Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,532 questions
MsFteWDS open files from Windows 11 connected computers
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 73%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
CWatson2
1
Reputation point
I'm running Windows Server 2012 R2 Recently deployed 4 new Windows 11 Pro laptops which connect to the server for shared file access. Each of the Windows 11 computers are showing \MsFteWds open file connections in Computer Management -> Open Files on the server. This appears to be a new occurrence and does not show up for any of the Windows 10 Pro laptops which have been connecting for years. Why are Windows 11 Pro OS's making this type of open file connection in Write+Read mode? Previous references suggest \MsFteWds is a Named Pipe in the older SMBV1 and SMBV2 incarnations which - to my understanding - have been deprecated with advisories as security risks. What is this? Is it a security risk? Should it be disabled? How should it be disabled?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 40%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELS%3C/text%3E%3C/svg%3E)
Leighton Starwalt 0 Reputation points2024-03-05T14:06:08.9466667+00:00 Hi CWatson2,
I know this is a little old, but I just found something like this on our 2019 servers acting as our file server.
Do you have any instances of the Windows Search services installed on your server?
I ask because this named pipe is used with Windows Search services (which we do have enabled) Please see this PDF [MS-Windows Search Protocol].pdf that covers the Windows Search Protocol. The information pertaining to this pipe can be found in this document at the following locations:
- The last section of page 14: "This protocol has no standards assignments, only private assignments made by Microsoft using allocation procedures specified in other protocols. Microsoft has allocated this protocol a named pipe as specified in [MS-SMB] or [MS-SMB2]. The pipe name is \pipe\MSFTEWDS."
- Section 2.1 on page 15: "All messages MUST be transported using a named pipe, as specified in [MS-SMB] or [MS-SMB2]. The following pipe name is used. For more information, see [PIPE]. ** \pipe\MsFteWds** This protocol uses the underlying server message block (SMB) named pipe protocol to retrieve the identity of the caller that made the connection as specified in [MS-SMB] section 2.2.4.9.1 or [MSSMB2] section 2.2.13 . The client MUST set SECURITY_IMPERSONATION as the ImpersonationLevel in the request to open the named pipe."
- Item #2 in section 4.1 on page 220: "The protocol client establishes a connection with search server UserA-4. The protocol client uses the named pipe \pipe\MsFteWds to connect to the server UserA-4 over SMB."
I hope you find this information useful.
Sign in to comment
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
1 deleted comment
Comments have been turned off. Learn more