Sometimes it may be necessary to monitor who is accessing shared data on a computer. There are two basic ways of determining who is accessing what data on a server system. The system maintains a list of active connections that are established when a user maps a drive, accesses data through a UNC share, and also when they login to the system. The easiest way to access this list is through Computer Management|Shared Folders.

Computer management is accessed by right-clicking on My Computer from the Start Menu or within Windows Explorer. From within the Shared Folders section, information is divided into three groups: Shares, Sessions, and Open Files.

The Shares folder displays all current shares on the server. Double-clicking on a share will display its basic properties and share permissions. Administrative shares will not display or allow you to modify permissions. The Sessions folder will display all connections on the system, including locally-logged-on, network, and Terminal Server connections. Active service accounts will also display here, along with ANONYMOUSly labeled users that are accessing the server under the guise of the Guest account. The Open Files folder will display a list of all files currently being accessed on the system. Any session or open file can be terminated by right-clicking on the entry in the console.

Specific file and folder access can be also monitored using Auditing, which, when configured appropriately, can allow you to not only determine when a file is being accessed and by whom, but also when file access is attempted and fails due to permissions or other security measures that may be in place. You can enable auditing for files and folders through group policy or the local security policy.