Audit map drives on remote machines

rated by 0 users
This post has 7 Replies | 2 Followers

Top 200 Contributor
Posts 12
pmrku Posted: 04-26-2012 12:44 AM

hi there,

i have the need to create a powershell script to list all map drives on remote machines in a particular OU. We are performing a audit of all network shares either created by GPO or manually by users.

Can someone out there assist please.

Many thanks,

 

Ryan

Top 25 Contributor
Posts 287
Top Contributor

$dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

$root = $dom.GetDirectoryEntry()

$search = [System.DirectoryServices.DirectorySearcher]$root

$search.Filter = "(OU=LabComputers)"

$result = $search.FindAll()

$path = [ADSI]$result[0].path

$children = $path.psbase.children

foreach($child in $children){

foreach($drive in (Get-WmiObject win32_systemnetworkconnections -ComputerName $child.name | select -ExpandProperty partcomponent))

{$drive.split(".",4)[1]}}

Replace LabComputers with your OU.

Top 200 Contributor
Posts 12

Hi Felipe,

thankyou for the script, could i trouble you to describe how this script works please.

Many thanks,

Ryan

Top 25 Contributor
Posts 287
Top Contributor

Sure no problem.

The first line creates an object with information about your domain.

The second and third line create a searcher.

The forth sets the filter. (ie which OU to search)

The fifth store the search's result.

The sixth cast it as ADSI resulting in a DirectoryEntry object.

The seventh get all objects in inside that DirectoryEntry object. (ie all computers in the OU passed as filter)

Then we query all those computer names one by one getting in return the network drives for each of them.

The last line is just for readness sake.

Top 200 Contributor
Posts 12

thanks for providing the description. i have tried to run the script but got the following error message:

The only part i changed was the adding in the OU, is there something i have missed?

Get-WmiObject : Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Supply an argument that is not null or empty and then try the comman
d again.
At line:2 char:78
+ foreach($drive in (Get-WmiObject win32_systemnetworkconnections -ComputerName <<<<  $child.name | select -ExpandProperty partcomponent))
    + CategoryInfo          : InvalidData: (:) [Get-WmiObject], ParameterBindingValidationException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetWmiObjectCommand

 

 

Top 25 Contributor
Posts 287
Top Contributor

Is the OU name unique? Is there other OUs inside this OU?

Also if you are using the Computers container you have to change OU= to CN=

Top 200 Contributor
Posts 12

this is an example of the typical structure:

Xyz.com.au
    xyz
       Melbourne
            Disabled Accounts
            Resources
            UsersAndGroups
            Workstations
       Sydney
        Computer Accounts
        Groups
        Resources
        User Accounts

what i am after is to query all computers in the Melbourne OU, and retrieve all the map drives that have been installed on computers in this OU either by the user or by GPO.

Top 25 Contributor
Posts 287
Top Contributor

Hum I see. It's a bit more complicated.

Try this:


Function SearchOU($OU){

$dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

$root = $dom.GetDirectoryEntry()

$search = [System.DirectoryServices.DirectorySearcher]$root

$search.Filter = "(OU=$OU)"

$result = $search.FindAll()

if($result.count -gt 1){
foreach($r in $result){
if($r.path -match $top){$result = $r}
 }
}
Try{
$path = [ADSI]$result[0].path}
Catch{$path = [ADSI]$result.path}

$children = $path.psbase.children

foreach($child in $children){

if($child.objectcategory -like '*organizational*'){

SearchOU($child.name)

}
if($child.objectcategory -like '*person*'){}

else{
if(Test-Connection -ComputerName $child.name -Count 1 -Quiet){
foreach($drive in (Get-WmiObject win32_systemnetworkconnections -ComputerName $child.name | select -ExpandProperty partcomponent))

{$drive.split(".",4)[1]}}
else{Write-Host $child.name "did not respond."}
}

}}

$OU = Read-Host "Type OU name"
$top = $OU
SearchOU($OU)

Do not replace the OU anymore. It will prompt you for it.

Page 1 of 1 (8 items) | RSS
Copyright 2012 PowerShell.com. All rights reserved.