Having issues with a Copy-Item


so writing powershell script copy logfiles user pc server location.  this script run after various spyware/virus cleaners have been run.  i used same code each program , of course last item doe snot want play nice, or making error cannot see.  hoping different set of eyes can see problem.  

one works rkill logfile.  the logfile gets created on desktop of account running rkill program.  i used following code , worked perfectly:

# 1 - rkill  $rkilllog = (get-childitem -path $env:userprofile -filter rkill.txt -recurse) | select-object -expandproperty fullname    copy-item $rkilllog ("\\networklocation\incidentresponse\logs\{0:yyyymmdd}-rkill-$env:computername.txt" -f (get-date))     write-verbose "rkill log copied" -verbose


$rkilllog = c:\users\mjd-ir\desktop\rkill.txt

this works mbam well:

# 3 - chameleon mbam  $chameleonlog = (get-childitem -path c:\programdata -filter mbam-log*.xml -recurse) | select-object -expandproperty fullname    # rename , copy log \\secret2  copy-item $chameleonlog ("\\networklocation\incidentresponse\logs\{0:yyyymmdd}-chameleon_mbam-$env:computername.xml" -f (get-date))     write-verbose "mbam log copied" -verbose


$chameleonlog = c:\programdata\malwarebytes\malwarebytes anti-malware\logs\mbam-log-2015-11-03 (08-33-54).xml

the problem final log need copy.  no error comes up, file not copied.  

here code:

# 5 - adwclean  $adwcleanlog_s = get-childitem -path c:\adwcleaner -filter adwcleaner[s*].txt -recurse | select-object -expandproperty fullname    # rename , copy log \\secret2  copy-item $adwcleanlog_s ("\\networklocation\incidentresponse\logs\{0:yyyymmdd}-adwclean_s-$env:computername.txt" -f (get-date)) 

 

$adwcleanlog_s = c:\adwcleaner\adwcleaner[s8].txt

in troubleshooting, added rename-item command after first get-child... command , got error that c:\adwcleaner\adwcleaner[s8].txt not exist.  

is there obvious reason 1 file not copy?



matt dillon

the code worked great variable. 

the problem actual file not being renamed.  until can remove [ , ] actual file name using powershell, cannot of anything.  


matt dillon

why trying remove it? escape brackets , can copy file without issue:

ps c:\scripts\powershell scripts\misc testing\11-3-2015> ls       directory: c:\scripts\powershell scripts\misc testing\11-3-2015   mode                lastwritetime     length name                                                                                                                         ----                -------------     ------ ----                                                                                                                         d----         11/3/2015   1:38 pm            dest                                                                                                                         -a---         11/3/2015   1:27 pm          0 adwcleaner[s1].txt                                                                                                              ps c:\scripts\powershell scripts\misc testing\11-3-2015> $adwcleanlog_s = (get-childitem -path .\ -filter adwcleaner[s* | select-object -expandproperty fullname).replace('[','`[').replace(']','`]')  ps c:\scripts\powershell scripts\misc testing\11-3-2015> $adwcleanlog_s c:\scripts\powershell scripts\misc testing\11-3-2015\adwcleaner`[s1`].txt  ps c:\scripts\powershell scripts\misc testing\11-3-2015> copy-item $adwcleanlog_s .\dest  ps c:\scripts\powershell scripts\misc testing\11-3-2015> ls .\dest       directory: c:\scripts\powershell scripts\misc testing\11-3-2015\dest   mode                lastwritetime     length name                                                                                                                         ----                -------------     ------ ----                                                                                                                         -a---         11/3/2015   1:27 pm          0 adwcleaner[s1].txt  




Windows Server  >  Windows PowerShell



Comments

Popular posts from this blog

WIMMount (HSM) causing cluster storage to go redirected (2012r2 DC)

Failed to delete the test record dcdiag-test-record in zone test.com

Azure MFA with Azure AD and RDS