CIM_Datafile issue

[purepest]

Hi

I am trying to find all the index.dat files on machines so that I can colect information about them.

The ones that I am looking for are in the profile directories on w2k machines - general path of C:\Documents and Settings\<profile folder>\cookies

I have written the following script (OK I used scriptomatic 2.0) to try and get this information

On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

arrComputers = Array("WINTELCY")
For Each strComputer In arrComputers
WScript.Echo
WScript.Echo "=========================================="
WScript.Echo "Computer: " & strComputer
WScript.Echo "=========================================="

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND FileName = 'index'", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)

For Each objItem In colItems
'WScript.Echo "CreationDate: " & WMIDateStringToDate(objItem.CreationDate)
WScript.Echo "Drive: " & objItem.Drive
WScript.Echo "Extension: " & objItem.Extension
WScript.Echo "FileName: " & objItem.FileName
WScript.Echo "LastAccessed: " & WMIDateStringToDate(objItem.LastAccessed)
WScript.Echo "LastModified: " & WMIDateStringToDate(objItem.LastModified)
WScript.Echo "Name: " & objItem.Name
WScript.Echo "Path: " & objItem.Path
WScript.Echo
Next
Next


Function WMIDateStringToDate(dtmDate)
WScript.Echo dtm:
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

When I run this script I do get information back about index files but none of them are in the documents and settings folder, they all sit in the Windows folders.

When I change the query to this:

"SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND Path = '\\Documents and Settings\\' AND FileName = 'index'"

just to see if I can see any files in this folder. It doesn't return anything.

I have browsed my machine and there are files in there called 'index'

Can anyone tell me why this script will not see in the documents and settings folder?

Colin

 

[tsuji]

>[tt]SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND FileName = 'index'[/tt]
Subdirectories will not be searched.

- tsuji

 

[tsuji]

Sorry! It will, as the condition is on drive not path. My mistake. I take back. Only, it may take quite long while to do.

- tsuji

 

[purepest]

Hi

I have ran more tests and found the following

1) With the SELECT statement I can get results if I only put the drive letter and filename (even from subdirectories)

2) If I put in an exact path it will find a file if it is there

3) I have tried to put in LIKE '%cookies%' but that didn't work

aarrgghhh


Any more suggestions

Colin

 

[tsuji]

purepest,

The only reason I can think of off-hand is whether you have read access to profiles? (I suppose you run it with some sort of local administrative right? Make yourself a member of local admin group?)

- tsuji

 

[purepest]

Hi

I have domain admin permissions over the network and local admin rights.

The following script outputs the information required (well almost)

On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

arrComputers = Array("ukpbtcdcsr03")
For Each strComputer In arrComputers
WScript.Echo
WScript.Echo "=========================================="
WScript.Echo "Computer: " & strComputer
WScript.Echo "=========================================="

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND Extension = 'dat' AND FileName = 'index'", "WQL", _
wbemFlagReturnImmediately + wbemFlagForwardOnly)

For Each objItem In colItems
WScript.Echo "CreationDate: " & WMIDateStringToDate(objItem.CreationDate)
WScript.Echo "LastModified: " & WMIDateStringToDate(objItem.LastModified)
WScript.Echo "Name: " & objItem.Name
WScript.Echo
Next
Next

This brings back all the information about all the index.dat files on the C drive. the problem now is that there is too much information.

I only need the information on the index.dat file that is in the cookies folder and not the information from local settings or application data

I tried:

"SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND Extension = 'dat' AND FileName = 'index' AND Path LIKE '%cookies%'"

But nothing happened.

So you know how to use wildcards in this statement?

Colin

 

[PHV]

Have you tried this ?
AND Path LIKE '*cookies*'"

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[purepest]

Yes but it didn't work

 

[PHV]

A work around is to test objItem.Path with InStr

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[tsuji]

purepest,

[1] You must establish one single fact. Bind to the specific cookies file and enum what found? Else it is the access problem.

[2] Else, Take out the "on error resume next". There should be runtime error I anticipate.

- tsuji

 

[purepest]

Yes I do get an error

80041017

I have had a look on the net and it appears to point towards the escape character '\'

that is the reason why I tried to use \\ instead of \. I also tried not putting backslashes in because if it is a wildcard then they should be needed but that didn't work either.

I definitely have permissions to do this work on other machines because I changed the computer name to another machine and ran it remotely and it worked a treat (without the Path information in it)

 

[PHV]

This works for me:
Set colItems = objWMIService.ExecQuery( _
"SELECT * FROM CIM_DataFile WHERE Drive = 'C:' AND Extension = 'dat' AND FileName = 'index' AND Path Like '%cookies%'", _
"WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)

However I get a type mismatch error for 'WMIDateStringToDate'

(Win XP pro SP2, WSH 5.6)

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[purepest]

did that take a long time to execute?

 

[PHV]

did that take a long time to execute?
Sure, as always with the CIM stuff ...

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244