What tools are available to scan remote desktops for certain types of files?

Question

I need to scan about 50 desktop computers and check to see if any *.doc, *.xls, *.ppt etc... files are being stored locally. I am wondering what tools might be available for this. A quick Google didn't find any great solutions so I am thinking I may need to write a script to do this.

Answer 1

I'm assuming you're doing this from a Windows machine to Windows machines. I'd do something quick and dirty like:

Machines.TXT

COMPUTERNAME-1
COMPUTERNAME-2
COMPUTERNAME-3

Scan-Machines.cmd

@echo off
if "%1"=="" goto all

echo Scanning %~1
dir "\\%~1\c$" /s /a /b > "%~1.txt"
goto end

:all
for /f "delims=" %%i in (Machines.TXT) do call %0 "%%i"

:end

Put all the machine names in the Machines.TXT file (and put it in the same folder as Scan-Machines.cmd). Run Scan-Machines.CMD and you'll end up with one text file for each machine listing all the files on their "C:" "drives". Then you can just search the text files.

Yep-- quick and dirty, but cheap.

Edit: Fixed to allow computer names with spaces in them. Computer names with spaces make me weep, but the script should handle them.

Answer 2

Good solution, Evan. To save the time and tedium of looking through the list of files searching for your entries you could add the following to Evan's script.

dir "\%~1\c$" /s /a /b *.doc *.xls *ppt > "%~1.txt"

That way you don't have to parse the returned data looking for your desired extensions.

Answer 3

I think that some of the enterprise desktop search products have a management interface for auditing where files are stored, where duplicates of files are kept, and even where older versions of existing files are stashed away.

Answer 4

We've been using Cornell Spider to scan servers, documents, and databases for social security numbers on a somewhat automated basis. We've hacked some additional functionality on to talk to our database engines and to manage the scan with our desktop management software. The basic functionality in the engine is there to do what you need, you could probably just hack the engine a touch and have a solid, deployable solution that you can set to log back centrally to a shared drive.

Depending on use, there may be a better alternative to scanning. A friend who administers a student lab has started re-imaging the machine on every logout. It only takes about thirty seconds to a minute to copy a clean 10GB image over from a protected 10GB separate partition on the local machine's disk, and you don't have to worry about kids replacing the windows start splash with a crude drawing of genitalia.