Need to exclude "C:\Windows", "C:\Program Files (x86)", "C:\Program Files"

Hi,

I am trying to capture the video file information, but unable to exclude “C:\Windows”, “C:\Program Files (x86)” and “C:\Program Files” directories.

Please support in this regard.

q:(pathnames of it, (size of it / (1024*1024)) as string & "MB") of descendants whose(name of it as lowercase ends with ".mpeg" or name of it as lowercase ends with ".mkv") of folders "\" of drives whose (type of it="DRIVE_FIXED")

Please edit your post, highlight your code, and click the “code” formatted icon which looks like </> so we can see the characters that the forum is interpreting as tags.

There are better ways to accomplish this; doing it directly in Relevance is likely to take a long time and may time-out before completing. In any case don’t use this as Fixlet/Task relevance, or the client will re-evaluate on every evaluation loop. Running it inside of an Action, or in an Analysis Property set to evaluate once a month or so might be acceptable.

That said, on your query you’d modify the folders"" to be

Folders whose (name of it as lowercase != "windows" and name of it as lowercase != "program files")

Add in whatever folders to exclude in that list.

3 Likes

Hi Jason, Please see now.

Moreover, I have created an analysis property to extract the information. As I have to check the compliance status of 1000 machines, where I need to check these file extensions.

And the analysis property set to evaluate once a week.

Kindly support on excluding “C:\Windows”, “C:\Program Files (x86)” and “C:\Program Files” directories.

As @JasonWalker mentioned, using relevance is probably not the best approach as it will time out before completing the scan (I think I once recall seeing that if a property take longer than 10 seconds it will gracefully timeout to avoid locking up the client). My personal suggestion would be to find a way of doing this via PowerShell then redirect the output to a file then use a property to parse the lines of the file. Possibly something like this will give you something you can build upon

Get-WMIObject Win32_LogicalDisk -filter "DriveType = 3" | select-object DeviceID | ForEach-Object {Get-ChildItem ($_.DeviceID + "\") -include *.mpeg, *.mkv -recurse | select-object fullname, length | export-csv -path $env:windir\temp\FileList.txt -append}

1 Like

Thank you @SLB & @JasonWalker, for your valuable suggestion.

Another possible solution would be to put your relevance inside of a task.

For example, make an action similar to the following:

createfile until _end_
{your relevance here}
_end_
move createfile "anylocation\results.txt"

You can then write an analysis to collect the results from that text file, collect the count of lines, etc…

This way you can also schedule the action to run whenever you would like using the scheduler.

Also, could have the file copy to a shared network location or something similar for you to review, or even create a remediation script of sorts within this action to remove those files, email the user about them requesting they clean them up, etc… Skys the limit really. All depends on your end goal and how creative you are.

Hmm, thanks for the tip, Albee! Will also keep that in mind.