How to Check SMB Sessions in Windows 11

Learn how to check SMB sessions, connected users, and open network files in Windows 11 using PowerShell.

Knowing how to check SMB sessions in Windows 11 can help you identify which computers and users are currently connected to shared folders on your PC. This is especially useful when troubleshooting network file sharing, investigating unexpected connections, or finding out why a shared file cannot be modified or moved.

Windows uses Server Message Block (SMB) for many network file and folder sharing operations. When another computer connects to an SMB share, Windows can maintain an active SMB session between the client and the computer hosting the shared resources.

Windows 11 includes PowerShell commands that can show active SMB sessions and files that are currently open through those sessions. In this guide, you will learn how to check SMB sessions, identify connected client computers, find connected users, inspect open files, and troubleshoot common SMB connection problems.

What Is an SMB Session?

An SMB session represents an active connection between an SMB client and an SMB server. In a simple home network, your Windows 11 PC can act as an SMB server when it shares folders, while another PC acts as the client when it accesses those folders.

For example, suppose Computer A shares a folder named Projects. Computer B connects to:

\\ComputerA\Projects

When the connection is active, Windows can maintain an SMB session between the two computers.

Checking these sessions can be useful when you need to determine which computers are connected and which user accounts are being used.

Why Check SMB Sessions in Windows 11?

Most home users never need to inspect SMB sessions manually. However, the information can be valuable when diagnosing network sharing problems.

You may want to check SMB sessions when:

• A shared folder is currently being accessed by another computer.
• You need to identify connected client computers.
• A file appears to be locked or in use.
• You want to determine which user is accessing a shared resource.
• You are troubleshooting unexpected network activity.
• You manage several computers that use shared folders.
• You need to identify active SMB connections before changing a share.

Checking sessions can also help you distinguish between a problem with the shared folder configuration and a problem caused by an active connection.

Before Checking SMB Sessions

Make sure the Windows 11 computer you are checking is actually hosting an SMB share. You can review the available shares with PowerShell.

Open Windows Terminal or PowerShell and run:

Get-SmbShare

This displays the SMB shares configured on the computer.

If you recently followed our guide about shared folders, you can also review How to Check Shared Folders in Windows 11 to identify the shares available on the system.

Method 1: Check SMB Sessions with PowerShell

The simplest way to view active SMB sessions is to use the Get-SmbSession cmdlet.

Open PowerShell or Windows Terminal and run:

Get-SmbSession

The command displays information about SMB sessions currently established between the SMB server and associated clients.

Depending on your system, the output can include information such as:

• Session ID
• Client computer name or address
• Client user name
• Number of open files or objects associated with the session

This makes Get-SmbSession a useful first command when investigating active network file-sharing connections.

How to Read Get-SmbSession Results

A typical result may look similar to this:

SessionId       ClientComputerName   ClientUserName       NumOpens
---------       ------------------   --------------       --------
123456789       192.168.1.25         DESKTOP\User1       3
123456790       192.168.1.30         DESKTOP\User2       1

The exact values will be different on every computer.

SessionId identifies the SMB session. You can use it with other SMB commands when you need to investigate a particular connection.

ClientComputerName identifies the client computer associated with the session.

ClientUserName shows the account associated with the SMB connection.

NumOpens indicates the number of opens associated with the session and can help show whether the connection is actively using shared resources.

Method 2: Check SMB Sessions for a Specific Computer

If several computers are connected to your Windows 11 PC, you can filter the results by client computer name.

For example:

Get-SmbSession -ClientComputerName "192.168.1.25"

Replace the address with the client computer you want to investigate.

This can be useful when you already know which computer is accessing the shared folder and want to see its active SMB sessions.

Method 3: Check SMB Sessions for a Specific User

You can also filter SMB sessions by client user name.

For example:

Get-SmbSession -ClientUserName "Computer\User"

Replace Computer\User with the account shown on your system.

This can help when multiple users access shared folders and you need to determine which account has an active SMB connection.

Method 4: Check a Specific SMB Session

If you already know the session ID, you can retrieve information about that particular session.

Get-SmbSession -SessionId 123456789

Replace the example number with the actual session ID from your system.

You can also request more detailed information:

Get-SmbSession -SessionId 123456789 | Select-Object -Property *

This can expose additional information associated with the session, such as the client user, client computer, SMB dialect, idle time, and other session properties available on the system.

What Is an SMB Dialect?

An SMB dialect identifies the version or protocol variant being used by an SMB connection.

Modern Windows systems use newer SMB versions, while older devices may use older protocol implementations. When troubleshooting compatibility problems, session information can sometimes help determine which SMB dialect is involved.

Do not enable legacy SMB protocols simply because an older device fails to connect. First identify the actual compatibility problem and determine whether the device or software can be updated.

How to Check Files Opened Through SMB

Knowing that a computer is connected is useful, but sometimes you need to know which files are actually being accessed.

Windows provides the Get-SmbOpenFile cmdlet for retrieving information about files opened on behalf of SMB clients.

Run:

Get-SmbOpenFile

The results can include information such as:

• File ID
• Session ID
• Local file path
• Share-relative path
• Client computer
• Client user

This can be particularly helpful when a file appears to be in use by another computer.

Check Open Files for a Specific SMB Session

If you have identified a session ID, you can use it to find files associated with that session.

Get-SmbOpenFile -SessionId 123456789

This limits the results to files associated with the specified SMB session.

You can then compare the session information with the client computer and user shown by Get-SmbSession.

Check Open Files from a Specific Computer

You can also filter open files by client computer.

Get-SmbOpenFile -ClientComputerName "192.168.1.25"

This is useful when a particular computer is suspected of keeping a file open.

For example, if a document cannot be renamed because another computer is using it, checking open SMB files can help identify the client associated with that access.

Check Open Files for a Specific User

To investigate files opened by a particular user, use the client user filter:

Get-SmbOpenFile -ClientUserName "Computer\User"

Replace the example account with the account shown in your SMB session information.

How SMB Sessions and Open Files Work Together

The two commands provide different but related information.

Command	Purpose
Get-SmbSession	Shows active SMB sessions between clients and the SMB server.
Get-SmbOpenFile	Shows files currently opened on behalf of SMB clients.
Get-SmbShare	Shows SMB shares configured on the computer.
Get-SmbShareAccess	Shows permissions associated with an SMB share.

Together, these commands can give you a much clearer picture of Windows file sharing.

Check Which User Is Connected to a Shared Folder

Start with:

Get-SmbSession

Look at the ClientUserName column to identify the account associated with each session.

If you need to investigate what that account is accessing, use the corresponding session ID:

Get-SmbOpenFile -SessionId 123456789

This two-step approach is useful when troubleshooting access problems or determining whether another user is actively working with a shared file.

Check Shared Folder Permissions Separately

An active SMB session does not tell you whether the user has the correct permissions for every operation.

For that, check the share permissions:

Get-SmbShareAccess -Name "Projects"

You should also check the permissions on the underlying folder.

(Get-Acl "C:\Projects").Access

This distinction is important because SMB session information tells you about an active connection, while share and NTFS permissions determine what the connected account can do.

For a detailed explanation, see How to Check Shared Folder Permissions in Windows 11.

How to Check SMB Sessions When a File Is Locked

If Windows reports that a file is being used by another person or program, start by checking open SMB files.

1. Open Windows Terminal or PowerShell.
2. Run Get-SmbOpenFile.
3. Find the affected file in the Path or ShareRelativePath information.
4. Record the SessionId.
5. Use Get-SmbSession to identify the associated client and user.

For example:

Get-SmbOpenFile

Then investigate the associated session:

Get-SmbSession -SessionId 123456789

This is safer than immediately forcing a file closed because you can first identify which client is using the resource.

Be Careful When Closing an SMB Open File

Windows also provides a Close-SmbOpenFile cmdlet for forcibly closing a file opened through an SMB server. However, this should be treated as an administrative troubleshooting action rather than a routine step.

Forcing a file closed can interrupt the client using the file. If the client has unsaved changes, closing the connection can potentially cause data loss.

Before closing an open file, identify the client, user, and affected file and determine whether the connection can be closed safely.

Common Reasons SMB Sessions Remain Active

An SMB session can remain active because a client is still using a shared folder, an application has a file open, or a network connection has not yet been released.

Therefore, the presence of an SMB session does not automatically mean that something is wrong.

Instead, investigate:

• Which computer created the session?
• Which user account is associated with it?
• How many opens are associated with the session?
• Which files are open?
• Is the connection expected?
• Is the user still working with the shared resource?

SMB Session Troubleshooting Checklist

If you are investigating unexpected or problematic SMB activity, use this checklist:

1. Run Get-SmbShare to confirm the available shares.
2. Run Get-SmbSession to identify active clients.
3. Check ClientUserName to identify the associated account.
4. Check NumOpens for active resource usage.
5. Run Get-SmbOpenFile to identify files being accessed.
6. Compare the session with the shared folder permissions.
7. Check NTFS permissions on the underlying folder.
8. Verify Network Discovery and File and Printer Sharing when discovery or access fails.
9. Review Windows Firewall settings when network connections are blocked.

Microsoft recommends checking that computers are on the same network and reviewing Network Discovery and File and Printer Sharing when troubleshooting Windows network file sharing.

Check Network Discovery and File Sharing Settings

If an SMB connection cannot be established in the first place, checking sessions will not solve the problem because there may be no active session to inspect.

First verify that the computers can communicate on the network. Then check Network Discovery and File and Printer Sharing.

You can continue with How to Check Network Discovery Settings in Windows 11 and How to Check File and Printer Sharing Settings in Windows 11.

Check Windows Firewall Settings

Windows Firewall can also affect network file-sharing traffic. If the computers are configured correctly but cannot establish the expected connection, review the firewall configuration.

See How to Check Windows 11 Firewall Settings for a separate guide to checking firewall status and related settings.

Check the Network Profile

The network profile can also affect Windows network sharing behavior. For local file sharing, verify that the network configuration is appropriate for the environment.

You can review this setting with How to Check Network Profile in Windows 11.

Useful SMB PowerShell Commands

Command	What It Checks
Get-SmbShare	Available SMB shares.
Get-SmbSession	Active SMB sessions.
Get-SmbOpenFile	Files currently open through SMB.
Get-SmbShareAccess	Permissions assigned to an SMB share.
Get-Acl	File-system permissions on the underlying folder.

Frequently Asked Questions

How do I check SMB sessions in Windows 11?

Open PowerShell or Windows Terminal and run Get-SmbSession. The command displays currently established SMB sessions and information about their client computers and users.

How do I see who is connected to my shared folder?

Run Get-SmbSession on the computer hosting the shared folder. The results can show the client computer and user associated with an active SMB session.

How do I see which files are open through SMB?

Run Get-SmbOpenFile. You can also filter the results by session ID, client computer, or client user.

Can I check SMB sessions without PowerShell?

PowerShell provides the most direct built-in commands for detailed SMB session information. Other Windows tools can help diagnose networking and shared folders, but Get-SmbSession is specifically designed to retrieve SMB session information.

Does an SMB session mean someone is using my files?

Not necessarily. An SMB session means there is an established SMB connection. To determine which files are actively open, use Get-SmbOpenFile.

Can I close an SMB session?

Windows provides administrative SMB commands for managing connections and open files, but forcibly closing active resources should be done carefully because it can interrupt users and potentially cause data loss if applications have unsaved changes.

Related Windows 11 Networking Guides

• How to Check Shared Folders in Windows 11
• How to Check Shared Folder Permissions in Windows 11
• How to Check File and Printer Sharing Settings in Windows 11
• How to Check Network Discovery Settings in Windows 11
• How to Check Network Profile in Windows 11
• How to Check Windows 11 Firewall Settings
• How to Check IP Address in Windows 11
• How to Check Default Gateway in Windows 11

Final Thoughts

Checking SMB sessions in Windows 11 is useful when you need to understand what is happening on a computer that hosts shared folders. The Get-SmbSession command can show active client connections, while Get-SmbOpenFile can help identify files being accessed through those connections.

For a more complete investigation, combine SMB session information with share permissions and NTFS permissions. This gives you a clearer picture of which computer is connected, which account is being used, which files are open, and what access that account has.

These tools are especially useful when troubleshooting locked files, unexpected network connections, and Windows 11 file-sharing problems without relying only on the graphical interface.