Advertisement
Guest User

Untitled

a guest
Jul 15th, 2017
158
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Function Start-FileSystemWatcher {
  2.     [cmdletbinding()]
  3.     Param (
  4.         [parameter()]
  5.         [string]$Path,
  6.         [parameter()]
  7.         [ValidateSet('Changed', 'Created', 'Deleted', 'Renamed')]
  8.         [string[]]$EventName,
  9.         [parameter()]
  10.         [string]$Filter,
  11.         [parameter()]
  12.         [System.IO.NotifyFilters]$NotifyFilter,
  13.         [parameter()]
  14.         [switch]$Recurse,
  15.         [parameter()]
  16.         [scriptblock]$Action
  17.     )
  18.     #region Build  FileSystemWatcher
  19.     $FileSystemWatcher = New-Object  System.IO.FileSystemWatcher
  20.     If (-NOT $PSBoundParameters.ContainsKey('Path')) {
  21.         $Path = $PWD
  22.     }
  23.     $FileSystemWatcher.Path = $Path
  24.     If ($PSBoundParameters.ContainsKey('Filter')) {
  25.         $FileSystemWatcher.Filter = $Filter
  26.     }
  27.     If ($PSBoundParameters.ContainsKey('NotifyFilter')) {
  28.         $FileSystemWatcher.NotifyFilter = $NotifyFilter
  29.     }
  30.     If ($PSBoundParameters.ContainsKey('Recurse')) {
  31.         $FileSystemWatcher.IncludeSubdirectories = $True
  32.     }
  33.     If (-NOT $PSBoundParameters.ContainsKey('EventName')) {
  34.         $EventName = 'Changed', 'Created', 'Deleted', 'Renamed'
  35.     }
  36.     If (-NOT $PSBoundParameters.ContainsKey('Action')) {
  37.         $Action = {
  38.             Switch ($Event.SourceEventArgs.ChangeType) {
  39.                 'Renamed' {
  40.                     $Object = "{0} was  {1} to {2} at {3}" -f $Event.SourceArgs[-1].OldFullPath,
  41.                     $Event.SourceEventArgs.ChangeType,
  42.                     $Event.SourceArgs[-1].FullPath,
  43.                     $Event.TimeGenerated
  44.                 }
  45.                 Default {
  46.                     $Object = "{0} was  {1} at {2}" -f $Event.SourceEventArgs.FullPath,
  47.                     $Event.SourceEventArgs.ChangeType,
  48.                     $Event.TimeGenerated
  49.                 }
  50.             }
  51.             $WriteHostParams = @{
  52.                 ForegroundColor = 'Green'
  53.                 BackgroundColor = 'Black'
  54.                 Object          = $Object
  55.             }
  56.             Write-Host  @WriteHostParams
  57.         }
  58.     }
  59.     #endregion  Build FileSystemWatcher
  60.     #region  Initiate Jobs for FileSystemWatcher
  61.     $ObjectEventParams = @{
  62.         InputObject = $FileSystemWatcher
  63.         Action      = $Action
  64.     }
  65.     ForEach ($Item in  $EventName) {
  66.         $ObjectEventParams.EventName = $Item
  67.         $ObjectEventParams.SourceIdentifier = "File.$($Item)"
  68.         Write-Verbose  "Starting watcher for Event: $($Item)"
  69.         $Null = Register-ObjectEvent  @ObjectEventParams
  70.     }
  71.     #endregion  Initiate Jobs for FileSystemWatcher
  72. }
  73.  
  74. $FolderToWatch = "\\$item\C$\users\*\AppData\Local\Microsoft\Windows"
  75. $Search = Get-ChildItem $FolderToWatch -Filter wpad*.dat -Recurse -Force -Verbose -ErrorAction SilentlyContinue
  76. Start-FileSystemWatcher -Path $PathToWatch -EventName Deleted -Recurse -Filter wpad*.dat
  77. $Search | Remove-Item
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement