This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 70%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EY%3C/text%3E%3C/svg%3E)
On a Domain Controller what does sessions under shared folder indicate?
Under User I can computername$(covered with red) & user id's(covered with blue)
Does it mean these computername$ & user id are authenticating via this DC or does it mean something else ?
Do note that "open files" is "0" for any of the users.
I'm doubtful about that coz when I login to a member server, run "set l" or "nltest /dsgetdc:domain name" & then login the DC which it is showing. It doesn't list the memberservername or my user id under sessions
So what exactly is this ? Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Most likely is a connection at some point to this server's sysvol /netlogon shares. Looks like they can come and go quite quickly depending on what the client computer is doing.
--please don't forget to upvote and Accept as answer if the reply is helpful--
But you see the sessions from 6 days 2 days as well, why such long sessions?
Does this session mean the mentioned user id are authenticating via this DC?
Also what is the diff when it shows computername$ and actual Userid in diff cases?
The open shared folder is in a SMB session, the default timeout for SMB session is 15 minutes. If the SMB session is inactive for 15 minutes the server will send a TCP reset to close the SMB connection. Until the Autodisconnect timer is reached, the server will send an NBT keep-alive packet every two minutes. In this case either the default may have been changed or something strange going on client-side.
https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/mapped-drive-connection-to-network-share-lost#method-1-using-registry-editor
--please don't forget to upvote and Accept as answer if the reply is helpful--
Does this session mean the mentioned user id are authenticating via this DC?
Also I've already moved all the subnets which were earlier mapped to this DC in Sites& Services to a different Site with different set of DC's. Should I still be seeing these sessions on previously mapped DC?
What problem are you trying to solve? It may be the wrong rabbit hole. nltest or %logonserver% may be more appropriate.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 28.999999999999996%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVW%3C/text%3E%3C/svg%3E)
Hi，
》》Does this session mean the mentioned user id are authenticating via this DC?
You can understand what it means
》》Should I still be seeing these sessions on previously mapped DC?
You can see these sessions on the mapped DC
Hope this information can help you
Best wishes
Vicky
Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.
Best Regards,
Vicky
Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.
Best Regards,
Vicky