Who's Accessing Your Network Shares?

I let users on my office network share files on my computer, and I'm always curious about who uses the shares I publish. The shares usually contain patches and bug fixes I've downloaded from various vendors to fix problems or security holes in the software we use. After I download the files, I send an email letting company employees know where to find the fix and asking them run the appropriate applications as necessary.

Sometimes I want to install a downloaded fix on every machine in the company, and, because most of our users are very technically savvy, I let them install the patches themselves rather than send an IT person to every machine. To make sure that everyone installs the patch, I run a utility on my computer that lets me see who has connected to the share and what files they accessed.

The utility I use to track share activity is TamoSoft's Essential NetTools, although this type of monitoring isn't the product's primary use. Essential NetTools is a package of standard networking tools with an easy-to-use interface that resides in my System Tray. The package has a GUI version of many of the network analysis tools I regularly use, and I stumbled upon its ability to track access to my machine when I realized that I could log the information the application provides about local shares. I just open that log file to see who has connected to my machine and which files they accessed. For my limited needs to track access to local shares, the product does a good job.

Other tools are available that expand the function of tracking share access, both locally and on other machines on your network. If you need detailed tracking of share activity, look at Visualware's VisualLookout. This inexpensive tool gives you a detailed picture of traffic behavior to and from network shares that are visible to you. Shares don't need to be on your machine; the software can track actions on any machine your account can access.

Neither of these tools will explain what's happening on your network, but they'll display information that a knowledgeable user can use to make reasonable assumptions about network behavior. You still need a good understanding of networking and network protocols to derive significant value from these tools, but if you have that level of knowledge, and aren't currently tracking your network share activity, the tools are worth a look.

As a side note, I have good news for system administrators who upgraded to Windows XP and realized that Microsoft failed to include with XP Professional any of the server management tools that come with the Win2K Professional CD-ROM (and who realized that the Win2K Pro tools don't work with their XP installation).

Responding to complaints about the omission, Microsoft rushed out the Windows .NET Server Administration Tools Pack. The tools are still in beta, but Microsoft has promised that the release version of the tools will be available by the end of the year. If you need the Microsoft Management Console (MMC) snap-ins for your XP desktop that will let you manage Win2K servers, you can get the beta here