How to view SMB open file handles

Case



You have an Server Message Block (SMB) file sharing infrastructure hosted in any of the following locations:



- Windows Server based file server

- Azure Files file share

- Sharepoint Online site

You need to be able to view a list of file handles of all files which are open on the server side at any given moment.



This article provides instructions on what is doable and how you can view SMB open file handles in Windows Server, Azure Files and Sharepoint Online.



Solution



Windows Server based file server

Window Server comes with MMC-based tools and Powershell modules which allow you to fully manage all aspects of a Windows file server. One such tool is File Server Resource Manager (FSRM), which can be installed as part of the Remote Server Administration Tools (RSAT) as shown in the example below.





In order to access the open file handles and user sessions of a Windows file server, you need the Computer Management tool (compmgmt.msc) or the individual MMC snap-in for "Shared Folders". This snap-in provides management for the active SMB shares, the open user sessions and the open files to the SMB server, as shown in the example below.





Given that MMC will be gradually phased out, you can alternatively use Windows Admin Center to access the "Files and File Sharing" section, a shown in the example below.





Powershell can also come to rescue with the Get-SmbOpenFile cmdlet.





The Get-SmbOpenFile cmdlet retrieves basic information about the files that are open on behalf of the clients of the Server Message Block (SMB) server, as shown in the example below.





Additional tools which you may want to consider to discover open file handles are the following (Handle and Process Explorer from Microsoft SysInternals):



- https://docs.microsoft.com/en-us/sysinternals/downloads/handle

- https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Azure Files file share

Azure Files is the SMB implementation of the Azure Storage service. Any Azure File share can be accessed as per appropriate access policies and permissions. You can utilize the conventional Windows Server based tools mentioned in the previous section to access the Azure-hosted Azure Files file share. Or alternatively you can use any of the methods below to view the open SMB file handles.



Run the Powershell module Get-AzStorageFileHandle, which is shown below.





Some typical examples of the above cmdlet are shown in the screenshot below.





You can also utilize the Microsoft Graph Rest API to get a list of open file handles in Azure Files. You can send a List Handles request by using the GET HTTP method. Details of the GET message can be found at: https://docs.microsoft.com/en-us/rest/api/storageservices/list-handles. An example GET request would look like the following:



https://myaccount.file.core.windows.net/myshare/mydirectorypath/myfileordirectory?comp=listhandles

You can further experiment with the Graph API using the Graph Explorer available at:



https://developer.microsoft.com/en-us/graph/graph-explorer



Sharepoint Online site

Sharepoint Online is a SaaS service and it hides the implementation of the Sharepoint Server in the back end to a large extent. But even in on-premises Sharepoint Server installations it is not feasible to view the list of open file handles at any given moment. This is not doable by design, since many of the file handles are opened via the Sharepoint Online clients (Onedrive or WebDAV clients) in an asynchronous manner. The only indirect ways to review file activity in Sharepoint Online sites are the following:



- View the file activity history of a Sharepoint Online document library. You can do this by opening the document library. Then open the details pane on the top right (i icon) and browse the activity section , as shown in the example below.



- Review the audit log reports of Microsoft 365 and filter out any events related to Sharepoint Online sites. For this, you need to follow instructions in the following articles:- https://support.microsoft.com/en-us/office/view-audit-log-reports-b37c5869-1b47-4a82-a30d-ea20070fe527

- https://support.microsoft.com/en-us/office/configure-audit-data-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2#ID0EBBH=Modern


https://stefanos.cloud/kb/how-to-view-smb-open-file-handles/

Comments

Post a Comment

Popular posts from this blog

How to perform hardware health checks in Windows

Image
Case You need to perform an overall hardware health check in a Windows machine, running either a Windows client or a Windows Server operating system. This article provides guidance on the steps to carry out to perform hardware health checks in Windows. Solution Carry out the steps below. - Thoroughly check all Windows event logs (Application, System, Security) for any warnings or errors which may be related to issues you are experiencing with your Windows machine. - Check the device management mmc console by running devmgmt.msc. Ensure that you choose to show all hidden devices from the View menu. If you notice any exclamation marks next to any device, you will need to re-install its driver from the respective manufacturer to ensure that there afterwards no warnings in the device management console. - Check the health of all your disks , either HDD or SSD. Follow instructions in the following KB article for steps to follow to check your disk health: https://stefanos.cloud/kb/how-to-ch
Read more

How to resolve Group Policy error codes 8007071a and 800706ba

Image
Case You are running "Group Policy Update" on an OU inside the Group Policy Management Console in Active Directory but you are receiving RPC errors from your servers or domain-joined workstations, as shown in the example below. After a Group Policy Update, you come across Group Policy error codes 8007071a and 800706ba. This means that the local Windows Firewall is not configured properly to allow Group Policy (GPO) traffic. GPO traffic an be either remote GPO update or remote GP Resultant Set of Policy (RSOP) operations. Solution Option 1 Run gpedit.msc and create a new local group policy object which implements the following policies under Local Computer Policy --> Computer Configuration --> Windows Settings --> Security Settings --> Windows Defender Firewall --> Inbound Rules : The full configuration is shown below. After the above local group policies are configured on each domain server and workstation, you can start applying group policy objects to the dom
Read more

FsLogix 2201 Public Preview release

Image
The FsLogix 2201 Public Preview release is now available for download from Microsoft. The change log is as follows: - Fixed issue where the FSLogix Profile Service would crash if it was unable to communicate with the FSLogix Cloud Cache Service. - The OfficeFileCache folder located at %LOCALAPPDATA%MicrosoftOffice16.0OfficeFileCache is now machine specific and encrypted so we now exclude it from FSLogix containers. Office files located outside this folder are not impacted by this update. - Windows Server 2019 version 1809, and newer versions of Windows Server, natively support per-user search indexes and we recommend you leverage that native search index capability. FSLogix Search Indexing is no longer available on those versions of Windows Server. - Windows 10 Enterprise Multi-session and Windows 11 Enterprise Multi-session natively support per-user search indexes and FSLogix Search Indexing is no longer available on those operating systems. - FSLogix now correctly handles cases where
Read more