SERVER SMB checks

Three read-only PowerShell blocks. Run them on the Windows file server.

These commands inspect configuration only. They do not change passwords, shares, permissions, firewall rules, or files.

1 — Computer, sessions, users and shares

Get-CimInstance Win32_ComputerSystem |
  Select-Object Name,Domain,PartOfDomain,Workgroup

Get-SmbSession |
  Select-Object ClientComputerName,ClientUserName,Dialect,NumOpens

Get-LocalUser |
  Select-Object Name,Enabled,LastLogon,SID

Get-SmbShare |
  Where-Object Special -eq $false |
  Select-Object Name,Path,Description,EncryptData

2 — Members of the local Administrators group

$administrators = Get-LocalGroup |
  Where-Object SID -eq 'S-1-5-32-544'

Get-LocalGroupMember -Group $administrators.Name

3 — Share-level access rules

Get-SmbShare |
  Where-Object Special -eq $false |
  ForEach-Object {
    $shareName = $_.Name

    Get-SmbShareAccess -Name $shareName |
      Select-Object `
        @{Name='Share';Expression={$shareName}},
        AccountName,
        AccessControlType,
        AccessRight
  }