1

I have a server where is shared folder e.g. shared_folder. Another server in the same domain is sending files into this folder (it is probably a scheduled task)

unknown_server -> copy files -> my_server/shared_folder

How to find the unknown_server if I'm not sure when the replication runs (if I knew it, I could see the session in computer management)?

gaffcz
  • 145
  • 1
  • 8

1 Answers1

3

If you open computer management (right click on 'my computer', choose manage) then expand Shared Folders, then sessions, you can see the sessions open on that server. It should show either the name or IP address of the connected system, and the username it is using to connect.

Rob Moir
  • 31,884
  • 6
  • 58
  • 89
  • Yes, I know (see the last sentence of my question in parentheses). But there's no history and that's why I'm asking - i don't know WHEN the replication runs – gaffcz Jan 20 '14 at 10:47
  • 1
    to be fair, your question could be clearer on the subject of wanting history. But moving on, your answer may be to turn on NTFS security auditing for changes to that area and see what gets logged. – Rob Moir Jan 20 '14 at 12:36
  • Yes, first I've been looking for on the net was 'session history' and found auditing. But I thought it isn't possible to audit sessions. So I have to explore that a bit more... but thank you! – gaffcz Jan 20 '14 at 19:24
  • You perhaps can't audit sessions per se, but you can certainly audit the file system and see the 'who what and when' of any changes to that. – Rob Moir Jan 20 '14 at 20:03