Solved

Need assistance with a PowerShell script used to find ALL .exe files on the C: drive of multiple computers

Posted on 2011-09-26
17
1,266 Views
Last Modified: 2012-05-12
I would like to use PowerShell or VBScript to find all .exe files on the C: drive of multiple computers then write the path and file to a specified text output file. Only the C: drive and all folders, including the root.

I've started with the following script but it seems to repeat what it found on the first computer for all subsequent computers. Can this be done in PowerShell AND VBScript if it isn't too big a project?

Thanks in advance for your help!!

Below is the PowerShell Script:

# PowerShell script to list specified file types in any folder / any drive

$strComputers = Get-Content -Path "C:\Test\ServerList.txt"
foreach($strComputer in $strComputers)
{
$Dir = get-childitem C:\ -recurse
$List = $Dir | where {$_.extension -eq ".exe"}
# the "- Width 200" statement below can be increased if you have Long Paths
$List |ft fullname -wrap |out-file C:\Test\dircom.txt -Width 200 -append
}


 
0
Comment
Question by:lasthope
  • 6
  • 5
  • 5
  • +1
17 Comments
 
LVL 65

Expert Comment

by:RobSampson
ID: 36598975
Hi, I don't have time to do it at the moment, but the immediate problem I see is that it's only going to search your local computer.  Change this:
$Dir = get-childitem C:\ -recurse

to this
$Dir = get-childitem \\$_\C$\ -recurse

and it should then search the remote C$ share.

I also think VBScript would be too slow....if I were to do it in VBScript, I'd just shell out to the DOS dir command anyway....

Regards,

Rob.
0
 

Author Comment

by:lasthope
ID: 36599029
Gave the suggested change a quick try. Below are the error messages.

Get-ChildItem : The UNC path should be of the form \\server\share.
At C:\TEST\ListFiles(Use This One).ps1:7 char:21
+ $Dir = get-childitem <<<<  \\$_\C$\ -recurse
    + CategoryInfo          : InvalidArgument: (\\\C$\:String) [Get-ChildItem], ArgumentException
    + FullyQualifiedErrorId : ItemExistsArgumentError,Microsoft.PowerShell.Commands.GetChildItemCommand
 
Get-ChildItem : Cannot find path '\\\C$\' because it does not exist.
At C:\TEST\ListFiles(Use This One).ps1:7 char:21
+ $Dir = get-childitem <<<<  \\$_\C$\ -recurse
    + CategoryInfo          : ObjectNotFound: (\\\C$\:String) [Get-ChildItem], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetChildItemCommand
0
 
LVL 35

Expert Comment

by:YZlat
ID: 36599136
you could do something like that in VBScript:

 
On Error Resume Next

'open the file system object
Set FSO = CreateObject("Scripting.FileSystemObject")
set WSHShell = wscript.createObject("wscript.shell")

Set Stream = FSO.OpenTextFile("C:\Test\ServerList.txt")
computers = Split(Stream.ReadAll, vbNewLine)
Stream.Close

OutputFilePath="C:\Test\Output.txt"
Set oReportFile = FSO.CreateTextFile(OutputFilePath, True)

For Each computer In computers
	Set objWMIService = GetObject("winmgmts:\\" & computer & "\root\cimv2")

	Set colFiles = objWMIService. _
    	ExecQuery("Select * From CIM_DataFile Where Extension = 'exe'")

	If colFiles.Count = 0 Then
    		Wscript.Echo "no exe files found"
	Else
		For Each oFile in colFiles
			oReportFile.WriteLine(oFile.FileName)
    		Next
	End If
Next
Set FSO=nothing

Open in new window

0
 
LVL 35

Expert Comment

by:YZlat
ID: 36599187
With PowerShell you can try something like that:

 
$files = get-wmiobject -query "Select * from CIM_DataFile Where Extension = 'exe'" -ComputerName (Get-Content C:\Test\ServerList.txt) 

foreach($file in $files)
{

}

Open in new window

0
 

Author Comment

by:lasthope
ID: 36599209
YZlat - I have a VBscript that will do the list similar to the one you offered here.  Only problem is with the "\root\cimv2" the script finds .exe files on ALL drives.  I only want the specified drive, in this case C:

What can be done to check only a specified hard drive?
 
0
 
LVL 35

Expert Comment

by:YZlat
ID: 36599231
try

$files = get-wmiobject -query "Select * from CIM_DataFile Where Extension = 'exe'" -ComputerName (Get-Content C:\Test\ServerList.txt) 

| out-File "C:\Test\Output.txt"

Open in new window


or

 
$files = get-wmiobject -query "Select * from CIM_DataFile Where Extension = 'exe'" -ComputerName (Get-Content C:\Test\ServerList.txt) 

foreach($file in $files)
{
	$file.name out-File "C:\Test\Output.txt"
}

Open in new window

0
 
LVL 35

Assisted Solution

by:YZlat
YZlat earned 250 total points
ID: 36599280
you can specify Drive and/or Path in this query:

Select * From CIM_DataFile Where Extension = 'exe'

like

Select * From CIM_DataFile Where Extension = 'exe' AND Drive="..."
0
 
LVL 35

Expert Comment

by:YZlat
ID: 36599289

 
On Error Resume Next

'open the file system object
Set FSO = CreateObject("Scripting.FileSystemObject")
set WSHShell = wscript.createObject("wscript.shell")

Set Stream = FSO.OpenTextFile("C:\Test\ServerList.txt")
computers = Split(Stream.ReadAll, vbNewLine)
Stream.Close

OutputFilePath="C:\Test\Output.txt"
Set oReportFile = FSO.CreateTextFile(OutputFilePath, True)

For Each computer In computers
	Set objWMIService = GetObject("winmgmts:\\" & computer & "\root\cimv2")

	Set colFiles = objWMIService. _
    	ExecQuery("Select * From CIM_DataFile Where Extension = 'exe' AND Drive='c:' AND Path='Test'")

	If colFiles.Count = 0 Then
    		Wscript.Echo "no exe files found"
	Else
		For Each oFile in colFiles
			oReportFile.WriteLine(oFile.FileName)
    		Next
	End If
Next
Set FSO=nothing

Open in new window

0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:lasthope
ID: 36599480
YZlat

The PowerShell script works but it again gives ALL drives. I would like to only get results from C:.

The VBScript works but doesn't include the "path" in the output.  Any idea what to change?

I think the VBScript is going to be too slow. I'm testing on 2 machines but I have over 120 to run this report for.  VBScript is great for many things but I think I'll pass here and stick with PowerShell.
0
 
LVL 9

Expert Comment

by:chrismerritt
ID: 36601915
Try this in your PowerShell query:

Get-WmiObject -Query "SELECT * From CIM_DataFile WHERE Name LIKE '%.exe' AND Name LIKE 'C:\\%'"
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 36605215
Here's one option, just a slight change to your original code:
$strComputers = Get-Content -Path "C:\Test\ServerList.txt"
foreach($strComputer in $strComputers)
{
Write-Host "Scanning \\$strComputer\C$\"
$Files = gci "\\$strComputer\C$\" -recurse | Where {$_.extension -eq ".exe"}
$Files | ft fullname -wrap|out-file C:\Test\dircom.txt -Width 200 -append
}

Open in new window


Rob.
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 36606766
IMO, the CIM_DataFile query takes too long, even if you use
And Drive = 'C:'

to restrict the search to local drives.

Rob.
0
 

Author Comment

by:lasthope
ID: 36614518
Sorry ALL.  I will give these a try, but I'm getting, and giving, a moving target.  Now I need to find .exe files on ALL server hard drives and output to the same text file.  One other important thing, the output must include the path to the .exe.

Thanks again and sorry about the moving target.
0
 

Author Comment

by:lasthope
ID: 36615276
Rob - I agree with you that the CIM_Datafile query takes too long.  And I have 120 servers with multiple drives to search.
0
 
LVL 65

Accepted Solution

by:
RobSampson earned 250 total points
ID: 36629631
OK, this should do the job on all logical drives of each server.

Regards,

Rob.
foreach($disk in Get-WmiObject Win32_LogicalDisk -filter "DriveType=3" -computer (Get-Content "C:\Test\ServerList.txt"))
{
	$remotepath = "\\$($disk.SystemName)\$($disk.DeviceID.Replace(':','$'))\"
	Write-Host "Scanning $remotepath"
	$Files = Get-ChildItem "$remotepath" -recurse | Where {$_.extension -eq ".exe"}
	$Files | ft fullname -wrap|out-file C:\Test\dircom.txt -Width 200 -append
}

Open in new window

0
 

Author Closing Comment

by:lasthope
ID: 36711769
Each of these scripts works to the extent of security on our systems. Biggest barrier is no administrative shares, so scripts searching C$, D$ so forth cannot be used. If it were an easy script to change autoshareserver registry key to 1 and back to 0 with the rest of the code sandwiched inbetween this may have been a whole lot easier on me, and possibly faster to complete. As it is it was a long excercise, but the results appear to be accurate.

Thank you for your expert assistance.
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 36713610
We didn't know you had admin shares disabled.....in that case WMI is your only option.  One option though, if WMI does work, is that you could use WMI to *create* a share on the root of the drive, then do the search, and remove the share, but you seem to have moved on anyway.

Glad we could help.

Rob.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now