Поиск с помощью power shell sdk

The PowerShell SDK provides you access to Identity Security Cloud’s Search functionality.

Here is an example search you can copy into your PowerShell instance to try it out:

This example request uses the Perform Search endpoint to search your tenant for identities with the name “john.doe”.

You can paginate your search results to get records past the default limit of 10000. With pagination, you can get as many records as you want.

This example searches your Identity Security Cloud tenant for all identities and sorts them by their displayName in descending order. The search returns a maximum of 150000 records (the Limit) and 5000 records per page (the Increment).

I have created a simple PowerShell script to search files on a particular directory path which will show files larger than 100MB. It will take the output into a csv file as well.Here is the script i use

Get-childitem -path "C:\Users\someuser" -Include *.db,*.bak,*.mdf,*.ldf,*.zip,*.rar,*.7z -recurse | where-object {$_.length -gt 104857600} | select-object FullName, @{Name="SizeInMB"; Expression={ [math]::Round($_.length / 1MB,2 )}} | export-csv -notypeinformation -path "C:\temp\Report.csv" | % {$_.Replace('"','')} 

another column with last modified dates of the files

This should fulfill your need. please check the select-object line

Get-childitem -path "C:\Users\someuser" -Include *.db,*.bak,*.mdf,*.ldf,*.zip,*.rar,*.7z -recurse |
    where-object {$_.length -gt 104857600} |
    select-object FullName, @{Name="SizeInMB"; Expression={ [math]::Round($_.length / 1MB,2 )}}, @{Name="File extension"; Expression={($_.Extension).Replace('.','')}} |
    export-csv -notypeinformation -path "C:\temp\Report.csv" | % {$_.Replace('"','')}

4 silver badges17 bronze badges

Windows Index Search, also known as Windows Search or Windows Indexing, is a feature in the Microsoft Windows operating system that improves the speed and efficiency of file searches on your computer. It is designed to create and maintain an index of the files and folders stored on your local drives, allowing for faster and more accurate searches.

When you perform a search using Windows Index Search, the system does not have to scan every file and folder on your computer every time you search. Instead, it refers to the index, which is a database containing information about the files’ names, locations, and contents. This significantly reduces the time it takes to find and retrieve search results, especially when dealing with a large number of files.

Key Features and Benefits of Windows Index Search:

• Fast Search Results: With the index pre-built, Windows Search can quickly return search results, making it easier to find the files and documents you need.

• Support for Various File Types: Windows Index Search supports various file types, including documents, images, music, videos, and more.

• Partial and Phrasal Search: It allows partial word matches and supports searching for phrases, making it more flexible and powerful.

• Outlook Integration: The Windows Search index can also be used by Microsoft Outlook to speed up email searches.

• Advanced Search Operators: Windows Search supports advanced search operators, such as AND, OR, and NOT, to refine search queries further.

• Real-Time Indexing: As files and folders change or new ones are added, the index is updated in real-time to ensure the search results remain up-to-date.

Netwrix Auditor for Windows File Servers

1. Open the PowerShell ISE.
2. Run a script like the following, which will return all files in the Accounting folder whose filename includes the string “payroll”:

The results will show all matching files.

• Using Get-Item to check if a file exists — You can use the Get-Item cmdlet in PowerShell to find a file by name. If the specified item path does not exist, the script will throw an error. Below is a PowerShell script that checks whether the file “Payroll 2022 – 2023.xlsx” exists using the Get-Item cmdlet. If the file exists, the script provides the file details; if not, it will display a message saying the file does not exist.

    Write-Host”The file exists. Details:”

    Write-Host”The file does not exist.”

• Using Get-ChildItem to check if a file exists — The Get-ChildItem cmdlet is typically used to retrieve a list of items in a specified location, but it can also be used to check for the existence of a specific file. The script below attempts to retrieve the file “Payment_2021.rtf”. If the file exists, the script will return the file details and a success message; otherwise, no output will be returned by Get-ChildItem and the write host cmdlet will display the message “The file does not exist.”

    Write-Host”The file exists.”

    Write-Host”The file does not exist.”

• Using Test-Path to check if a file exists — You can use the Test-Path cmdlet to check whether a specific file or folder exists. It returns True if the file or folder exists and False if it does not. For example, to check whether the “Payroll 2022 – 2023” file exists, run the following script:

You can also use Test-Path to check whether a path is a file or a directory. Add the ‑PathType with “leaf” as its value, and the cmdlet will return “true” if the path is a file.

Test-path -Path “C:\Temp\Temp*” -pathtype leaf

Test-Path -Path “\\FileServer\Backup”

1. Run Netwrix Auditor → Navigate to Reports → Open User Behavior and Blind Spot Analysis → Go to Information Disclosure → Select File Names Containing Sensitive Data → Click View.
2. Specify the following filters and parameters:
3. Object UNC Path — Specify the path to your file share
4. Disallowed Words — Specify the string you want to search for in filenames
5. Click View Report.

Get-ChildItem -Name "MyFile.txt"

Get-ChildItem -Recurse -Name "MyFile.txt"

Get-ChildItem -Recurse -Name "*partialname*"

Get-ChildItem -Recurse -Filter "*.txt"

Get-Item "C:\Path\To\Your\File\filename.txt"

Get-ChildItem -Recurse | Select-String -Pattern "searchTerm" | Select-Object -Unique Path

Get-ChildItem -Recurse | Where-Object { $_.Name -eq "filename.txt" }

Get-ChildItem -Recurse | Where-Object { $_.Extension -eq ".txt" }

try {
    Get-ChildItem -Path "C:\Invalid\Path" -ErrorAction Stop
} catch {
    Write-Error "An error occurred: $_"
}

function Find-FileName {
    param (
        [string]$FileName
    )
    Get-ChildItem -Recurse -Name $FileName
}

Select-String -Path C:logsexample.log -Pattern "error"

Select-String -Path C:logsexample.log -Pattern "error"

Select-String -Path C:logsexample.log -Pattern "Error" -CaseSensitive

Select-String -Path C:documentscontacts.txt -Pattern "b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+.[A-Z]{2,}b"

Select-String -Path C:logs*.log -Pattern "success"

Select-String -Path C:logsexample.log -Pattern "exception" -Context 2

Select-String -Path C:logsexample.log -Pattern "error|warning"

Select-String -Path C:logsexample.log -Pattern "data" | Where-Object { $_.Line -notmatch "backup" }

Select-String -Path C:logs*.log -Pattern "update" -List

Select-String -Path C:logsexample.log -Pattern "^Errord+"

Get-ChildItem C:configurations -Recurse -Include *.txt | Select-String -Pattern "configuration"

How to do full-text searches on the Windows Explorer

• Open the Windows Explorer window

• Navigate to the folder where you want to perform the search

• Type in the search text box the term that you are looking for, specifying the content filter (e.g.: content: “design analysis”)

As the contents of all the documents contained in that folder have been already indexed by the Windows Search Index, you will see how the results of documents containing that term (if any) start to emerge immediately.

Find Your Sensitive Files — and Get Critical Details about Them, Too

To maintain security and compliance, IT pros need to regularly search for files that might contain sensitive data and move them to a secure location. You can find and move files manually using Windows Explorer, but this method takes a lot of time so it is useful mainly when you need to secure a single file. To check multiple files more efficiently, you can use PowerShell. However, a PowerShell script for moving files will terminate with an error if the path is invalid, so before you run it, you need to meticulously check whether the files and folders exist, as shown in the examples above.

How to do full-text searches on PowerShell

We are now going to see how we can use that functionality from a PowerShell script. It will use the APIs exposed by Windows to have access to the Windows Search Index database.

 {
<#

Absoloute or relative path. Has to be in the Search Index for results to be presented.

File name or pattern to search for. Defaults to *.*. Aliased to Filter to ergonomically match Get-ChildItem.

Free text to search for in the files defined by the pattern.

Add the parameter to perform a recursive search. Default is false.

Add the parameter to return System.IO.FileSystemInfo objects instead of String objects.

Uses the Windows Search index to search for files.

Uses the Windows Search index to search for files. SQL Syntax documented at https://msdn.microsoft.com/en-us/library/windows/desktop/bb231256(v=vs.85).aspx Based on https://blogs.msdn.microsoft.com/mediaandmicrocode/2008/07/13/microcode-windows-powershell-windows-desktop-search-problem-solving/ 

By default one string per file found with full path.
If the AsFSInfo switch is set, one System.IO.FileSystemInfo object per file found is returned.
#>
    
     (  
        [] = ,
        [] = ,
        [] = ,
        [] = ,
        [] = 
    )

     = (  ).Path

     =   , 
     = .Replace(,)

     ((  Variable:fsSearchCon)  )
    {
         =   ADODB.Connection
         =   ADODB.Recordset
    }

    .Open()

    [] = "SELECT System.ItemPathDisplay FROM SYSTEMINDEX WHERE System.FileName LIKE '" +  + 
     ([]::IsNullOrEmpty()  ){
         +=  +  + 
    }

     (){
         +=  +  + "' ORDER BY System.ItemPathDisplay "
    }
     {
         +=  +  + "' ORDER BY System.ItemPathDisplay "
    }

    .Open(, )

    ( .EOF){
         (){
            [](  (.Fields.Item().Value) )
        }
         {
            .Fields.Item().Value
        }
        .MoveNext()
    }
    .Close()
    .Close()
}

SearchIndex @args

You can copy this script to a file named SearchIndex.ps1. As long as it is contained in one of the directories defined in the Path environment variable, you will be able to run it from any location on the PowerShell terminal. The script supports several arguments. It looks recursively in the folders contained in the current directory by default. It looks over all kinds of documents by default too. But the argument -Pattern allows you to filter out the results just to the files of the specified extension.

PS C:\>SearchIndex.ps1 -Text  -Pattern 

How to do full-text searches from the Windows run dialog

Windows has a very useful feature that allows you to quickly execute a command. To do so, you just have to press the “Windows key” plus the “key r”, and you will see a pop-up dialog called Run. You can type there any program that is available on the Path environment variable, and execute it.

In our case, we want to trigger the execution of a full-text search over any document contained in the Windows Search Index database from that Run dialog. That way, we would just need to type “Win + r” and the search command together with the search term to do a full-text search over all the target documents on our machine. Not bad, right?

The problem is that this Run dialog can only run batch files, not PowerShell scripts. Therefore, to overcome that limitation, we have to create a wrapper batch file that will call our PowerShell script. And add the location of this wrapper batch file to our Path environment variable.

We are going to create a search-text.bat file, that will allow us to perform a full-text search over any pdf file contained in a specific directory, which belongs to the Windows Search Index database.

@ off

Rem Description: Search text  Windows Search Index pdf files
Rem Usage: search-text.bat {strings}
Rem Example: search-text.bat Seamless

 cmd=
 %cmd%

PowerShell -ExecutionPolicy Bypass -Command %cmd%
Pause

Once we have done that, we can use the Run dialog to execute the SearchIndex script to search for all the PDF documents from that directory that have been indexed in the Windows Search Index database.

And that’s all. With this utility, you can search for any text at lightning speed on your computer. It is so fast, that it almost feels like you have a Google Search Engine on your local laptop.

How to set the index sources

• Win + S: press the “Windows key” plus the “key s” to open the Windows Search panel

• Type Indexing Options to open the corresponding dialog

• Add the folders that you want to include in the index

Once you have configured the folders to be included in the database, the Index Engine will start indexing all the documents included in those locations. Once it finishes, it will show a message saying that the indexing process is complete. From then on, you can do full-text searches on the specified directories.

Похожее:

Как найти файл по имя в power shell Полезные заготовки вызова утилит командной строки Удалить обновление при помощи DISM. Power shell и его возможности в уходящем году