Как смотреть в Powershell открытые файлы по протоколу SMB и их закрывать

Для просмотра в Powershell открытых файлов через SMB (открытых по сети) мы можем использовать командлет Get-SmbOpenFile. Командлет доступен с версии Windows Server 2012. Эта команда выведет папку, сессии и идентификаторы подключения:

Если мы захотим посмотреть детальную информацию по подключению нужно сделать следующее:

Или аналогично для сессий:

Навигация по посту

Как фильтровать через Powershell файлы открытые по сети

Мы можем получить данные только по определенному свойству. Т.е. это могут быть файлы открытые определенным пользователем, компьютером, с каким-то расширением и т.д. Для того что бы увидеть все свойства объекта нужно сделать следующее:

Все что выделено — это свойство, которое мы можем вывести или отфильтровать по нему. Например я хочу вывести все компьютеры с которых выполнено подключение:

Меня могут не интересовать все компьютеры, а только файлы открытые с определенного адреса:

Таким образом я вывел все сессии, где свойство ClientComputerName заканчивается на 3.1.

Аналогично мы можем найти всех пользователей:

Если нам нужно найти, например, конкретный файл или расширение, то мы можем воспользоваться свойством Path или ShareRelativePath:

Таким образом я нашел все сессии, где открытый файл заканчивается на txt.

Как закрывать сессии открытых файлов в Powershell через Close-SmbOpenFile

Для закрытия сессий есть другой командлет. Мы можем закрыть существующую сессию так:

Среди других ключей, которые мы можем указывать как идентификатор для закрытия могут быть:

• FileId
• SessionId
• ClientComputerName
• ClientUserName
• ScopeName

Частым сценарием может быть закрытие сессии где открыт определенный файл. Я бы это сделал так:

Т.е. в случае выше я закрыл все сессии, где открыт файл содержащий .txt

Выполнение Get-SmbOpenFile на другом сервере

Этот командлет поддерживает удаленное выполнение через сессию CIM. Для того что бы это сделать нужно написать следующее:

Ключ -Credential необходим, если мы используем не привилегированную учетную запись и хотим исполнить команду под другой учеткой.

Мы можем использовать и командлеты PSRemoting — это команды двух типов:

• New-PSSession и Enter-PSSession — для подключения к удаленному компьютеру и работы на нем
• Invoke-Command — выполнение команды на удаленном компьютере

Если вы работаете в домене и являетесь администратором сервера, к которому пытаетесь подключиться, то у вас должны сработать команды:

Если у вас будут какие-то сложности, то стоит прочитать эту статью.

Get-SmbOpenFile для Windows Server 2008

На Windows Server 2008 этого командлета нет, но у нас есть другие способы для просмотра сессий и их закрытия. Так мы увидим все открытые файлы и папки:

Есть аналогичные команды для просмотра файлов и установленных сессий:

Можно посмотреть сессии на другом сервере. В моем случае я смотрю на сервере AD1:

Для закрытия файлов мы можем использовать:

Либо через утилиту Openfiles:

Если нам нужно отфильтровать результат по расширению файла:

Windows 10 File Explorer closes immediately after opening. (Not Crashing)

Replies (6) 

I will be glad to help you with the issue you have with File Explorer.

Did you make any changes to the computer prior to the issue?

What is the anti-virus program on the computer?

The issue could occur if the system files are corrupted.

I suggest you to follow the below methods to troubleshoot with the issue:

Method 1: Perform a sfc scan on the computer to check if there are any corruptions on the computer. System File Checker is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files. Please follow the below link to perform a sfc scan on the computer.

Method 2: Try to perform a DISM commands on the computer. Windows updates and service packs may fail to install if there are corruption errors. For example, an update might not install if a system file is damaged. The DISM or System Update Readiness tool may help you to fix some Windows corruption errors. Please follow the below link to know how to perform DISM in Windows.

Please reply with the results, we are happy to help you further.

1 person found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Looks like my account was suspended for some reason, but anyhow, after some careful observation I noticed that if the default view is set to quick access, the explorer window closes immediately. I’m only guessing as to why, but I’m assuming that the shortcut that quick access is trying to display is somehow invalid in some way and causes explorer to close.

I was able to access explorer without closing by either opening a run prompt or directly typing into the cortana/search box «C:\» and pressing enter. Explorer now opens with it’s focus on the C: drive instead of the quick access listing in the folder tree. Open folder options, and change the «Open File Explorer to:» option to [This PC].

Quick Access is still not working, so if you change your focus to the root folder, explorer will still crash.

22 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Thank you for getting back to us. The issue could occur if the Quick Access settings have been changed. To identify what causing this issue, we need to investigate further. Kindly provide us the information below.

• What was the result after you perform SFC and DISM steps on the previous post?
• What Windows build is currently installed in you PC?

You can also check and download available updates under Windows Update. This might help us isolate the issue.

Get back to us if you need further assistance.

2 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

You may not be able to sign in to your original account (forum profile; Microsoft account) but it was not suspended => https://answers.microsoft.com/en-us/profile/6263a77e-f178-414c-8043-cbd291120a8b#user-profile-tab-activity

Assuming Windows 10 64-bit.

Please answer each of the following [admittedly tedious] diagnostic questions in a correspondingly-numbered list in your very next reply, preferably without quoting this post:

1a. When (approx. date) did you purchase the Win7 computer?

1b. Who manufactured the computer (e.g., Dell; HP; Lenovo; Acer)?

2a. When (exact date, preferably) did you upgrade to Win10?

2b. Was the upgrade to Windows 10 (not Windows 10 Anniversary Update) offered & installed via Windows Update or did you upgrade manually?

3. What is the full name of your currently-installed third-party anti-virus application or security suite — i.e., not Windows Defender! — (if any), and when (approx. date) does your current subscription (if any) expire?

4. What third-party anti-malware applications (i.e., not Windows Defender!) are installed, if any? What third-party firewall, if any?

5. Has a(nother) Norton application or a McAfee application EVER been installed on the computer since you bought it?

6. Have you ever run the Norton Removal Tool and/or the McAfee Consumer Products Removal Tool?

7. What Windows 10 Version & OS Build is currently installed?

• Press & hold the Windows Key and press the R key. In the RUN dialog, type WINVER and press the Enter key.

8. Is Adobe Flash Player version 25.0.0.127 (or higher) installed? TEST HERE USING INTERNET EXPLORER OR EDGE ONLY! => http://www.adobe.com/software/flash/about/

9. Is Firefox version 52.0.2 (or higher) and/or Google Chrome version 57.0.2987.133 (or higher) or any other alternate browser installed?

10. Are you in the habit of using «Registry cleaners» (e.g., CCleaner’s Registry Cleaner component; Registry Mechanic; System Mechanic; RegCure; RegClean Pro; Advanced SystemCare; Total System Care; Advanced System Optimizer; Comodo System Cleaner; Glary Utilities; Registry Booster; McAfee QuickClean; AVG Quick Clean; AVG PC TuneUp; Norton Registry Cleaner; Norton PC Tuneup; PCTools Optimiser; SpeedUpMyPC; FixMyPC; PC Doctor; TuneUp Utilities; WinMaximizer; WinSweeper; Wise Care 365; Wise Cleaner; etc.)?

Robear Dyer (PA Bear)
Microsoft MVP (Windows Client) since October 2002

How to view open files on Windows Server (2008, 2012 & 2016)

There are times when a file is open on a windows server and you need view what user or process has it open. These open files can be locked and prevent users from editing, cause errors when upgrading software, hold up a reboot and so on.

In this article, I will show you how to quickly view open files on windows server and workstations.

Both methods use built in Windows tools and works on most Windows versions (I’ve tested this on Server 2008, 2012, 2016 and Windows 10).

Video Tutorial

If you don’t like videos or want more details then continue reading.

Recommended Tool: SolarWinds Permissions Analyzer

Now you can quickly see WHO has permission to WHAT and answer the questions that suck up your time and patience.

SolarWinds FREE Permission Analyzer will determine a user’s effective NTFS permissions for a specific file, folder or network share access. The results are displayed in a nifty desktop dashboard.

Method 1: Use Computer Management to view shared files/folder

This first method is used to view open files on a shared folder. This is the best way to troubleshoot locked files that users have left open. If you need to see what process has a file open then check out method 2.

Step 1: Right Click the start menu and select Computer Management

Another way to access computer management is to type in compmgmt.msc into the start menu search box.

You will need to open up this console on the computer or server that has the shared folder. For example, I have a server called file1 with a shared folder named HR. To see the open files on this share I will need to open up the computer management console from the file1 server.

Step 2: Click on Shared Folders, then click on open files

I can now see that the user rallen has the HR folder and the file adpro.txt open.

If I needed to I can right click the file and select “Close Open File”. This is something that needs to be done when a file is locked.

That’s it for method 1.

If you need to check who has permissions to a file or folder then check out my guide How to view NTFS effective permissions.

Methods 2: See process and file details with Resource Monitor

Step 1: Type Resource monitor into the start menu search box

This is the quickest way to access the Resource Monitor.

Another option is to open up the task manager, click the performance tab and then click Open Resource Monitor.

Step 2: Click on the disk tab in resource monitor

Now that I have the resource monitor open I just need to click on the disk tab.

Now I can see all kinds of details about the disk activity such as files open, PID, read and write bytes per second and more.

You can move the columns around so you can see the full file path.

If have a lot of disk activity you go stop the live monitoring so you can view the open file activity.

To stop the live monitoring go to monitor, then select stop monitoring.

If you liked this article, then please subscribe to our YouTube Channel for more Active Directory Tutorials.

Recommended Tool: SolarWinds Server & Application Monitor

This utility was designed to Monitor Active Directory and other critical services like DNS & DHCP. It will quickly spot domain controller issues, prevent replication failures, track failed logon attempts and much more.

What I like best about SAM is it’s easy to use dashboard and alerting features. It also has the ability to monitor virtual machines and storage.