I was poking around WMI the other day in PowerShell and was intrigued by the Win32_Share class. This is a great way to find out what items are shared on a server such as printers and folders, although it's not limited to those types of resources. I thought this would make a useful function; one that you might use to audit a collection of computers.<\/p>\n
The function, Get-ShareResource, takes a computername as a parameter, but it defaults to the local computername. I didn't add support for alternate credentials so if connecting to a remote machine you'll need to make sure you have admin rights on the computer. You could add support for alternate credentials if you are so inclined. Here's the main part of the function.<\/p>\n
[cc lang=\"PowerShell\"]<\/p>\n
Function Get-ShareResource {<\/p>\n
[cmdletbinding()]<\/p>\n
Param(
\n[Parameter(Position=0,ValuefromPipeline=$True)]
\n[Alias(\"Name\")]
\n[string[]]$Computername=$env:computername
\n)<\/p>\n
Begin {
\n Write-Verbose \"Starting $($myinvocation.mycommand)\"
\n}<\/p>\n
Process {<\/p>\n
Foreach ($computer in $computername) {
\n Write-Verbose \"Querying $($computer.ToUpper())\"
\n Try {
\n Get-WmiObject -Class Win32_Share -ComputerName $Computername -erroraction \"Stop\" |
\n Select Name,Path,Description,Status,
\n @{Name=\"Type\";Expression={
\n Switch ($_.Type) {
\n 0 {\"File\"}
\n 1 {\"Printer\"}
\n 2 {\"Device\"}
\n 3 {\"IPC\"}
\n 2147483648 {\"AdminDisk\"}
\n 2147483649 {\"AdminPrint\"}
\n 2147483650 {\"AdminDevice\"}
\n 2147483651 {\"AdminIPC\"}
\n Default {$_.Type}
\n }
\n }},
\n @{Name=\"Hidden\";Expression={
\n #use a regular expression and check if the name ends in a $
\n #which indicates a hidden share
\n if ($_.Name -match \"[\\$]$\") {
\n $True
\n }
\n else {
\n $False
\n }
\n }},
\n @{Name=\"Computername\";Expression={$_.__SERVER}}
\n }
\n Catch {
\n $msg=\"Failed to get share information from {0}. {1}\" -f $($computer.ToUpper()),$_.Exception.Message
\n Write-Warning -Message $msg
\n }<\/p>\n
}#foreach<\/p>\n
} #process<\/p>\n
End {
\n Write-Verbose \"Ending $($myinvocation.mycommand)\"<\/p>\n
}<\/p>\n
} #end function
\n[\/cc]<\/p>\n
The core command is a Get-WmiObject expression to retrieve all instances of the Win32_Share class from the specified computer.<\/p>\n
[cc lang=\"PowerShell\"]
\nTry {
\n Get-WmiObject -Class Win32_Share -ComputerName $Computername -erroraction \"Stop\"
\n[\/cc]<\/p>\n
But I then select a few properties to write to the pipeline. I also \"convert\" a few properties into more meaningful values. For example, the Type property is a numeric value so I use a Switch construct to create a \"better\" value.<\/p>\n
[cc lang=\"PowerShell\"]
\n Select Name,Path,Description,Status,
\n @{Name=\"Type\";Expression={
\n Switch ($_.Type) {
\n 0 {\"File\"}
\n 1 {\"Printer\"}
\n 2 {\"Device\"}
\n 3 {\"IPC\"}
\n 2147483648 {\"AdminDisk\"}
\n 2147483649 {\"AdminPrint\"}
\n 2147483650 {\"AdminDevice\"}
\n 2147483651 {\"AdminIPC\"}
\n Default {$_.Type}
\n }
\n }},
\n[\/cc]<\/p>\n
If you're wondering where I got the values, I looked up the Win32_Share class on MSDN. I also thought it would be handy to have a boolean value to check if share is hidden or not. A hidden share name will end in a $ so I use a regular expression comparison.<\/p>\n
[cc lang=\"PowerShell\"]
\n@{Name=\"Hidden\";Expression={
\n #use a regular expression and check if the name ends in a $
\n #which indicates a hidden share
\n if ($_.Name -match \"[\\$]$\") {
\n $True
\n }
\n else {
\n $False
\n }
\n }},
\n[\/cc]<\/p>\n
The last custom property is for the computername. The class itself lacks a property but I can always use the system class, __SERVER.<\/p>\n
[cc lang=\"PowerShell\"]
\n @{Name=\"Computername\";Expression={$_.__SERVER}}
\n[\/cc]<\/p>\n
So, assuming I don't run into errors getting the WMI objects, I end up with results like this:<\/p>\n
[cc lang=\"DOS\"]
\nPS S:\\> get-shareresource<\/p>\n
Name : ADMIN$
\nPath : C:\\Windows
\nDescription : Remote Admin
\nStatus : OK
\nType : AdminDisk
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : C$
\nPath : C:\\
\nDescription : Default share
\nStatus : OK
\nType : AdminDisk
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : Download$
\nPath : c:\\users\\jeff\\downloads
\nDescription :
\nStatus : OK
\nType : File
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : E$
\nPath : E:\\
\nDescription : Default share
\nStatus : OK
\nType : AdminDisk
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : IPC$
\nPath :
\nDescription : Remote IPC
\nStatus : OK
\nType : AdminIPC
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : print$
\nPath : C:\\Windows\\system32\\spool\\drivers
\nDescription : Printer Drivers
\nStatus : OK
\nType : File
\nHidden : True
\nComputername : SERENITY<\/p>\n
Name : Users
\nPath : C:\\Users
\nDescription :
\nStatus : OK
\nType : File
\nHidden : False
\nComputername : SERENITY
\n[\/cc]<\/p>\n
The computername parameter can accept pipelined input so it's pretty easy to create an audit report.<\/p>\n
[cc lang=\"DOS\"]
\nPS C:\\> Get-Content c:\\work\\computers.txt | Get-ShareResource | Export-CSV c:\\work\\ShareAudit.csv
\n[\/cc]<\/p>\n
This isn't an especially fancy function, but I hope you'll pick up on using Switch to \"decode\" and provide more meaningful information.<\/p>\n