Find users connected to a network share

Solution 1:

There are two ways to go about this that I know if. One is unreliable, but probably good enough for most scenarios. One is extensive, but hard to implement at any scale that exceeds a handful of user connections.

The Kinda-Sorta Way: Select System Tools >> Shared Folders >> Open Files to see what files are open on the file server. From there you can correlate the user accounts that have open files to the shares that they are connected to.

However, that can be insufficient. Don't believe me? Go into Computer Management and select System Tools >> Shared Folders >> Sessions to see who is connected. Then look at the # open files column. Some sessions should have 0 open files. How do you know what share they are technically connected to? I'm glad you asked...

The Extensive but Hard to Scale Way: Perform net share [sharename] on each share in question to get a list of the users that are connected to it. In my testing, even users that have no open file are listed.

You can also utilize the Share and Storage Manager administrative tool in Server 2008 and beyond instead of Computer Management. Find the share in the list of shares, and then in the action pane to the right click "Manage Sessions." You will see a list of sessions including those that have zero open files.

But... but... I want to find a specific user without querying each share! If you have a specific user that you want to track down, it appears that your only means of finding that information is to query each share and eyeball it to find the user you want. And by eyeball I mean piping output to findstr or select-string. One could extrapolate the workflow to a script that enumerates all available shares, queries for connected users, and searches the output for the user in question, but that appears to be an exercise for the reader and not something that Microsoft has included as a native feature.

Solution 2:

This is a very old question, but the accepted answer skipped over one of the best ways to find the info. The GUI can show there are "connected clients" but not show those connections under "open files". In that case it requires using WMI to find who is connected to a share.

Here's the powershell command to see who is connected to a specific share and example output:

Get-WmiObject Win32_ServerConnection -ComputerName SERVER01 | Select-Object ShareName,UserName,ComputerName | Where-Object {$_.ShareName -eq "SHARENAME"}

Example output:

ShareName        UserName        ComputerName
---------        --------        ------------
SHARENAME        user1           10.0.0.20
SHARENAME        user2           10.0.0.30
SHARENAME        user3           10.0.0.40