0

I am testing out a powershell script that runs several commands on remote servers. One of the commands is net session. When I was running the command a on a test server an unusual connection/session was listed. After some investigation I could not determine why this specific connection/session was appearing and nothing else.

This made me think what exactly defines a connection or session according to net session.

The definition as far as I can tell is: The net session command is used to list or disconnect sessions between the computer and others on the network.

Which is pretty vague and any more specific information would be helpful.

7
  • As far as I know, it lists any active SMB connection on the server, e.g., if anyone is connected to C$ or any other share on the server then net session should show the corresponding session. If you're using Powershell to run the command remotely, you should at a minimum see your own session, i.e., the one Powershell opened in order to run the command. It is difficult to be more specific without some idea of what was "unusual" about one of the sessions or what sessions you are expecting to appear that don't. Feb 5 '19 at 0:33
  • @HarryJohnston correct me if I am wrong but doesn't the command net view shows SMB connections? As for what is unusual: When I run the command remotely it shows one user/computer connected to the server the command was run against (it does not show the powershell connection). It is odd because no other machine is connected to the remote server and there is no reason this user/machine should be connected in the first place.
    – FRALEWHALE
    Feb 5 '19 at 13:41
  • The net view command shows available SMB shares, not active connections. Feb 5 '19 at 21:48
  • ... the unexpected connection doesn't happen to be from the same user that installed the system you're using to run remote commands, does it? Feb 5 '19 at 21:52
  • @HarryJohnston No. The user is a random user with a connection from one server to the server we are talking about. I ran the netstat command on the machine and it is a TCP connection on port 445 which indicates it is an SMB share. I reran netstat -nao and the connections are being done by System (PID 4). Still nothing conclusive.
    – FRALEWHALE
    Feb 6 '19 at 15:30
0

Windows has a long-standing bug whereby sessions that were actually disconnected long ago sometimes remain active on the server end indefinitely as a sort of zombie session. This isn't usually a problem unless they are holding files or directories open, in which case they may need to be manually disconnected by the administrator. (They will also be cleaned up if the server is rebooted.)

It is therefore possible that someone opened a connection to the server in question by mistake, e.g., by double-clicking the wrong icon in the Network view, and that session might still be appearing in the sessions list on the server. If, on the other hand, the session reappears after being disconnected, it indicates that the client in question is genuinely connected to the server - that could still be by mistake, of course. You would need to look at the client, not the server, to figure out what is going on there. Note that a connected session isn't necessarily connected to anything in particular, even just running the net view command against a remote server establishes a session in order to enumerate the available shares.

It is unlikely that the information reported by net session is incorrect, but if in doubt, you can log into the server at the console or via Remote Desktop and use Computer Management to examine the connected sessions. You could also cross-reference with the output of the netstat command which shows the underlying network connections, if the session is a zombie it would probably not appear in netstat.

I would have expected net session to also show the connection being used to run the remote command, but this depends on how the remote access is implemented. Since net session only shows SMB sessions, any mechanism that uses TCP/IP directly wouldn't show up. Neither would a system that establishes the SMB session in reverse, from the system where the command is being run to the system that requested it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.