theNetFlow.com

Search all the computers in your domain

Sometimes, as part of an IT team, you’ll get a strange request to search every PC in your domain for a particular file, or files containing particular information. Also, you couldn’t just search for a file name as someone might have renamed the file. At first I would have said that it was an impossibly hard task but in the end it turned out to be not as hard as it seems, with a little scripting knowledge.

Obviously, the first suggestion was to go to each PC and start a search. Ouch. That would have taken an age and would have to be done when no-one is at the desk. And with hundred’s of PC’s to look after this really wasn’t a good idea.

So, wanting to show off my meagre scripting skills (but mostly to avoid walking around the entire office) I said that I would be able to script a solution to search every PC remotely. Although, I’m pretty good at scripting  pretty simple tasks, I had no idea if I could do this.

First, I had to see if I could search my own PC with a command line tool. I considered a couple of options – either FIND or FINDSTR. I decided to go with FINDSTR as there are loads of options and useful switches. I also wanted to reduce the time it would take to search my PC. I took a look at the security settings and basically decided that it would be a waste of resources to search every file and folder on the PC as our PCs are locked down so that users only have write permission on certain folders. So I could narrow the search down to those folders. So part 1 of my script became:

findstr /s /M /D:c:\Temp\;c:\docume~1\; /C:”Phrase to Search For” *.xls

Let me explain the switches in use here:

• /s – Search all subfolders
• /M – Only print out the filename of files that contain the phrase. The default is to display where in the file it is too.
• /D: – The directories to search in a list separated by semi-colons.
• /C: – The literal search string
• and the last option is the files to search. In this case – all files that have the .xls suffix. i.e. Excel files.

This line worked excellently and produced the following output:

c:\Temp\:
c:\docume~1\:
username\Local Settings\Temporary Internet Files\OLK10\stupidfile.xls

This shows that it found a file in my documents and settings folder with the above phrase in it. Excellent, so now I could move onto the next task – running this script on every PC and with admin rights, so that every folder could be searched.

In steps the Systems Administrator‘s best friend – PSTOOLS. Literally the best selection of admin tools for the Windows Systems Administrator, from the legendary Mark Russinovich. One of them – psexec.exe – does exactly what I need it to do. It allowed me to send out the above bat file to a huge list of machines and run it remotely using whatever user account I need to.

psexec @list.txt -u domain\adminadccount -d -c search.bat

Let me explain the switches in use here:

• @list.txt – basically this list contains every machine that you want to run the command on.
• -u – this allows out to stipulate the account to run the command under. In this case the fictional domain\adminaccount account
• -d – dont wait for the command to finish before carrying on. I was able to do this by using the bat file to output to a cetral location.
• -c – this switch copies the following bat file locally to the machines in question before running it. This is important because I had local drives specified in the bat script.

This ran on the test machines fine. Next stage was to pipe the output to somewhere nice and central and in manner that would allow us to differentiate the output from each machine. You couldn’t output everything to one file or you would have different machines outputting to the file at different times so depending on when the search was started it would output at different times and the file would become unreadable and full of meaningless data.  To avoid this I did a little roundabout way of outputting to files. I did this by getting the bat file to create a txt file based on the PC name:

echo %COMPUTERNAME% >> \\centrallocation\%COMPUTERNAME%.txt
findstr /s /M /D:c:\Temp\;c:\docume~1\; /C:”Phrase to Search For” *.xls >> \\centrallocation\%COMPUTERNAME%.txt
If %ERRORLEVEL% EQU 0 ECHO %COMPUTERNAME% had a copy of the file >> \\centrallocation\overall.txt

Note – The above should only be three lines. This was the full search.bat file but let me explain it:

First line created a file called computer name and on the first line of that file wrote the computername. You may not need this but for peice of mind I did this to be able to show management that it actually ran on the machine.

Next line outputs the findstr command from above to that same file. Often this would just output two lines with the directories searched as nothing would be found on the machine. However if the file was found it would also output that information.

The next line is very important. It is what the entire bat file relies on to make it simple for you to find the machines with the file. Even though the line above has created files for every PC, and all the information is held within them, it would be a very timeconsuming task to go through each one. Basically if findstr doesn’t find a file that you’re looking for it will change %ERRORLEVEL% to greater than 0. If it does find it however find a file the %ERRORLEVEL% will be 0. So if that is so then we output the computername to a file called overall.txt. This then gives us a list of PC’s where the file was found and we can then go to the corresponding computername.txt and find the location where the file was found.

So that’s how I did it. I wouldn’t mind hearing any different ways to do it from anyone out there so get in touch in the comments.

Tags: bat, Batch file, Command-line interface, computers, domain, files, Mark Russinovich, Microsoft Windows, Operating system, psexec, scripting, search, System administrator, Windows