Analysis to querie shortcut

Hey everyone,
i’m not sure if IEM has the capability to querie an entire drive for the target location of a shortcut location on a host. Just to give a quick overview of what im trying to accomplish, i’m looking to find shortcuts that are pointing to a specific network location that does not exist. The attribute of the shortcut is “Target location”.

Thanks!

This should be possible.

I wouldn’t recommend searching the entire drive, that is very slow and problematic.

It could search the user’s desktop & start menu and the all users desktop & start menu. A focused search is definitely better. If you have some other criteria to search on, like a case insensitive part of the file name, even better.

##Related:

1 Like

Thanks @jgstew. Do you know if there is a way to have a focused search that looks for shortcuts on the desktop with the target containing “\server\share” ? I believe this would be an attribute of the shortcut properties, the problem is the file type will vary (.xlsx, .txt, ect). Thanks.

This will get you all of the files in each of the system user’s desktop folders

(files of folders "Desktop" of folders of folder "C:\users")

This will get you the targets of all shortcuts in user’s desktop directories on windows:

pathnames of shortcuts of ( (files of folders "Desktop" of folders of folder "C:\users") whose (exists shortcut of it))

To look for the server share you could probably do

(pathnames of shortcuts of ( (files of folders "Desktop" of folders of folder "C:\users") whose (exists shortcut of it))) whose (it contains "\\server\share")

You can replace C:\ with “name of drive of system folder” if you need it to work on non C:\ Windows systems

1 Like

You could try something like this …

(pathname of it) of files whose (substring ((Length of it)-4,4) of it of names of it = “.lnk” AND Content of it as lowercase contains “\server\share”) of folders “desktop” of folders of folders “C:\Users”

It should return a list of all shortcuts on user desktops that refer to anything on \server\share

1 Like