查看在Windows共享出去的文件，以及谁在哪里打开了什么文件（命令行）

创建用户

# 追加用户
C:\Users\Administrator>net user user01 user01 /add

# 加入远程登录组
C:\Users\Administrator>net localgroup "remote desktop users" user01 /add
The command completed successfully.

C:\Users\Administrator>net localgroup "remote desktop users"
Alias name     remote desktop users
Comment        Members in this group are granted the right to logon remotely

Members

-------------------------------------------------------------------------------
user01
The command completed successfully.

创建文件共享

创建共享文件夹

C:\Users\Administrator>mkdir C:\share
C:\Users\Administrator>cd C:\share

共享文件

C:\share>net share share=C:\share /GRANT:user01,FULL
share was shared successfully.

C:\share>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
C$           C:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\Windows                      Remote Admin
share        C:\share
The command completed successfully.

访问共享文件

使用user01用户访问共享文件

# 路径
\\192.168.50.11\share

查看

openfiles命令

管理员权限打开

C:\share>openfiles

INFO: The system global flag 'maintain objects list' needs
      to be enabled to see local opened files.
      See Openfiles /? for more information.


Files opened remotely via local share points:
---------------------------------------------

ID       Accessed By          Type       Open File (Path\executable)
======== ==================== ========== ====================================
255      user01               Windows    C:\share\
256      user01               Windows    C:\share\
290      user01               Windows    C:\share\dir1
291      user01               Windows    C:\share\dir1

powershell命令

Get-SmbOpenFile可以看到更多信息，包括客户端IP或者主机名等

PS C:\Users\Administrator> Get-SmbOpenFile

FileId      SessionId   Path          ShareRelativePath ClientComputerName ClientUserName
------      ---------   ----          ----------------- ------------------ --------------
51539608573 51539607553 C:\share\                       192.168.50.11      WS2019EN\user01
51539608577 51539607553 C:\share\                       192.168.50.11      WS2019EN\user01
51539608713 51539607553 C:\share\dir1 dir1              192.168.50.11      WS2019EN\user01
51539608717 51539607553 C:\share\dir1 dir1              192.168.50.11      WS2019EN\user01
PS C:\Users\Administrator> Get-SmbOpenFile | Select-Object ShareRelativePath,ClientComputerName,ClientUserName

ShareRelativePath ClientComputerName ClientUserName
----------------- ------------------ --------------
                  192.168.50.11      WS2019EN\user01
                  192.168.50.11      WS2019EN\user01
dir1              192.168.50.11      WS2019EN\user01
dir1              192.168.50.11      WS2019EN\user01

参考

Get-SmbOpenFile

https://docs.microsoft.com/en-us/powershell/module/smbshare/get-smbopenfile?view=windowsserver2022-ps