Category Archives: Clustering

Viewing open files on a file server from powershell.

/wp-content/uploads/2011/03/windows_powershell_icon.png?w=58&h=58&h=58So this is a situation you should all be aware of in an SBC / VDI environment, despite all warnings, you’ve redirected folders to your network drive and your file servers are screaming in agony?

Having been in this situation recently, I needed to audit and report on the types of files open on the file server, my hunch was a certain select number of users were running applications (like *gulp* lotus notes) from the network share.

Disappointed with the powershell scripts on the interwebs, I decided to write my own function to perform this task:

[sourcecode language=”powershell”]
function get-openfiles{
$collection = @()
foreach ($computer in $computername){
$netfile = [ADSI]"WinNT://$computer/LanmanServer"

$netfile.Invoke("Resources") | foreach {
$collection += New-Object PsObject -Property @{
Id = $_.GetType().InvokeMember("Name", ‘GetProperty’, $null, $_, $null)
itemPath = $_.GetType().InvokeMember("Path", ‘GetProperty’, $null, $_, $null)
UserName = $_.GetType().InvokeMember("User", ‘GetProperty’, $null, $_, $null)
LockCount = $_.GetType().InvokeMember("LockCount", ‘GetProperty’, $null, $_, $null)
Server = $computer
if ($verbose){write-warning $error[0]}
Return $collection

The function above (get-openfiles) has been written to accept an array of servers to the command line and it will return the following items:

  • The ID of the open file.
  • The server it’s open from.
  • The username who has the file open.
  • The amount of locks the file has.

A couple of quick examples for using this command are below:

Retrieving open files from server1:


[sourcecode language=”powershell”]get-openfiles -computername server1 | select server,itempath,lockcount[/sourcecode]

Retrieve a count of open files that end with the nsf file type (Lotus Notes):


[sourcecode language=”powershell”](get-open files -computername server1,server2 | ? {$_.itempath -like "*.nsf*"}).count()[/sourcecode]

Retrieve a report of total open files on a number of file servers:



[sourcecode language=”powershell”]get-openfiles -computername server1,server2,server3,server4,server5 | group -property server[/sourcecode]


The curious case of missing file shares on a Microsoft File Server Cluster.

I had a very unusual issue recently where, after a fail over one of my file cluster resources didn’t publish all shares to the users. Some shares did come up, but many of the shares were missing resulting in users being locked out of their network drives.

I immediately jumped to the registry HKEY_LOCAL_MACHINEClusterResources and found the resource by guid of my misbehaving file cluster. I could see all the shares missing were still published as resources as below:

Upon reviewing the event logs, each time the cluster was failed over, each missing share was logging the following event:

Log Name: System
Source: Microsoft-Windows-FailoverClustering
Date: xx/xx/xxxx 08:00:27
Event ID: 1068
Task Category: File Server Resource
Level: Warning
Cluster file share resource 'File Server FileServer' cannot be brought online. Creation of file share 'Vedeni' (scoped to network name Fileserver) failed due to error '5'. This operation will be automatically retried.

Upon reviewing the share permissions, an over zealous administrator had trimmed the NTFS permissions, removing the local system account. Upon each cluster resource coming online, the cluster uses the local system account to enumerate the shares and present them. Remove this account and your shares wont come online!

This  account doesnt need to be on every folder, just each folder a share is based on. E.g. if you share d:sharefinance as serverfinance, only the finance folder needs access granted to the system account.

To resolve, configure the system account to have access to the folder on “this folder only” then restart the file server resource. The resource will come on-line and your shares will be available again!