Hi, In regard to this blog: http://blogs.technet.com/b/thenetworker/archive/2007/12/09/of-file-access-from-the-command-prompt-and-trace-analysis.aspx how can I identify an image path or file/process name associated with the SMB process ID [ Process ID: 65279 ]? For example, comparing the sysinternals process monitor and wireshark logs done at the same time, process monitor does not reveal any activity related to that PID. Nor does the Windows task manager. Reading this KB article [ http://support.microsoft.com/kb/935741/en-us ], I see the PID might be related to a kernel level process, Have been unable to find any relevant information here either [ http://msdn.microsoft.com/en-us/library/ee442092%28PROT.10%29.aspx ] Thanks.