How to do a data search on remote pc's - powershell

I have a script:
get-childitem c:\users -include *.mov,*.avi,*.asf,*.flv,*.swf,*.mpg,*.mp3,*.mp4,*.wmv,*.wav,*.jpg,*.tif,*.png,*.gif,*.bmp
-recurse > collection.txt
This works great when collecting on a local computer. However, I need to run the same thing on several computers at once. So I tried this in a BAT file:
PSexec #list.txt -u UserID -p Password PowerShell get-childitem c:\users -include *.mov,*.avi,*.asf,*.flv,*.swf,*.mpg,*.mp3,*.mp4,*.wmv,*.wav,*.jpg,*.tif,*.png,*.gif,*.bmp
-recurse > collection.txt 2>&1 pause
This worked on some remote PC's, but I ran into a couple of problems:
1) The collection.txt file contains all the information with no identification of which piece goes with which computer.
2) When running on a single computer, sometimes, it looks like it is running, but never finishes and/or never reports that it has completed or writes to the file.
Is there another way to collect the same data for all users that have logged into the computer? Or, am I just not doing it right

The better approach would be to use PSRemoting rather than PSExec.
$list = "RemoteComputer1","RemoteComputer2"
Invoke-Command -ComputerName $list -ScriptBlock {get-childitem c:\users -include *.mov,*.avi,*.asf,*.flv,*.swf,*.mpg,*.mp3,*.mp4,*.wmv,*.wav,*.jpg,*.tif,*.png,*.gif,*.bmp -recurse} | Out-File .\collection.txt
If you need to use PSExec and a BAT file:
PSexec #list.txt -u UserID -p Password PowerShell -command $env:computername; get-childitem c:\users -include *.mov,*.avi,*.asf,*.flv,*.swf,*.mpg,*.mp3,*.mp4,*.wmv,*.wav,*.jpg,*.tif,*.png,*.gif,*.bmp -recurse 2>&1 > collection.txt

Related

Test-Path Remove-Item issue

I have a powershell script to install a very large application (15gb source media) from a location its been delivered to on the C drive.
At the end of the script, to ensure that the software is installed I perform a test-path of the HKLM Microsoft Windows CurrentVersion Uninstall path for the GUID, and if successful, clear the source media from the C drive.
If (Test-Path("HKLM:pathname")) { Remove-Item $path -force -recurse }
The problem I have is that the above command works via Powershell ISE when run individually. It knows the key exists so should perform Remove-Item. When run as a script, or via a deployment mechanism, it will not remove the folder.
I have even gone further and used:
GCI $Path -Recurse | Remove-Item -force -recurse
... to no avail.
Prior to introducing the Test-Path, I only had the Remove-Item $Path -force -recurse and this worked!!
So despite Test-Path correctly judging, it appears to prevent Remove-Item from doing anything. (I wrote to a log file to check the If routing)
Any thoughts? Sorry for any typos, I did not copy / paste any part of the script.
If you can't delete the key immediately after, that probably means it has a write lock that's been applied by the Test-Path cmdlet.
Try finding out if a lock exist using Sysinternals Handle command and then release it using the handle.exe -c argument, referencing the hexadecimal number.
Make sure the format used in $path matches the format used by handle.exe
$lock = & handle.exe -nobanner -a -p ($PID) ($path)
if (-not ($lock -like '*No matching handles found*')){
& handle.exe -nobanner -p ($PID) -c ($lock[0].split(':')[0].Trim(' ')) -y
}
This will only work if you have the permission to close handles.

Using Where-Object for accessing folders with administrator permission

I would like to scan windows folder to find files that are created in a specific data range and export it to a csv file. Although I have opened a powershell as administrator, I still see some "access denied" messages.
PS C:\Windows> Get-ChildItem . -recurse | Where-Object { $_.CreationTime -ge "07/01/2021" -and $_.CreationTime -le "07/31/2021" } | Export-Csv 'e:\scans.csv'
Get-ChildItem : Access to the path 'C:\Windows\CSC' is denied.
...
How can I fix that?
A known trick is to install the sysInternals suite to use psexec.exe and to run your script in a powershell as System:
psexec.exe -i -s powershell.exe
Then at least C:\windows\CSC is available.

Run all .exe in a folder

I'm playing with malware in a VM and every script I try gets stuck. Basically I need to run every .exe in a folder. Tried batch files using start, powershell, etc. The issue happens when AV moves some file to quarentine, or some process keep running then the script doesn't jump to the next one.
CMD start works but shows popups when doesn't find some file, then you have to keep clicking to jump to the next file.
These works but get stuck after a while:
Get-ChildItem 'C:\Users\LAB\Desktop\test' | ForEach-Object {
>> & $_.FullName
>> }
Same here:
for %%v in ("C:\Users\LAB\Desktop\test\*.exe") do start "" "%%~v"
and here:
for %%i in (C:\Users\LAB\Desktop\test\*.exe) do %%i
You need to provide some form of code to allow us to help you troubleshoot it; this is not a request a script page.
Anyways, you would be looking at something like this:
#Assuming the .exe's are located in C Root.
Get-ChildItem -Path C:\ | Where-Object {$_.Extension -like ".exe"}| Foreach {Start-Process $_.FullName}
#In Ps, we like to filter as far left as possible for faster results.
Get-ChildItem -Path C:\ -File "*.exe" | Foreach {Start-Process $_.FullName}
#Running the commands as jobs so it doesnt wait on any to finish before running the next.
Start-Job { Get-ChildItem -Path C:\ -File "*.exe" | Foreach {Start-Process $_.FullName} }
Start-Sleep 2
Get-Job | Remove-Job
Please refer to the following link: How to ask a question

Powershell command for ReadinessReportCreator.exe

I've got 4,000 shares to go through with the readinessreportcreator, which works when I run it locally, however I put together a command with a foreach loop to read a csv of all the DFS shares, however I need to go deeper into the folder structure, normally I would use the -recurse switch, but that doesn't seem to be working.
The site I got the command from
https://learn.microsoft.com/en-us/deployoffice/use-the-readiness-toolkit-to-assess-application-compatibility-for-office-365-pro
The powershell I have put together is:
$shares = import-csv -path 'C:\temp\dfs.csv'
$shs = ($shares).share
foreach ($sh in $shs)
{
Start-Process -NoNewWindow -FilePath "C:\Program Files (x86)\Microsoft Readiness Toolkit for Office\ReadinessReportCreator.exe" "$sh" Out-File "C:\temp"
write-host "share=" $sh
}
The command the site suggest from a command line is:
ReadinessReportCreator.exe -p c:\officefiles\ -r -output \\server01\finance
I was thinking if I could just use the foreach loop and change c:\officefiles\ with the variable of the share it would run through each folder and subfolder, but it doesn't like the -p, -r or the -output. Porbably because they're not powershell cmdlets, so -p should be -path and -r should be -recurse and -output should be out-file, but onlu out-file is recognised.
Excel file si:
share
\\vmshare\share
\\vm3share\share1
\\vm2share\share2
\\vm2share\share3
Hope this makes sense
Thanks in advance
1)Info from site above:
ReadinessReportCreator.exe -p c:\officefiles\ -r -output \\server01\finance -silent
The following is an example of a command line that you can run to scan a folder, and all its subfolders, and save the results to a network share for the Finance department. This only scans for VBA macros.
2)Can't see structure your csv file, but i have doubt about this rows of code(not sure what in $shs):
$shares = import-csv -path 'C:\temp\dfs.csv'
$shs = ($shares).share
3)When you run command Start-Process you must pass parameters via key -ArgumentList,
-Wait — Wait for the process to be finished before accepting any more inputs.
Start-Process .\DeploymentServer.UI.CommandLine.exe -ArgumentList "register --estNumber $Number --postcode `"$PostCode`" --password $Password" -Wait -NoNewWindow
4)For more about Start-Process enter in cli Get-Help Start-Process -Online

Executing a batch file from local server to multiple remote servers using powershell

I would like execute the below batch file (using PowerShell) from local server which will get results from multiple remote servers and I would like to get those results in C:\temp folder.
#echo off
cd "C:\Program Files\Tivoli\TSM\baclient"
dsmc.exe q mgmtclass > C:\temp\TSMmgmtclass.txt
After that, would like to get those output results using PowerShell script as mentioned below.
Get-Content -Path 'C:\Program Files\tivoli\tsm\baclient\dsmerror.log' | select-object -last 15
The best way to do this is probably using invoke-command, and eliminating the .bat file completely. it would look something like this
$scriptBlock = {
& "C:\Program Files\Tivoli\TSM\baclient\dsmc.exe" q mgmtclass
return $return
}
invoke-command -computername $computernames -scriptblock $scriptBlock | out-file $logfile
In this case $computernames would be an array holding the name of each computer you want to run the command against and $logfile is just the path you want the contents output to.