Monitor Windows Share

Question

I am trying to monitor connections to a windows share using C#, I am pretty sure it’s possible since you can see people connected to you from Windows Console Manager.

While I don't mind a solution using WMI I would prefer some alternate method.

What I mean by connections is when someone opens a share on the PC being monitored or a file in a share.

Answer 1

Both WMI classes and performance counters exist for shares.

With WMI, you can see what sessions are open by share, using WMI associations. This is PowerShell code for a single share ("Docs$"):

$p = (Get-WmiObject -Class Win32_Share -Filter 'Name="Docs$"').__PATH
Get-WmiObject -Query "Associators of {$p} WHERE ResultClass=Win32_ServerConnection" | Format-Table -auto ShareName, UserName,ComputerName,NumberOfFiles

Answer 2

I would suggest using WMI, since it is designed for this very purpose.

Here is an MSDN link on Win32 shares & WMI implementation:

Win32_Share Class - MSDN