Solved

vbscript - list all shares, export to spreadsheet, don't include default shares

Posted on 2016-08-04
8
34 Views
Last Modified: 2016-08-08
I'm trying to write a script that will list all shares on all drives
Then ignore the default shares:  $ADMIN, Apps$, C$, IPC$, Sys$ and only report (send email and dump to spreadsheet) the shares other than this.
Also trying to have this run locally on each computer and send email only when computer is detected to be authenticated to the domain it's on.  

Here is what I have so far, any help is appreciated.




Dim sSysDrive : sSysDrive = CreateObject( "Scripting.FileSystemObject" ) _
      .GetDriveName(  _
          CreateObject( "WScript.Shell" ).Environment( "PROCESS" )( "SYSTEMROOT" ) )
Dim strComputer : strComputer = "."
Dim objWMIService : Set objWMIService = GetObject( "winmgmts:" _
      & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2" )

Dim colDisks
  Set colDisks = objWMIService.ExecQuery("Select * from Win32_LogicalDisk")

Dim drives : drives = ""
Dim objDisk
  For Each objDisk in colDisks
      wscript.echo objdisk.drivetype &" "&objDisk.DeviceID

      If objDisk.DriveType = 3 And objDisk.DeviceID <> sSysDrive Then
         If drives > "" Then
            drives = drives & ";"
         End If
         drives = drives & objDisk.DeviceID & "\"
      End if
  Next
Set colShares = objWMIService.ExecQuery("Select * from Win32_Share")

For each objShare in colShares
' Wscript.Echo "Allow Maximum: " & objShare.AllowMaximum
' Wscript.Echo "Caption: " & objShare.Caption
' Wscript.Echo "Maximum Allowed: " & objShare.MaximumAllowed
  Wscript.Echo "Name: " & objShare.Name
  Wscript.Echo "Path: " & objShare.Path
' Wscript.Echo "Type: " & objShare.Type
Next

WScript.Echo drives
0
Comment
Question by:Rob Shorts
  • 5
  • 3
8 Comments
 
LVL 32

Expert Comment

by:it_saige
Comment Utility
You can use the Type to filter the results so that the Administrative Shares are not retrieved; e.g. -
Dim strComputer, strResult

strComputer = Inputbox("Enter Computer Name","Enter Computer Name")

If Trim(strComputer) = "" Then strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colShares = objWMIService.ExecQuery("SELECT * FROM Win32_Share WHERE NOT Type=2147483648 AND NOT Type=2147483649 AND NOT Type=2147483650 AND NOT Type=2147483651")
For each objShare in colShares
strResult = strResult + "AllowMaximum: " & vbTab & objShare.AllowMaximum & vbcrlf &_
	"Caption: " & vbTab & objShare.Caption & vbcrlf &_
	"MaximumAllowed: " & vbTab & objShare.MaximumAllowed  & vbcrlf &_
	"Name: " & vbTab & objShare.Name & vbcrlf &_
	"Path: " & vbTab & objShare.Path & vbcrlf &_
	"Type: " & vbTab & objShare.Type & vbcrlf & vbcrlf
Next
wscript.echo "Shares on computer: " & strComputer & vbcrlf &vbcrlf & strResult
wscript.echo "Done"

Open in new window

Produces the following results -Capture.JPG
The Type values were retrieved from here: Win32_Share class

-saige-
1
 

Author Comment

by:Rob Shorts
Comment Utility
Thank you.  Any idea how I could get the other shares excluded along with the admin shares? IPC$ and Sys$ for example?
0
 
LVL 32

Expert Comment

by:it_saige
Comment Utility
This is excluding all Administrative shares; namely:

  • Disk Drive Admin (2147483648)
  • Examples - ADMIN$, C$, D$, E$
  • Print Queue Admin (2147483649)
  • Device Admin (2147483650)
  • IPC Admin (2147483651)
  • Examples - IPC$

-saige-
0
 

Author Comment

by:Rob Shorts
Comment Utility
Yes, it excludes Administrative shares, but to recognize other shares I would need different method correct?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 32

Accepted Solution

by:
it_saige earned 500 total points
Comment Utility
In that case you could use a combination of UBound and Filter in conjunction with an array of exclusions and check against the sharename; e.g. -

My current output with the above script -Capture.JPGNow I want to exclude print$, CSDemo and for grins I will add sys$:
Dim strComputer, strResult
Dim exclusions

strComputer = Inputbox("Enter Computer Name","Enter Computer Name")

If Trim(strComputer) = "" Then strComputer = "."
exclusions = Array("print$", "csdemo", "sys$")

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colShares = objWMIService.ExecQuery("SELECT * FROM Win32_Share WHERE NOT Type=2147483648 AND NOT Type=2147483649 AND NOT Type=2147483650 AND NOT Type=2147483651")
Set objExcel = CreateObject("Excel.Application")
objExcel.Workbooks.Add

For each objShare in colShares
	If UBound(Filter(exclusions, objShare.Name, True, 1)) < 0 Then
		strResult = strResult + "AllowMaximum: " & vbTab & objShare.AllowMaximum & vbcrlf &_
			"Caption: " & vbTab & objShare.Caption & vbcrlf &_
			"MaximumAllowed: " & vbTab & objShare.MaximumAllowed  & vbcrlf &_
			"Name: " & vbTab & objShare.Name & vbcrlf &_
			"Path: " & vbTab & objShare.Path & vbcrlf &_
			"Type: " & vbTab & objShare.Type & vbcrlf & vbcrlf
	End If
Next
wscript.echo "Shares on computer: " & strComputer & vbcrlf & vbcrlf & strResult
wscript.echo "Done"

Open in new window

I now get the following output -Capture.JPG-saige-
1
 

Author Comment

by:Rob Shorts
Comment Utility
Thank you so much, exactly what I was looking to do!
0
 

Author Comment

by:Rob Shorts
Comment Utility
One more question, how would I get the output "Name:" and "Path" to output and send via email?

Thank you
0
 

Author Closing Comment

by:Rob Shorts
Comment Utility
Much appreciated!!!
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Hello again, all.  For those of you that have been following along, you'll know that this is my third article on this topic (though it is not Part III).  This article is sort of remedial, and probably the topic with which I should have started the s…
This script will sweep a range of IP addresses (class c only, 255.255.255.0) and report to a log the version of office installed. What it does: 1.)      Creates log file in the directory the script is run from (if it doesn't already exist) 2.)      Sweep…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now