MD5 Hash and File Check on 2012+ Servers

hello gurus!

   i've been working on script past few weeks check specific
paths file extensions , doing comparisons previous days
check find files have been added/removed , hash check on
remaining files make sure haven't changed since previous day. can
parts of working reliance on compare-object comparisons
changing output can no longer pipe cmdlets get-filehash.
use help!

   here i'm trying do. first i am scanning
following paths *.exe, *.dll, *.bat, *.vbs, *.cmd files.

path1 - c:\ (non-recursive)

path2 - c:\windows (recursive)

(code example)

$include=@("*.dll","*.exe","*.bat","*.cmd","*.vbs")
$files = @(get-childitem -path c:\* -include $include)
$files += @(get-childitem -path $env:windir\* -include $include)

(/code example)

once have file list stuffed in variable (is get-childitem best
way this?) i compare previous days file list (stored in csv
form , imported variable) , compare 2 variables to find files
have been deleted or added.

(code example)

$previous = import-csv c:\scripts\prevfiles.csv

$current = $files | get-filehash -algorithm md5 | select-object path,hash

$fd = compare-object $previous $current -property path | sort-object path | select-object -property path,sideindicator

(/code example)

once files have been identified, exported
readable text file:

filechanges.txt

c:\windows\driver.com    file deleted!

c:\gpologger.dll             file added!

now run compare against current , previous file lists find
files paths match and create new file list of matched
paths that stored in new variable.

i run variable of matching path file list piped
get-filehash , assign new variable have file path , hash
each file. import csv previous days filehash output ,
compare them looking changes in hash. once files changed hash
identified are appended filechanges.txt file in readable
format.

filechanges.txt

c:\windows\driver.com       file deleted!

c:\gpologger.dll                file added!

c:\windows\explorer.exe    hash changed!

once complete, check filechanges.txt content, if none send
e-mail saying no changes. if there content in filechanges.txt send
different e-mail alerting people of changes , attach filechanges.txt
file e-mail.

i write current file list csv , overwrite yesterdays file list
can read tomorrow "previous day". same thing
current hash/file list.

------

i thought going painless until realized compare-object
changes data type can no longer feed it's output get-filehash. while
understand parts of powershell well, not 1 of them. can
me on hump of generating file lists can compare ,
output new file lists can fed get-filehash? or if have better
idea how structure data , comparisons, i'm ears!

thanks all!

the documentation compare-object doesn't mention whether or not adds property when called -passthru parameter, guess normal behavior.

for you're doing, verify pipeline continue work way need to, modified objects. can pulling get-help cmdlets , reviewing parameters (get-help -full or get-help -showwindow easy ways full parameter output).

in parameter info, "accept pipeline input?" line on each parameter. how can tell how cmdlet behave when pipe data it. get-filehash, there 1 parameter accepts pipeline input - literalpath, , accepts property name. means long objects pipe get-filehash have property called literalpath, work expect.

get-help about_pipelines, though lengthy read, gives in depth explanation of how pipeline input gets bound cmdlet parameters.

Windows Server  >  Windows PowerShell