I have a need to perform change audits on some servers, and as such need to look at a particular bunch of file types, create hashes for the files matching those types, and then at a later time, compare the first hash list with a second hash list I created.
So far, I have created this string:
Get-ChildItem -Path C:\Windows -Force -Recurse -Include "*.exe","*.dll","*.sqr","*.sqc","*.sql","*.dms","*.asps" -ErrorAction SilentlyContinue | Get-Hash | Out-File 'results.txt'
This does a great job of finding all files that I need hashed, and creating hashes for those files. I have two problems with what I have so far...
First problem, when I pipe my results into the "Get-Hash" cmdlet, I lose most of the relevant information about the files that I am hashing, such as the last modified date, file length, and other timestamps.
I tried first piping my results into a Select-Object command, and then into the Get-Hash cmdlet, but it seems that the only information from the Get-Hash output is the file's path and hashstring.
Example:
Path : C:\Users\MM COS\Documents\results\changes.txt
HashString : 00C89D6C14E29A77DD52644F91E240DF
Second problem...So I decided to push on and work with what I had for the moment, and ran the following command to compare two hash files I created from my first step.
Compare-Object $(Get-Content .\results.txt) $(Get-Content '.\results2.txt')
The problem with this command, is it only displays the hashes that do not match; it does not display the file names associated with the hashes, which is pretty useless to me. I need to know what files are being changed.
Example:
Compare-Object (Get-Content .\hash1.txt) (Get-Content .\hash2.txt)
InputObject SideIndicator
----------- -------------
HashString : 1D90ADDE1194C8F1E60AF0BB0D725162 =>
HashString : D591529F73ADCB4ADAC8DD8B7AE58554 <=