0

Few days ago I was trying to access a shared folder via SMB on Windows File Explorer and noticed 3 strange mobile phone devices appear listed in the network drive. I never owned any of the mobile devices that listed in the drive

Being the only person using my home wifi network nobody accesses my network resources

The Phone listed in the screenshot is the suspicious device that had me wonder how is it in the network enter image description here

My question is How would you investigate if noticed unauthorized devices (mobile phones or laptops) appear in your windows 10 network drive ?

closed as off-topic by vidarlo, schroeder May 6 at 21:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You have not described a compromised SMB. Did you intend to? – schroeder May 6 at 15:27
  • Where did you see these devices? – schroeder May 6 at 15:28
  • I saw them appear on the windows file explorer as i was browsing the network resources like when you try to access a shared printer or shared folder via SMB on the windows file explorer thats where the 3 unauthorized devices appeared. – Saeed AK May 6 at 15:30
  • 2
    I'm flagging this question as "too broad", as it doesn't actually define one question. It's a description of a situation, with the general undertone of "What should I do now?". The problem is that none of us can say for sure. – MechMK1 May 6 at 15:33
  • 1
    @vidarlo i attached a screenshot, tried my best to explain the situation this is what i was seeing on windows file explorer. – Saeed AK May 6 at 23:52
0

The first thing, in any network, is to check the access logs. What connected to those shares? From there, you gather as much information as you can on the devices/users connecting. That's how you investigate.

Monitoring wifi for unauthorised devices is usually done on the WiFi AP. But it is usually better to have the strongest encryption and a strong passphrase to join the network.

  • I resolved it , but still appreciate your reply, it turned out to be a Windows 10 feature called Windows Connect Now. – Saeed AK May 6 at 16:42
0

It turned out this was a Windows 10 feature called Windows Connect Now (WCN). I resolved it by disabling the service of Windows Connect Now and no longer see random / unauthorized devices appear in the Windows Network in ‘File Explorer’.

source https://appuals.com/fix-unknown-strange-devices-showing-network/

Not the answer you're looking for? Browse other questions tagged or ask your own question.