How to combine these two relevance scripts to gather user profile sizes

Content Authoring
1

Hi, I’m looing for assistance on combining following two relevance scripts in an analysis to report back size of all the user profiles on the windows end-point.

  1. List of all user profiles:
    (following texts whose ( it is not contained by “NetworkService|LocalService|systemprofile|LocalAdmin” ) of lasts “” of (substrings before “%00” of (Values"ProfileImagePath" of Keys of key “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList” of Registry as string)))

  2. Size of the user profile folders under C:\users\xxxxxx
    if not exists (folder “c:\users\xxxx”) then nothing else ((if (0<(it / (1024102410241024))) then (it / (1024102410241024)) as string & " TB" else if (0<(it / (102410241024))) then (it / (102410241024)) as string & " GB" else if (0<(it / (10241024))) then (it / (10241024)) as string & " MB" else if (0<(it / (1024))) then (it / (1024)) as string & " KB" else (it as string & " B")) of (sum of sizes of descendants of folder “c:\users\xxxx”))

Thanks.

1 Like
2

Here is a working example using a simplified relevance:
Q:(name of it & “|” &((sum of sizes of descendants of it as string) | “ERR” ) & “|” & pathname of it) of folders of folder “C:\Users” as string
A: Administrator|541743301|C:\Users\Administrator
A: All Users|1457052803|C:\Users\All Users
A: Default|1597770|C:\Users\Default
A: Default User|0|C:\Users\Default User
A: Fabio|200063066|C:\Users\Fabio
A: Public|7748|C:\Users\Public

Replace the relevance in my example with your actual relevance and test it. Note that it could be not very efficient, as it “cycles” more times on the same object.

1 Like
3

Descendants of recurses the filesystem and can be quite expensive in disk operations.
I would recommend running this in an Action Script periodically.
I would discourage using this in an Analysis or Retrieved Property.

I like the approach that @FDA used in skipping the registry check entirely.

Here it is with the start point in the registry. I used the expand string and folder creation method before filtering since it allowed me to write the filter more compactly.

relevance
not exists file "c:\profilesize.txt" whose ((now - modification time of it) < 1*day)

action:
dos echo {concatenation "%0d%0a" of (it as string) of (name of it, sum of sizes of descendants of it, pathname of it) of (folders (it)) whose (name of it is not contained by set of ("NetworkService";"LocalService";"systemprofile";"LocalAdmin")) of expand environment strings of (it as string) of Values "ProfileImagePath" of keys of key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" of native registry} > c:\profilesize.txt

You would then create an analysis to read

lines of file "c:\profilesize.txt"

4

That’s a neat bit of relevance to get the information, but I’m not sure that redirecting the echo of a string into the relevance will create the file.

1 Like
5

whoops! I have those reversed!

dos echo {concatenation "%0d%0a" of (it as string) of (name of it, sum of sizes of descendants of it, pathname of it) of (folders (it)) whose (name of it is not contained by set of ("NetworkService";"LocalService";"systemprofile";"LocalAdmin")) of expand environment strings of (it as string) of Values "ProfileImagePath" of keys of key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" of native registry} > c:\profilesize.txt

2 Likes