Enumerating File Server Resources

This post provides several methods of enumerating sessions, connections and open files on a local or remote machine. Apart from the Powershell script that calls NetFileEnum there's nothing particularly new about this post, but I thought it was worth putting several different methods in one place.

This information is useful for gauging the use of file servers in particular, including the detail of which users are connected and what files they have locked.

Querying information against a single computer:

• Run 'compmgmt.msc /computer=%server%' and look in 'Shared Folders' for Shares, Sessions and 'Open Files'
• Run 'procexp.exe' (Process Explorer - SysInternals) on the machine and view the handles of the server service
• psexec \\%server% net file
• psloggedon \\server
• psexec \\%server% -c handle.exe

Querying against one or more computers:

• for %i in (server1 server2 server3 server4) do wmic /node:"%i" path win32_serverconnection get * /format:csv >> ServerConnections.txt
• for %i in (server1 server2 server3 server4) do wmic /node:"%i" path win32_serversession get * /format:csv >> ServerSessions.txt
• for %i in (server1 server2 server3 server4) do cscript //nologo listOpenFiles.vbs %i >> OpenFiles_%dateflat%.txt
• for %i in (server1 server2 server3 server4) do psexec \\%i net file
  $servers = ("server1", "server2") foreach {. .\EnumOpenFiles.ps1 -s $_} write-host

Closing handles:

• The compmgmt.msc GUI
• The .remove method in the VBS below
• net session \\%client% [/delete]
• net file %id% [/close]
  

' VBScript
On Error Resume Next

If wscript.arguments.count = 1 Then
 strserver = wscript.arguments.unnamed(0)
Else
 wscript.echo "Error, no server name provided"
 wscript.quit(0)
End If

Set objConnection = GetObject("WinNT://" & strServer & "/LanmanServer")
Set colResources = objConnection.Resources

For Each objResource in colResources
    Wscript.Echo objResource.User & "," & objResource.LockCount & "," & objResource.Path & "," & objResource.Name

  ' Remove the session: colResources.Remove(objResource.Name)
Next

-

# PowerShell
# EnumOpenFiles #
#
# 28/07/2008, martinwx, Initial version
#
#
# Description:
#   Call NetFileEnum() to enumerate open files on a file server
#   the computer that a user is connecting from.
#
# Assumptions, this script works on the assumption that:
#   The caller has administrator or server operator rights to the specified machines
#
# Usage
#   Enumerate open files from the specified server:
#   . .\EnumOpenFiles.ps1 -s server
#
# References
# http://msdn.microsoft.com/en-us/library/bb525378(VS.85).aspx
# http://support.microsoft.com/kb/176738

$server = $null

if (($args.count -eq 2) -or ($args.count -eq 4)) {
  for ($i = 0; $i -le $args.count-1; $i+=2) {
    if ($args[$i].ToLower().Contains("-s")) {
      $server = $args[$i+1]
    } elseif ($args[$i].ToLower().Contains("-v")) {
      $verbosePreference = $args[$i+1]
    }
  }
}

$info = ""
if ($server -eq $null) {
    write-output "No server specified, listing local files"
}


$provider = new-object Microsoft.VisualBasic.VBCodeProvider
$params = new-object System.CodeDom.Compiler.CompilerParameters
$params.GenerateInMemory = $True
$refs = "System.dll","Microsoft.VisualBasic.dll"
$params.ReferencedAssemblies.AddRange($refs)

# VB.NET EXAMPLE
$txtCode = @'
Imports System
Imports System.Runtime.InteropServices
Imports System.Net

Class EnumFiles

Const ERROR_SUCCESS As Long = 0
Private Const MAX_PREFERRED_LENGTH As Long = -1

Private Const PERM_FILE_READ = &h1
Private Const PERM_FILE_WRITE = &h2
Private Const PERM_FILE_CREATE = &h4
Private Const ACCESS_EXEC = &h08  '  Execute Permission (X)
Private Const ACCESS_DELETE = &h10  '  Delete Permission (D)
Private Const ACCESS_ATRIB = &h20  '  Change Attribute Permission (A)
Private Const ACCESS_PERM = &h40  '  Change ACL Permission (P)

Private Structure FILE_INFO_3
    public fi3_id As Integer
    public fi3_permissions As Integer
    public fi3_num_locks As Integer
    public fi3_pathname As String
    public fi3_username As String

    'fi3_id  Specifies a DWORD value that contains the identification number assigned to the resource when it is opened.
    'fi3_permissions Specifies a DWORD value that contains the access permissions associated with the opening application. This member can be one or more of the following values.
    'fi3_num_locks  Specifies a DWORD value that contains the number of file locks on the file, device, or pipe.
    'fi3_pathname  Pointer to a string that specifies the path of the opened resource.
    'fi3_username Pointer to a string that specifies which user (on servers that have user-level security) or which computer (on servers that have share-level security) opened the resource. Note that Windows does not support share-level security.

End Structure

Declare Auto Function NetApiBufferFree Lib "netapi32" (ByVal Buffer As Long) As Long

Declare Function NetFileEnum Lib "netapi32.dll" ( _
    ByVal servername As String, _
    ByVal basepath As String, _
    ByVal username As String, _
    ByVal level As Integer, _
    ByRef bufptr As Integer, _
    ByVal prefmaxlen As Integer, _
    ByRef entriesread As Integer, _
    ByRef totalentries As Integer, _
    ByVal resume_handle As Integer) As Integer

Function Main(Optional ByVal servername As String = Nothing) As String()
   Dim result  As Long
   Dim ptr  As IntPtr
   Dim bufptr  As Long  'out buffer
   Dim i  As Integer
   Dim fi3  As FILE_INFO_3
   Dim finfo  As Object
   Dim dwEntriesread As Long  'out
   Dim dwTotalentries As Long  'out
   Dim dwResumehandle As Long  'out
   Dim iPermissions  As Integer
   Dim sPermissions As String = ""

    If servername = "" Then servername = Nothing

    result = NetFileEnum(servername, _
   Nothing, _
   Nothing, _
   3, _
   bufptr, _
   MAX_PREFERRED_LENGTH, _
   dwEntriesRead, _
   dwTotalEntries, _
   Nothing)

    'Console.WriteLine("Entries: " + dwTotalentries.ToString() + ", " + dwEntriesRead.ToString())

    Dim output(dwEntriesRead-1) As String        ' Re-dim the array for the number of results
    if result = 0 then

        ptr = BufPtr          ' Convert long to pointer
        For i = 0 To dwEntriesread -1
     sPermissions = ""
            ptr = BufPtr          ' Convert long to pointer
            fi3 = CType(Marshal.PtrToStructure(ptr, GetType(FILE_INFO_3)),FILE_INFO_3)   ' Marshal this record of the output buffer to the structure
            BufPtr = BufPtr + Marshal.SizeOf(fi3)       ' Increment for the next record

     iPermissions = fi3.fi3_permissions
     If (iPermissions AND PERM_FILE_READ) Then sPermissions = sPermissions + "+Read"
     If (iPermissions AND PERM_FILE_WRITE) Then sPermissions = sPermissions + "+Write"
     If (iPermissions AND PERM_FILE_CREATE) Then sPermissions = sPermissions + "+Create"
     If (iPermissions AND ACCESS_EXEC) Then sPermissions = sPermissions + "+Execute"
     If (iPermissions AND ACCESS_DELETE) Then sPermissions = sPermissions + "+Delete"
     If (iPermissions AND ACCESS_ATRIB) Then sPermissions = sPermissions + "+Attr"
     If (iPermissions AND ACCESS_PERM) Then sPermissions = sPermissions + "+Security"

     If sPermissions.Length > 1 Then sPermissions = sPermissions.Remove(0,1)

            output(i) = serverName + "," + fi3.fi3_id.ToString() + "," + fi3.fi3_pathname + "," + _
                        fi3.fi3_username + "," + fi3.fi3_num_locks.ToString() + "," + sPermissions
        Next
    Else
        Output = Nothing
    End If

    Call NetApiBufferFree(ptr)         ' Free the memory

    return output
End Function

end class

'@


$cr = $provider.CompileAssemblyFromSource($params, $txtCode)
if ($cr.Errors.Count) {
    $codeLines = $txtCode.Split("`n");
    foreach ($ce in $cr.Errors)
    {
        write-output -i "Error: $($codeLines[$($ce.Line - 1)])"
        write-output -i $ce
        #$ce write-output
    }
    Throw "INVALID DATA: Errors encountered while compiling code"
 }
$mAssembly = $cr.CompiledAssembly
$instance = $mAssembly.CreateInstance("EnumFiles")

#write-output "Enumerating open files from $server"
$result = $instance.main($server)    # Call the VB.Net entry point
write-output -i $result

-
References:

IADsResource Property Methods
http://msdn.microsoft.com/en-us/library/aa706125(VS.85).aspx

IADsResource Interface
http://msdn.microsoft.com/en-us/library/aa706124(VS.85).aspx

List Open Sessions and Open Files
http://www.microsoft.com/technet/scriptcenter/resources/qanda/feb05/hey0216.mspx


Wayne's World of IT (WWoIT)