SMB connections - PDC role holder 1

[applywithforce]

Hi there,

I have installed in my environment monitoring software that is detecting a high amount of SMB connections to our 2003 PDC role holder. The number of connections is 23, is this bad or something I should be concerned about? I am wondering if this is to do with our trusts to other domains?

 

[victorv]

hi,

in Computer Management, under Shared Folders | Sessions
do you see anything: if yes, how many ?

ciao
vittorio

 

[applywithforce]

Thanks for replying so quickly.

I can see 16 sessions, most are workstations and I can see a few DC's - all are in the same domain as the PDC.

Does this mean the workstations/DC's have software trying to make contact to the PDC?

 

[victorv]

hi,
SMB is not a virus, stays for "Server Message Block",
and is the mechanism (protocol) used by Windows to share
Files and Printers.

Unix OS use NFS for file sharing and LPR for printers.

If from Windows computer, you want access Unix Files&Printer
you can install Samba sw on Unix box
(the name Samba comes from SMB) and, after well setting
authentication parameters, you can see the Unix share
("Sambed") in your Windows Network Place.

May be the difference between 23 and 16, printers
or multiple opened files ?

ciao
vittorio

 

[applywithforce]

Thanks for your reply.

I know what SMB is, however, I don't know why these clients are trying to make connections to the PDC - should they be? Is it because they have software trying to do this?

 

[victorv]

hi,
I like joke (virus).

In Sessions you see which clients have opened connections
and you can see also Opened Files.

Have you some command as NET USE.. in your login scripts or
Users, browsing network, can do NET USE from cmd or
Map Network Drive from Explorer

Your DC may have policy to share to clients, however,
in Session\Shares, which are the accessed ones ?

bye
vic

 

[applywithforce]

I am only concerned with one AD account that appears on every DC is the Sessions folder. The account in question is an account that runs software that monitors web activity. I am just wondering if this software has been configured incorrectly and is causing overhead on every DC in our environment. I have DC's all over the world so this would have an impact on replication. What do you think?

 

[victorv]

hi,
is this sw strategical, in the sense, could you
take off it for one day?
You can analyze network activity by Network Monitor
and/or a sniffer,
making comparisons between with/without it.

Also, to begin, just in one DC.

bye

 

[applywithforce]

Thanks for your help victorv, the software had some sort of agent that used all the DC's in our environment. I asked them to configure for local DC use only and that has stopped SMB connections going everywhere!