How do I tell which computer name (or IP) is accessing a specific file on a server?

pts.
Tags:
DHCP
DNS
Help Desk
Networking
Networking services
Tech support
I have a scenario where (on a small LAN) one computer is locking a shared file on a server so no other machine can use it. It's not the same computer every time, or the same LAN. I need to determine which computer has locked the file while it's locked to figure out why it keeps happening. If you go to "computer management>system tools>shared folders>open files>" you can see the file is open and by what user account. However, since all workstations on the LAN are using the same log on account, this information doesn't help me. Since all workstations are maintaining an active connection to the server, netstat probably can't help either. The file being locked is a very small text file. Does anyone have any suggestions?

Answer Wiki

Thanks. We'll let you know when a new response is added.

Try turning on the Object Auditing on the server and specifically audit access to that file. This should provide more information than the usersname.

Discuss This Question: 5  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Rjournitz574
    Hi: Instead if going to Open Files try using Sessions instead. This should give you the IP address and if you want the Computer Name you can use nslookup. That should do it. RWJ
    0 pointsBadges:
    report
  • Gwilks98
    additional note, since all workstations maintain an active connection, every machine will have a session listed in computer management. I do not see a way to browse into each open session. Did I miss something?
    0 pointsBadges:
    report
  • BlueSky53
    Look at Group Police JH
    0 pointsBadges:
    report
  • BlueSky53
    Look at Group Policy on all computers
    0 pointsBadges:
    report
  • Spadasoe
    You may not have a computer with the file open at all. Check to see if a temp file is at the root where the file is stored. Temp files will display with the ~$ at the front of the file name. I have seen where documents (especially word docs) that are not closed properly on network shares will leave the temp remnant on the share, and the result when somebody tries to open the file is a file open/share warning.The file will only be available as read only, sometimes not at all.Make sure the person listed as having the file open is not using the file and delete the temp file.
    5,130 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following