PST Audit - HELP Please!

Content Authoring
1

I’m a bit confused, I thought this Analyses was working perfect for me. I’ve been able to get the PST size of about 300 machines, but about 400 of my remaining machines are returning an error that says “Inspector Interrupted”. What exactly is this and why is it working on some and not others? What can I do to the Analyses below to get this to work? It’s been a tough 2 weeks, any help would be appreciated.

Thanks.

Sno

(size of it) of find files “*.pst” of (descendant folders of folder “c:\users”)

2

Yeah, I was afraid of that. It’s taking the client so long to traverse through all of the folders that the inspector is timing out.

I recommend you use the method suggested on one of your other threads, to use an action to retrieve a directory listed through PowerShell or the output of dir /s /b c:\users\*.pst and then loop through the text file’s results in your analysis. Ref Get Outlook PST size and location or Outlook PST Size

Also more generic methods for scanning the whole drive are linked on your other thread at Search hard drive for partial name of a file and get it's location

There’s also a very similar scan at Get Java, version and java build details

3

We have powershell locked down in our environment, so that will prove unhelpful. I’ll keep poking around for solutions. Thanks for the feedback as usual, Jason.

4

The link I posted for the Java scan doesn’t use PowerShell.

1 Like
5

Here it is customized for your case.

Action:

action uses wow64 redirection false

parameter "output_folder"="{parent folder of parent folder of client folder of site "actionsite"}\filescans"
parameter "output"="{parameter "output_folder"}\pst-scan.txt"

folder create "{parameter "output_folder"}"
delete "{parameter "output"}"

delete __appendfile

appendfile dir /s /b c:\users\*.pst > "{parameter "output"}"

delete run_scan.cmd

move __appendfile run_scan.cmd

waithidden cmd.exe /c run_scan.cmd

This saves a listing at “BES Client\filescans\pst-scan.txt”. The content of that file will look like

C:\Program Files (x86)\BigFix Enterprise\BES Client\filescans>type pst-scan.txt
c:\users\jason.walker\AppData\Local\test1.pst
c:\users\jason.walker\AppData\Roaming\test2.pst

Now you can use an Analysis to retrieve the resulting paths and file sizes:

q: (pathname of it, size of it) of files (lines of files (pathname of parent folder of parent folder of client folder of site "actionsite" & "\filescans\pst-scan.txt") as trimmed string)
A: c:\users\jason.walker\AppData\Local\test1.pst, 7
A: c:\users\jason.walker\AppData\Roaming\test2.pst, 7
2 Likes
6

Ok, I’m about to give it a shot. Many thanks.

7

hey jason, this appeared to work, it returned c:\users\nfcccvc\outlook\personal.pst, 38618112 which is good progress! is there anything in your analyses below that can get the size separately, into a separate field? The way it is now it would be hard to sort this in excel because it’s one long run-on string of text, but if the size had it’s own column, it would work. I think were close. Thanks.

(pathname of it, size of it) of files (lines of files (pathname of parent folder of parent folder of client folder of site “actionsite” & “\filescans\pst-scan.txt”) as trimmed string)

8

The path and size need to be in the same result or you’ll have problems matching the right size to the right file if there are more than one PST files on a machine.

There’s probably a way to split it in Excel, but I don’t know any tricks there.

1 Like
9

ok, thanks for your support!

1 Like
10

I’d work with your SOC people to allow powershell access for bigfix processes. I’m sure they do the same for other Approved applications.