File locks: Poor mans auditing on SMB Windows File Servers

Do you need a lightweight solution to get a rough idea of what people are up to on your Windows File Servers?

Try the below.

This will:

• Document all file locks on your Windows File Server
• Export the results as a CSV which can be opened in Excel
• Create a cumulative list, the longer it runs, the more you know

This won't:

• Tell you when files were accessed (e.g. date/time)
• Capture info about files which were accessed but not locked
• Provide a forensic-grade audit trail of what users are doing

If your goal is to add auditing for security compliance, then don't use this script, enable Windows built-in auditing features instead.  However, if your goal is to get a feel for what people are actually using over time while leaving everything else as-is, this is the script for you.

All you need is PowerShell Active Directory Module on a recent Windows Server version.  I wrote this for Windows Server 2016 but in theory this should work on Server 2012 R2 or newer just fine.

## User Editable variables

$domain = "CONTOSO"

$root = "C:\ServerFolders\Security\OpenFiles"

$interval = 10

##

$ErrorActionPreference = "SilentlyContinue"

 

# Infinite loop for simplicity

while(1)

{

    # Get full AD user list

    $userlist = (get-aduser -Filter * | select SamAccountName)

    # Unlock all files to be updated by closing SMB handles

    Get-SmbOpenFile | Where {$_.Path -like "$root\*"} | Close-SmbOpenFile -Force

    # For every user, make an open file list

    foreach($user in $userlist)

    {

        # Process existing data

        $name = ($user.SamAccountName)

        # Initialise empty in case no previous log exists

        $old = ""

        $old = (Import-CSV -Path "$root\$name.csv" -ErrorAction SilentlyContinue)

        $new = (Get-SmbOpenFile -ClientUserName "$domain\$name" | Select-Object ClientComputerName, Path -Unique | Sort-Object)

        # We want to combine the current list and the new list, while only keeping unique records

        $combined = ((@($old) + @($new)) | Select-Object ClientComputerName, Path -Unique)

    

        # Re-export combined new unique value set

        $combined | Export-CSV -Path "$root\$name.csv" -ErrorAction SilentlyContinue

    }

    ## Start sleeping

    Start-Sleep -Seconds $interval

}