Hellow Everyone, I am new to BigFix and still learning.Please advise how I can get the relevance of the PST File,I have checked other relevance but it gives me path also now I need to include properties that will only display the PST size.
Please advise.
Thanks,
Asif
so, the PST files are inside the user’s folder.
What makes it tricky is that the user’s name is a variable here.
you can use folder of folder.
Something like this.
if(exists files ("AppData\Local\Microsoft\Outlook\filename.PST") of folders of folders "C:\Users") then (size of file "AppData\Local\Microsoft\Outlook\filename.PST") of folders of folders "C:\Users" as string) else ("No PST Found")
Something Like That I think the PST name is also a variable and I would not know how to do that. you will need to do some research on that. and as per another post I mentioned to you. you can future proof your file locations for windows if you follow what is in this post:
I think you’re going to have to create a task that looks in the registry values under HKCU that specify the location of the PST files, and then check the size of those files.
One issue we faced with auditing PST’s if that if the PST is not connected to Outlook, the registry won’t contain the PST and you end up loosing visibility of it. What we did was execute a PowerShell script to scan all fixed drives for *.PST files, output the path and size to a text file and then we had a property that would read the file.
For the fixlet/task relevance
((windows of operating system) AND (nt workstation product type = product type of operating system)) AND (not exists file "PSTList.txt" whose (exists lines of it) of folder "TEMP" of windows folder)
For the ActionScript
createfile until EOF
Remove-Item $env:windir\TEMP\PSTList.txt
Get-WMIObject Win32_LogicalDisk -filter "DriveType = 3" | select-object DeviceID | ForEach-Object {{Get-ChildItem ($_.DeviceID + "\") -include *.pst -recurse | select-object fullname, length | export-csv -path $env:windir\TEMP\PSTList.txt -append}
EOF
delete {name of drive of windows folder}\TEMP\FindPST.ps1
folder create {name of drive of windows folder}\TEMP
copy __createfile {name of drive of windows folder}\TEMP\FindPST.ps1
runhidden powershell.exe -ExecutionPolicy Bypass -File {name of drive of windows folder}\TEMP\FindPST.ps1
For the Property
(concatenation "" of substrings separated by "%22" of it) of (lines whose (it as lowercase contains ".pst") of files "PSTList.txt" of folders "TEMP" of windows folder)
Hi CJ,
I am getting the complete path and size but need only size in separate column C:\Users\firstname.lastname\Documents\Outlook Files\archive.pst - 651MB need to get seperate column for size.
Hi @SLB, Could you please suggest how to add size of Outlook Pst files & Modification date…
As I am not able to extract these details in below analyses.
q: pathnames of descendants whose (name of it & " | " & size of it as string & " | " & modification time of it as string & " | " & pathname of it as lowercase as string contains “.pst”)of folders "C:\Users\Administrator\Documents\Outlook Files"
A: C:\Users\Administrator\Documents\Outlook Files\JFM’16.pst
A: C:\Users\Administrator\Documents\Outlook Files\AMJ’16.pst
A: C:\Users\Administrator\Documents\Outlook Files\JAS’16.pst
A: C:\Users\Administrator\Documents\Outlook Files~JFM’16.pst.tmp
A: C:\Users\Administrator\Documents\Outlook Files~AMJ’16.pst.tmp
T: 1.418 ms
In the example I supplied the data is retrieved by the PowerShell command in the actionscript so you’d need to update that to include appending the lastwritetime to the text file.
Get-WMIObject Win32_LogicalDisk -filter "DriveType = 3" | select-object DeviceID | ForEach-Object {{Get-ChildItem ($_.DeviceID + "\") -include *.pst -recurse | select-object fullname, length,lastwritetime | export-csv -path $env:windir\TEMP\PSTList.txt -append}
Using the relevance approach of yours, you would need to pull the names, sizes and mortification times…just be wary of the file IO as “descendants of” could cause some IO and CPU spikes when evaluated by the Bigfix service (it would depend on how deep the folder is and in your example, you have a hard coded path for the Administrator which probably wont work for all endpoints).
(pathnames of it, sizes of it, modification times of it) of descendants whose (name of it as string as lowercase contains ".pst") of folders "C:\Users\Administrator\Documents\Outlook Files"
I tried this, and now getting the desire details, but need the pst information for all available profiles.
(name of it & “|” & ((size of it as string) | “ERR”) & “|” &((modification time of it as string) | “ERR” ) & “|” & pathname of it) of files whose (pathname of it as lowercase as string contains “.pst”) of folders “C:\Users\Administrator\Documents\Outlook Files”
q: (pathnames of it, (size of it / (1024*1024)) as string & “MB”, modification times of it) of descendants whose (name of it as string as lowercase contains “.pst”) of folders “\Documents\Outlook Files” of folders of folder “C:\Users”