?
Solved

Search containing two wildcards across multiple PCs

Posted on 2012-03-14
4
Medium Priority
?
307 Views
Last Modified: 2012-03-19
Hi,

I'd like to perform the following search query on every running PC in our windows domain and like to have the results aggregated in one file: c:\Users\*\AppData\Local\Temp\*.exe
How can I achieve this using standard tools?

Regards,
Andreas
0
Comment
Question by:braunmiller
4 Comments
 
LVL 16

Accepted Solution

by:
ThinkPaper earned 375 total points
ID: 37726603
if you plan on using "standard tools" without using outside products, the only way I can think of doing this is using a script. Note that either way, this will be very time intensive as it will do a search for ALL machines that you specify.

You can use something of a VBS or powershell script to do the job:

http://www.activexperts.com/activmonitor/windowsmanagement/scripts/storage/filesystems/#SFUWQ.htm
0
 
LVL 8

Expert Comment

by:Brent Challis
ID: 37731797
Can you provide an example of your search query to inicate what information you are after from the computers?
0
 
LVL 15

Assisted Solution

by:qz8dsw
qz8dsw earned 375 total points
ID: 37732007
braunmiller,
ThinkPaper was correct, you can do this via VBS or windows scripting and his link gives good information on checking files.
But you will also beforehand need to enumerate the domain computers, check if they are up and if they are then run the check for exe's.

Checking all machines on a domain makes it difficult, better to have a part of the login script call the script that itterates through looking for c:\Users\*\AppData\Local\Temp\*.exe
Login scripts for the domain should run with admin access and hence have access to all profiles.
Are you just after the script with this question?
0
 

Author Closing Comment

by:braunmiller
ID: 37736585
Thank you all for the answers. We came across a trojan (troj_ransom.vtg) that seems to be inactive but we would like to know where it has spread it's component files. We know some file names and locations in c:\Users\<username>\AppData\Local\ and would have liked to know what clients still contain these files.
We will try the combined solution of using a custom VBS script being executed upon a user's domain login so we can get at least the files in this particular user's c:\Users\... hierarchy.

Best Regards,
Andreas
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension . This reminded me of questions that come up here at EE along the lines of, "How can I tell the type of file from its cont…
Virtualization software lets you run different versions of Windows, Ubuntu Linux and other versions of Linux all at the same time, rather than running each one directly from your computer's hard drive.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question