Windows Server / File Services, Storage & Backup
Inspect file-server client sessions during a capacity incident
A few clients can create many opens or unusual activity while other users report latency. Summarize actual server sessions before blocking traffic.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-SmbSession | Select-Object SessionId, ClientComputerName, ClientUserName, NumOpens, DialectRead the result
The view identifies current SMB sessions and open counts. Large counts can be normal for an application and are not automatically an abuse indicator.
Resolve and verify
Correlate the busiest sessions with file workload, storage latency and scheduled jobs. Coordinate changes with the affected application or client owner.
Before changing production
Do not disconnect sessions solely because they have many opens; doing so can interrupt legitimate writes.