How to find what user accessed \\computerName\Folder?

wireshark

asked 2019-07-11 16:04:54 +0000

SunMan
7 ●3 ●3 ●5

Hello guys,

I am trying to figure out how to find who accessed my share folder if I take traces on destination machine. I can see smb2 with what was accessed on the local server but not who did access.

thanks, SunMan

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2019-07-11 23:59:34 +0000

Spooky

191 ●47 ●7 https://www.wireshark.org

Hi SunMan,

If you captured the session setup, you should be able to see the username used to connect to the share.

I suggest trying the simple display filter smb2.acct

It should display all SMB2 packets where the session ID shows the Account field.

You can even apply this field as a column to help you sort out the information.

Hope that helps.

Cheers,

JFD

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-07-11 16:04:54 +0000

Seen: 507 times

Last updated: Jul 11 '19

How to find what user accessed \\computerName\Folder? edit

1 Answer