File Change Tripwire

[Ian]

Ian submitted a new article:

File Change Tripwire - A simple PowerShell script to monitor selected folders/filetypes for changes, then e-mail results.

This PowerShell script will monitor your selected folders for any created, modified, renamed or deleted files. You'll then be e-mailed a list of all the changes at a set interval, along with a time and details of each filename. This script could be set to run in the background to monitor important folder for security intrusions - for example, on a Windows based webserver.

All of the variables you need to configure are listed in the first two blocks of code. You'll need an SMTP server to...

Read more about this article...

 

[Regedit32]

This is a great script Ian.

Something you might consider including is a function to confirm the User belongs to the Administrative Group.

For example:

function ConfirmUserIsAdministrator {
    [CmdletBinding()]
    Param()
    ${CmdletName} = $Pscmdlet.MyInvocation.MyCommand.Name
    ${Identity} = [System.Security.Principal.WindowsIdentity]::GetCurrent()
    ${Principal} = new-object System.Security.Principal.WindowsPrincipal(${Identity})
    ${IsAdmin} = $Principal.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)
   
    if (-not ${IsAdmin}) {
        Write-Error -Message "${CmdletName}: User is not an administrator. To continue run application as administrator." `
                    -RecommendedAction "Run application as administrator" `
    }
    else {
        Write-Host "Scanning selected directory"
    }
}
ConfirmUserIsAdministrator

# Then your code goes here for the $Event's

 

[Ian]

A handy snippet! I'll integrate that when I give it an overhaul .

 

[Regedit32]

That snippet is based on a non termination error message [ i.e. the program is not stopped as a result ].

If you use this you'll see a red error message in the console, if user is not the admin or is not running the script as administrator. Thus they would need to close it and re-open when one or both conditions are met.

If you'd rather have the script terminate then you'd nee to use a throw error.

 

[Ian]

I think I'll be re-using this snippet across a few scripts, thanks for posting it . I'm hoping to add a few items from the "to do" list to the tripwire script, so I'll include this then.