Need query to find files written in the last 30 days

Why not simplify your life and look at the computer management shares sessions/shares to see which users have a connection to this share.

your likely have to use powershell to enumerate the files based on recent modify/create date and look at the owner of the files.

But that doesn't tell me is someone has written to the folder and now is not connected.

robocopy.exe can be used for this. For 2003, it's part of the Resource Kit Tools (https://www.microsoft.com/en-us/download/details.aspx?id=17657 (If you don't want to run the install on the server, you can extract the content with 7-zip and just copy robocopy.exe to the machine, or install the ResKit on a test client and copy robocopy to the server).
Since Vista/W2k8, it's part of the OS (so you can run the query remote, if you want to.
The command will not really copy anything, it will just create a list with files with a write stamp in the last 30 days.
Just change "C:\Source" to the folder where you want to start the search; leave the "C:\Dummy", it will not be used.

robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp

Select allOpen in new window

To create a file, just add logging (and /tee, so that the console doesn't look so empty ...):

robocopy.exe "C:\Source" "C:\Dummy" *.* /maxage:30 /L /s /np /r:0 /ndl /njh /njs /nc /ts /fp /tee /log:"C:\Temp\FileAgeReport.txt"

Select allOpen in new window

@lionelmm,

I also was going to recommend FORFILES, but it also won't be pre-installed so they have to get it out of a resource kit.  But more importantly, FORFILES works well for finding files older than a specified number of days, but not newer than, which is what this question needs.  To do that I think you always have to specify the actual date you want to find files newer than, nut the number of days in the past.  Always seemed odd to me the way they use sign on the /d option to me, who would ever want to look for files modified after some date in the future.

~bp

Well Bill you are the expert on these types of things so I won't disagree except that this is an examples they gave, the one I copied, it was for files less than 360 days or earlier, so I just changed it to -30

Okay, perhaps an example will help.  O created a folder with three test files in it and set the last modified dates as follows (one older than 30 days, one older than today but newer than 30 days, and one in the future more than 30 days):

B:\ee>dir b:\ee\forfiles

 Directory of b:\ee\forfiles

08/06/2015  01:18 PM    <DIR>          .
08/06/2015  01:18 PM    <DIR>          ..
10/01/2015  12:00 AM                 2 file3.txt
08/01/2015  12:00 AM                 2 file2.txt
07/01/2015  12:00 AM                 2 file1.txt
               3 File(s)              6 bytes

Select allOpen in new window

Now let's do some tests.  First, lets use the /D with a number of days, and the minus sign.  This should select all files older than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -30 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Select allOpen in new window

Good, that works as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than than the specified number of days forward in the future from today (I know, weird).

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +30 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"

Select allOpen in new window

Okay, that works as documented.  Notice it doesn't find what we need in this question though, which is all files modified more recently than 30 days ago.  

The other option with /D is to specify a date.  First, lets use the /D with a date, and the minus sign.  This should select all files older than the specified date.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d -7/06/2015 /c "cmd /c echo @fdate - @path"

7/1/2015 - "b:\ee\forfiles\file1.txt"

Select allOpen in new window

Good, as expected.  First, lets use the /D with a number of days, and the plus sign.  This should select all files newer than the specified number of days.

B:\ee>forfiles /p b:\ee\forfiles /m *.* /d +7/06/2015 /c "cmd /c echo @fdate - @path"

10/1/2015 - "b:\ee\forfiles\file3.txt"
8/1/2015 - "b:\ee\forfiles\file2.txt"

Select allOpen in new window

Works as expected, and could be used to solve this question.  The only wrinkle is rather than specify the cutoff point in days before today, you have to calculate the exact date of that day.

Make any more sense?

~bp

I'm not really advocating for this one, but if you did want a pure DOS approach without additional EXE files, here is a solution for that.  Adjust the SET lines near the top as needed, and save as a BAT file.

@echo off
setlocal EnableDelayedExpansion

REM Define base for folders, and days to find newer files than
Set BaseDir=c:\temp
set DaysToFind=30

REM Get current date in MM/DD/YYYY format
set Today=
for /f "tokens=* skip=1" %%A in ('wmic os get LocalDateTime') do (
  if not defined LocalDateTime (
    set LocalDateTime=%%A
    set Today=!LocalDateTime:~4,2!/!LocalDateTime:~6,2!/!LocalDateTime:~0,4!
  )
)

REM Convert todays date to julian for age checks
call :jDate jToday %Today%

REM Process all Files in the directory, display if newer than days specified
for /r "%BaseDir%" %%A in ("*.*") do (
  call :jDate jFile %%~tA
  set /A FileAge = !jToday! - !jFile!
  if !FileAge! LEQ %DaysToFind% (
    ECHO File:[%%A] is [!FileAge!] days old.
  )
)

REM Done
exit /b

REM Subroutine to calculate julian date
:jDate return-variable date-string(MM/DD/YYYY) 
  set DateStr=%~2
  set yy=%DateStr:~6,4%
  set /A mm=1%DateStr:~0,2%-100
  set /A dd=1%DateStr:~3,2%-100
  set /a "yy=10000%yy% %%10000,mm=100%mm% %% 100,dd=100%dd% %% 100"
  set /a %~1=dd-32075+1461*(yy+4800+(mm-14)/12)/4+367*(mm-2-(mm-14)/12*12)/12-3*((yy+4900+(mm-14)/12)/100)/4
  exit /b

Select allOpen in new window

~bp