object -Type PSObject -Property @{
            'Client' = $matches[1]
            'User'   = $matches[2]
            'Type'   = $matches[3].Trim()
            'Open'   = $matches[4]
            'Idle'   = $matches[5]
        }
    }