locked
help with a script RRS feed

  • Question

  • Hello-

    I was tasked with running a script against a list of servers to filter for files on each drive and then locate any files that might have passwords in clear text.  However, the script will either A.) only return results for the local server, or B.) produce no output at all.  Even though the script is running without error, the output folder has nothing in it.

    snippet below - the paths have been masked

    $servers = Get-Content -Path c:\<scriptpath>\servers.txt
    
    foreach ($server in $servers) {
    
    Invoke-Command -ComputerName $server -ScriptBlock{Get-ChildItem c:\,d:\,e:\ -rec -include @("*.ps1","*.txt","*.bat") -Force -erroraction silentlycontinue | select-string '(credentials) | (pscredential) | (password)' } 
    
    Export-Csv C:\<outputfolder>\$server-finder-$(get-date -f MM-dd-yyyy).csv -NoTypeInformation
    
    }

    What I need to have happen - run this script from my computer so that it goes to every server in the list, runs the query to find a matching string, then generates a csv file for EACH server (which is why the $server variable is in the output path) back on my system with the results of what was matched.   The command itself seems to work fine and return the results.....I'm trying to figure out how to give the script a list of servers to go out and do this on its own.  What am I missing here?

    fyi- i do not do much with powershell scripting per se, this is a new challenge for me.


    Monday, June 8, 2020 9:50 PM

Answers

  • If you want to get the output of Invoke-Command piped to Export-Csv you have to use a pipe.
    $servers = Get-Content -Path c:\<scriptpath>\servers.txt
    foreach ($server in $servers) {
        Invoke-Command -ComputerName $server -ScriptBlock { 
            Get-ChildItem c:\, d:\, e:\ -Recurse -Include *.ps1, *.txt, *.bat -Force -ErrorAction SilentlyContinue | 
            Select-String '(credentials) | (pscredential) | (password)' 
        } | Export-Csv C:\<outputfolder>\$server-finder-$(get-date -f MM-dd-yyyy).csv -NoTypeInformation
    }


    Live long and prosper!

    (79,108,97,102|%{[char]$_})-join''

    • Marked as answer by Tim Magnuson Tuesday, June 9, 2020 3:37 PM
    Monday, June 8, 2020 10:59 PM

All replies

  • If you want to get the output of Invoke-Command piped to Export-Csv you have to use a pipe.
    $servers = Get-Content -Path c:\<scriptpath>\servers.txt
    foreach ($server in $servers) {
        Invoke-Command -ComputerName $server -ScriptBlock { 
            Get-ChildItem c:\, d:\, e:\ -Recurse -Include *.ps1, *.txt, *.bat -Force -ErrorAction SilentlyContinue | 
            Select-String '(credentials) | (pscredential) | (password)' 
        } | Export-Csv C:\<outputfolder>\$server-finder-$(get-date -f MM-dd-yyyy).csv -NoTypeInformation
    }


    Live long and prosper!

    (79,108,97,102|%{[char]$_})-join''

    • Marked as answer by Tim Magnuson Tuesday, June 9, 2020 3:37 PM
    Monday, June 8, 2020 10:59 PM
  • Bah!

    So there were 2 problems - the missing pipe (THANK YOU!), and a lack of patience.  the first server I was hitting had large volumes that took a very long time for the script to run and I wasn't taking that in to consideration...

    I also found through my trials that I can skip the foreach and the invoke-command will run concurrently against all the systems in my array.  The only thing I had to change was the output file name as it would throw all the queried server names in there.  Since the invoke command includes PSComputerName in the output, just wait til it finishes, open the csv and sort by name.  done.

    Here's that one for anyone who may be interested

    $servers = Get-Content -Path c:\<scriptpath>\servers.txt

    Invoke-Command -ComputerName $servers -ScriptBlock { Get-ChildItem c:\, d:\, e:\ -Recurse -Include *.ps1, *.txt, *.bat -Force -ErrorAction SilentlyContinue | Select-String '(credentials) | (pscredential) | (password)' } | Export-Csv C:\<outputfolder>\result-finder-$(get-date -f MM-dd-yyyy).csv -NoTypeInformation


    Thanks again!

    Tuesday, June 9, 2020 3:36 PM