G3m1n1
asked on
Determine the source of a locked file
I am trying to determine which machine has some files locked on a Windows 2003 server. I've tried using Computer Management to compare sessions to open files, but there are so many sessions and open files it's impossible to determine which session has which files open. I've used FileMon, but that only monitors from the time you start the program, which doesn't help me as these files are currently locked but have no activity. So does anyone know of a program, preferably free, that will tell me what files are open and from which machine/IP?
Can't you use "Open Files" in computer management to obtain the user ID that has the files open and then call the person or figure out which machine they are logged onto?
ASKER
Thank you for the comments,
glennbrown2, thanks for the links however none of them do what I need. Unlocker simply unlocks currently open files. IconLockIt is a program to manually lock or unlock files. Opened Files View is very similar to FileMon and just shows what's open plus lots of info except for the machine the lock is coming from.
TheCleaner, unfortunately that won't tell me much as the "user" is actually a service account that runs on many servers that hit the fileserver in question.
glennbrown2, thanks for the links however none of them do what I need. Unlocker simply unlocks currently open files. IconLockIt is a program to manually lock or unlock files. Opened Files View is very similar to FileMon and just shows what's open plus lots of info except for the machine the lock is coming from.
TheCleaner, unfortunately that won't tell me much as the "user" is actually a service account that runs on many servers that hit the fileserver in question.
Try Netwatch from the NT4 reskit. It combines the Open files/users/sessions into one view.
https://www.experts-exchange.com/questions/21903496/List-Clients-Connected-to-a-Share.html
Then you can use process explorer from systernals to find out what process has the file open and kill those handles to the files:
http://www.sysinternals.com/Utilities/ProcessExplorer.html
https://www.experts-exchange.com/questions/21903496/List-Clients-Connected-to-a-Share.html
Then you can use process explorer from systernals to find out what process has the file open and kill those handles to the files:
http://www.sysinternals.com/Utilities/ProcessExplorer.html
ASKER
But that still will not tell me from which machine(s) the open handles originated. Before I kill any open files, I need to first determine the exact machine (by name or IP) that has each file open. Looking at the user will not help me because the same user account runs as a service on multiple machines which all use files stored on a file server.
ASKER
I've since learned that what I want to do is commonplace in Unix, but it seems impossible to do in Windows. So I suppose that this question does not have an answer, other than "not possible". Anyone agree with that?
I'm guessing the ability might be out there, but you'd have to find a 3rd party app that does it, and I'm not aware of one off the top of my head, unless www.scriptlogic.com has something in their arsenal.
Another thought since it is a service account would be that it is probably some networked process, so maybe a netstat -a -n would help?
Another thought since it is a service account would be that it is probably some networked process, so maybe a netstat -a -n would help?
ASKER
I agree, this question has been abandoned. Feel free to close it anytime.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Pber gave the correct answer and should have been awarded the points for this question. Netwatch shows the open files, as well as the user and machine/ip from which they were opened.
http://www.scanwith.com/download/Unlocker.htm
http://www.iconlockit.com/user_interface.htm
http://www.nirsoft.net/utils/opened_files_view.html