How do I tell which computer name (or IP) is accessing a specific file on a server?
I have a scenario where (on a small LAN) one computer is locking a shared file on a server so no other machine can use it. It's not the same computer every time, or the same LAN. I need to determine which computer has locked the file while it's locked to figure out why it keeps happening.
If you go to "computer management>system tools>shared folders>open files>" you can see the file is open and by what user account. However, since all workstations on the LAN are using the same log on account, this information doesn't help me. Since all workstations are maintaining an active connection to the server, netstat probably can't help either.
The file being locked is a very small text file.
Does anyone have any suggestions?
Software/Hardware used:
Software/Hardware used:
ASKED:
June 29, 2005 12:31 PM
UPDATED:
June 30, 2005 9:07 AM
Answer Wiki:
Try turning on the Object Auditing on the server and specifically audit access to that file. This should provide more information than the usersname.
To see all answers submitted to the Answer Wiki: View Answer History.
Hi:
Instead if going to Open Files try using Sessions instead. This should give you the IP address and if you want the Computer Name you can use nslookup.
That should do it.
RWJ
additional note, since all workstations maintain an active connection, every machine will have a session listed in computer management. I do not see a way to browse into each open session. Did I miss something?
Look at Group Police
JH
Look at Group Policy on all computers
You may not have a computer with the file open at all. Check to see if a temp file is at the root where the file is stored. Temp files will display with the ~$ at the front of the file name. I have seen where documents (especially word docs) that are not closed properly on network shares will leave the temp remnant on the share, and the result when somebody tries to open the file is a file open/share warning.The file will only be available as read only, sometimes not at all.Make sure the person listed as having the file open is not using the file and delete the temp file.