?List lastwritetime, lastaccesstime and user that last access or modify the foli

Welcome Forums General PowerShell Q&A ?List lastwritetime, lastaccesstime and user that last access or modify the foli

Viewing 2 reply threads
  • Author
    Posts
    • #203553
      Participant
      Topics: 1
      Replies: 0
      Points: 14
      Rank: Member

      Hi. I need to list lastwritetime, lastaccesstime and user that last access or modify the shared folder. I’ve been trying for days to add that to my code with no luck, every column after PropagationFlags are empty.

       

      $computer=Get-Content .\servers.txt
      $OutFile = “.\ShareDrives.csv”

      foreach ($comp in $computer){
      #############################################################################################
      #$currentSize1 = get-childitem $i.Fullname | select @{nAME=”MBytes”;EXPRESSION={ “{0:N0}” -f ($_.Length / 1MB)}}
      #$currentSize2 = $currentSize1.MBytes
      #$shortModified = $path.lastwritetime.ToString(“yyyy/MM/dd”)
      #$shortAccessed = $path.lastaccesstime.ToString(“yyyy/MM/dd”)
      #############################################################################################
      $shares=Get-WmiObject -Class win32_share -ComputerName $comp | Where-Object {(@(‘Remote Admin’,’Default share’,’Remote IPC’,’Default sharing’,’Remote IPC’,’Remote management’) -and ($_.LastWriteTime -lt (Get-Date).AddMonths(-1) ) )}
      $paths=$shares | Select path,Name,LastWriteTime

      foreach($path in $paths) {
      $fpath = $path.path.Replace(‘:\’,’$\’)
      $SName = $path.name
      $fCreationTime = $path.LastWriteTime
      $RootPath = “\\” + $comp + “\” + $fpath

      Get-childitem $RootPath -Recurse -Depth 2| where{$_.psiscontainer} |

      Get-Acl | % {
      $path = $_.Path
      $_.Access | % {
      New-Object PSObject -Property @{
      Directory = $path.Replace(“Microsoft.PowerShell.Core\FileSystem::”,””)
      Access = $_.FileSystemRights
      User = $_.IdentityReference
      Control = $_.AccessControlType
      Device = $comp
      SName = $SName
      IsInherited = $_.IsInherited
      PropagationFlags = $_.PropagationFlags
      Description = $AccessMask
      Description2 = $_.Description
      InstallDate = $AceFlags
      Caption = $AceType
      LastUsed = $_.LastWriteTime
      CreateDate = $CreateDate
      Date = $TodayDate
      CreationTime = $fCreationTime

      }
      }
      } | select-object -Property Device, SName, Directory, User, Control, Access, IsInherited, Date, PropagationFlags, Description, InstallDate, Caption, LastUsed, CreateDate, Description2, CreationTime | export-csv $OutFile -force -NoTypeInformation -encoding default -Append
      }
      }

    • #203676
      Participant
      Topics: 2
      Replies: 1013
      Points: 2,093
      Helping Hand
      Rank: Community Hero

      These are two different result request
      All that access time stuff is from this…

      $FilePath = 'D:\temp\FileList.txt'

      Get-ChildItem -Path $FilePath |
      Get-Member |
      Select-Object -Property Name

      # Results
      <# Name ---- ... PSChildName PSDrive PSIsContainer PSParentPath PSPath PSProvider Attributes CreationTime CreationTimeUtc Directory DirectoryName Exists Extension FullName IsReadOnly LastAccessTime LastAccessTimeUtc LastWriteTime LastWriteTimeUtc Length Name ... BaseName VersionInfo #>

      … not this …

      Get-Acl -Path $FilePath |
      Get-Member |
      Select-Object -Property Name

      # Results
      <# Name ---- Access CentralAccessPolicyId CentralAccessPolicyName Group Owner Path Sddl AccessRuleFactory AddAccessRule AddAuditRule AuditRuleFactory Equals GetAccessRules GetAuditRules GetGroup GetHashCode GetOwner GetSecurityDescriptorBinaryForm GetSecurityDescriptorSddlForm GetType ModifyAccessRule ModifyAuditRule PurgeAccessRules PurgeAuditRules RemoveAccessRule RemoveAccessRuleAll RemoveAccessRuleSpecific RemoveAuditRule RemoveAuditRuleAll RemoveAuditRuleSpecific ResetAccessRule SetAccessRule SetAccessRuleProtection SetAuditRule SetAuditRuleProtection SetGroup SetOwner SetSecurityDescriptorBinaryForm SetSecurityDescriptorSddlForm ToString PSChildName PSDrive PSParentPath PSPath PSProvider AccessRightType AccessRuleType AreAccessRulesCanonical AreAccessRulesProtected AreAuditRulesCanonical AreAuditRulesProtected AuditRuleType MSDN AccessToString AuditToString #>

      Unless you explicitly combine these results in an object, you cannot do this…

      <# | select-object -Property Device, SName, Directory, User, Control, Access, IsInherited, Date, PropagationFlags, Description, InstallDate, Caption, LastUsed, CreateDate, Description2, CreationTime #>

      Hence why you are getting something like this…

      'D:\temp\FileList.txt' |
      ForEach{
      Get-ChildItem -Path $PSItem
      Get-Acl -Path $PSItem
      } |
      Select-Object -Property Directory, User, Control,
      Access, IsInherited, Date, PropagationFlags,
      Description, InstallDate, Caption,
      LastUsed, CreateDate, Description2, CreationTime

      # Results
      <# Directory : D:\temp User : Control : Access : IsInherited : Date : PropagationFlags : Description : InstallDate : Caption : LastUsed : CreateDate : Description2 : CreationTime : 31-Jan-20 23:38:22 Directory : User : Control : Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule} IsInherited : Date : PropagationFlags : Description : InstallDate : Caption : LastUsed : CreateDate : Description2 : CreationTime : #>

      … vs this…

      Clear-Host
      'D:\temp\FileList.txt' |
      ForEach{
      $ReportObject = [PSCustomObject]@{
      FileObject = (
      Get-ChildItem -Path $PSItem |
      Select-Object -Property '*'
      )
      AccessObject = (
      Get-Acl -Path $PSitem |
      Select-Object -Property '*'
      )
      }
      }

      $ReportObject.FileObject
      <# PSPath : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileList.txt PSParentPath : Microsoft.PowerShell.Core\FileSystem::D:\temp PSChildName : FileList.txt PSDrive : D PSProvider : Microsoft.PowerShell.Core\FileSystem PSIsContainer : False Mode : -a---- VersionInfo : File: D:\temp\FileList.txt InternalName: OriginalFilename: FileVersion: FileDescription: Product: ProductVersion: Debug: False Patched: False PreRelease: False PrivateBuild: False SpecialBuild: False Language: BaseName : FileList Target : {} LinkType : Name : FileList.txt Length : 66 DirectoryName : D:\temp Directory : D:\temp IsReadOnly : False Exists : True FullName : D:\temp\FileList.txt Extension : .txt CreationTime : 31-Jan-20 23:38:22 CreationTimeUtc : 01-Feb-20 07:38:22 LastAccessTime : 01-Feb-20 00:22:46 LastAccessTimeUtc : 01-Feb-20 08:22:46 LastWriteTime : 01-Feb-20 00:22:46 LastWriteTimeUtc : 01-Feb-20 08:22:46 Attributes : Archive #>

      $ReportObject.AccessObject
      <# PSPath : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileLis t.txt PSParentPath : Microsoft.PowerShell.Core\FileSystem::D:\temp PSChildName : FileList.txt PSDrive : D PSProvider : Microsoft.PowerShell.Core\FileSystem CentralAccessPolicyId : CentralAccessPolicyName : Path : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileLis t.txt Owner : BUILTIN\Administrators Group : labpc01\postanote Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule} Sddl : O:BAG:S-1-5-21-3258886415-1034932420-179337933-1002D: (A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1301bf;;;AU)(A;ID ;0x1200a9;;;BU) AccessToString : BUILTIN\Administrators Allow FullControl NT AUTHORITY\SYSTEM Allow FullControl NT AUTHORITY\Authenticated Users Allow Modify, Synchronize BUILTIN\Users Allow ReadAndExecute, Synchronize AuditToString : AccessRightType : System.Security.AccessControl.FileSystemRights AccessRuleType : System.Security.AccessControl.FileSystemAccessRule AuditRuleType : System.Security.AccessControl.FileSystemAuditRule AreAccessRulesProtected : False AreAuditRulesProtected : False AreAccessRulesCanonical : True AreAuditRulesCanonical : True #>

      Now, you’ll have to tweak this very rough example I am showing for you to get your final use case result, but I hope the points here are clear.

      • This reply was modified 4 months, 2 weeks ago by postanote.
      • This reply was modified 4 months, 2 weeks ago by postanote.
    • #203685
      Participant
      Topics: 2
      Replies: 1013
      Points: 2,093
      Helping Hand
      Rank: Community Hero

      These are two different result request
      All that access time stuff is from this…

      $FilePath = 'D:\temp\FileList.txt'

      Get-ChildItem -Path $FilePath |
      Get-Member |
      Select-Object -Property Name

      # Results
      <#
      Name
      ----
      ...
      PSChildName
      PSDrive
      PSIsContainer
      PSParentPath
      PSPath
      PSProvider
      Attributes
      CreationTime
      CreationTimeUtc
      Directory
      DirectoryName
      Exists
      Extension
      FullName
      IsReadOnly
      LastAccessTime
      LastAccessTimeUtc
      LastWriteTime
      LastWriteTimeUtc
      Length
      Name
      ...
      BaseName
      VersionInfo
      #>

      … not this …

       

      Get-Acl -Path $FilePath |
      Get-Member |
      Select-Object -Property Name

      # Results
      <#
      Name
      ----
      Access
      CentralAccessPolicyId
      CentralAccessPolicyName
      Group
      Owner
      Path
      Sddl
      AccessRuleFactory
      AddAccessRule
      AddAuditRule
      AuditRuleFactory
      Equals
      GetAccessRules
      GetAuditRules
      GetGroup
      GetHashCode
      GetOwner
      GetSecurityDescriptorBinaryForm
      GetSecurityDescriptorSddlForm
      GetType
      ModifyAccessRule
      ModifyAuditRule
      PurgeAccessRules
      PurgeAuditRules
      RemoveAccessRule
      RemoveAccessRuleAll
      RemoveAccessRuleSpecific
      RemoveAuditRule
      RemoveAuditRuleAll
      RemoveAuditRuleSpecific
      ResetAccessRule
      SetAccessRule
      SetAccessRuleProtection
      SetAuditRule
      SetAuditRuleProtection
      SetGroup
      SetOwner
      SetSecurityDescriptorBinaryForm
      SetSecurityDescriptorSddlForm
      ToString
      PSChildName
      PSDrive
      PSParentPath
      PSPath
      PSProvider
      AccessRightType
      AccessRuleType
      AreAccessRulesCanonical
      AreAccessRulesProtected
      AreAuditRulesCanonical
      AreAuditRulesProtected
      AuditRuleType
      MSDN
      AccessToString
      AuditToString
      #>

      Unless you explicitly combine these results in an object, you cannot do this…

      <#
      | select-object -Property Device, SName, Directory,
      User, Control, Access, IsInherited, Date, PropagationFlags,
      Description, InstallDate, Caption, LastUsed, CreateDate,
      Description2, CreationTime
      #>

       

      Which is why you are most likely getting this…

      'D:\temp\FileList.txt' |
      ForEach{
      Get-ChildItem -Path $PSItem
      Get-Acl -Path $PSItem
      } |
      Select-Object -Property Directory, User, Control,
      Access, IsInherited, Date, PropagationFlags,
      Description, InstallDate, Caption,
      LastUsed, CreateDate, Description2, CreationTime

      # Results
      <#
      Directory : D:\temp
      User :
      Control :
      Access :
      IsInherited :
      Date :
      PropagationFlags :
      Description :
      InstallDate :
      Caption :
      LastUsed :
      CreateDate :
      Description2 :
      CreationTime : 31-Jan-20 23:38:22

      Directory :
      User :
      Control :
      Access : {System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule}
      IsInherited :
      Date :
      PropagationFlags :
      Description :
      InstallDate :
      Caption :
      LastUsed :
      CreateDate :
      Description2 :
      CreationTime :

      #>

      Vs this…

      Clear-Host
      'D:\temp\FileList.txt' |
      ForEach{
      $ReportObject = [PSCustomObject]@{
      FileObject = (
      Get-ChildItem -Path $PSItem |
      Select-Object -Property '*'
      )
      AccessObject = (
      Get-Acl -Path $PSitem |
      Select-Object -Property '*'
      )
      }
      }

      $ReportObject.FileObject
      <#
      PSPath : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileList.txt
      PSParentPath : Microsoft.PowerShell.Core\FileSystem::D:\temp
      PSChildName : FileList.txt
      PSDrive : D
      PSProvider : Microsoft.PowerShell.Core\FileSystem
      PSIsContainer : False
      Mode : -a----
      VersionInfo : File: D:\temp\FileList.txt
      InternalName:
      OriginalFilename:
      FileVersion:
      FileDescription:
      Product:
      ProductVersion:
      Debug: False
      Patched: False
      PreRelease: False
      PrivateBuild: False
      SpecialBuild: False
      Language:

      BaseName : FileList
      Target : {}
      LinkType :
      Name : FileList.txt
      Length : 66
      DirectoryName : D:\temp
      Directory : D:\temp
      IsReadOnly : False
      Exists : True
      FullName : D:\temp\FileList.txt
      Extension : .txt
      CreationTime : 31-Jan-20 23:38:22
      CreationTimeUtc : 01-Feb-20 07:38:22
      LastAccessTime : 01-Feb-20 00:22:46
      LastAccessTimeUtc : 01-Feb-20 08:22:46
      LastWriteTime : 01-Feb-20 00:22:46
      LastWriteTimeUtc : 01-Feb-20 08:22:46
      Attributes : Archive
      #>

      $ReportObject.AccessObject
      <#
      PSPath : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileLis
      t.txt
      PSParentPath : Microsoft.PowerShell.Core\FileSystem::D:\temp
      PSChildName : FileList.txt
      PSDrive : D
      PSProvider : Microsoft.PowerShell.Core\FileSystem
      CentralAccessPolicyId :
      CentralAccessPolicyName :
      Path : Microsoft.PowerShell.Core\FileSystem::D:\temp\FileLis
      t.txt
      Owner : BUILTIN\Administrators
      Group : Lab01\postanote
      Access : {System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule}
      Sddl : O:BAG:S-1-5-21-3258886415-1034932420-179337933-1002D:
      (A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1301bf;;;AU)(A;ID
      ;0x1200a9;;;BU)
      AccessToString : BUILTIN\Administrators Allow FullControl
      NT AUTHORITY\SYSTEM Allow FullControl
      NT AUTHORITY\Authenticated Users Allow Modify,
      Synchronize
      BUILTIN\Users Allow ReadAndExecute, Synchronize
      AuditToString :
      AccessRightType : System.Security.AccessControl.FileSystemRights
      AccessRuleType : System.Security.AccessControl.FileSystemAccessRule
      AuditRuleType : System.Security.AccessControl.FileSystemAuditRule
      AreAccessRulesProtected : False
      AreAuditRulesProtected : False
      AreAccessRulesCanonical : True
      AreAuditRulesCanonical : True
      #>

      Of course, you’ll need to take what I show here and tweak it to meet your end result needs.
      For example, directly combining the results of both commands.

      Clear-Host
      'D:\temp\FileList.txt' |
      ForEach{
      $FileObject = Get-ChildItem -Path $PSItem |
      Select-Object -Property '*'
      $AccessObject = Get-Acl -Path $PSItem |
      Select-Object -Property '*'

      [PSCustomObject]@{
      Directory = $FileObject.Directory
      User = $AccessObject.Group
      Access = $AccessObject.Access
      Description = $FileObject.VersionINfo.FileDescription
      CreationTime = $FileObject.CreationTime
      CreationTimeUtc = $FileObject.CreationTimeUtc
      LastAccessTime = $FileObject.LastAccessTime
      LastAccessTimeUtc = $FileObject.LastAccessTimeUtc
      LastWriteTime = $FileObject.LastWriteTime
      LastWriteTimeUtc = $FileObject.LastWriteTimeUtc
      }
      }

      # Results
      <#
      Directory : D:\temp
      User : Lab01\postanote
      Access : {System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule,
      System.Security.AccessControl.FileSystemAccessRule}
      Description :
      CreationTime : 31-Jan-20 23:38:22
      CreationTimeUtc : 01-Feb-20 07:38:22
      LastAccessTime : 01-Feb-20 00:22:46
      LastAccessTimeUtc : 01-Feb-20 08:22:46
      LastWriteTime : 01-Feb-20 00:22:46
      LastWriteTimeUtc : 01-Feb-20 08:22:46
      #>

      The last point is, as you can see above, you are calling a lot of properties that are not in the commands you are passing in. Assuming you are showing all your code for this use case here.

      • This reply was modified 4 months, 2 weeks ago by postanote.
      • This reply was modified 4 months, 2 weeks ago by postanote.
      • This reply was modified 4 months, 2 weeks ago by postanote.
      • This reply was modified 4 months, 2 weeks ago by postanote.
Viewing 2 reply threads
  • The topic ‘?List lastwritetime, lastaccesstime and user that last access or modify the foli’ is closed to new replies.