As part of domain consolidation we are trying to decommission a domain and migrate the users to a different domain (same forest). Users in the old abc domain have been accessing shares using \\abc\Files\filename... These dsf links have been copied to the xyz domain with new shares in the form \\xyz\abc\Files\filename... We would like to identify anyone using the old dsf links and have them update their links in shortcuts, documents, whatever before we break the links. I've been trying to use Security Event 5140 but have been unable to identify who is using the old dsf links. Does anyone have a solution to how to find users who will be affected when we delete the old links?