{"id":16231,"date":"2010-12-13T00:01:00","date_gmt":"2010-12-13T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/12\/13\/archiving-file-shares-with-windows-powershell\/"},"modified":"2010-12-13T00:01:00","modified_gmt":"2010-12-13T00:01:00","slug":"archiving-file-shares-with-windows-powershell","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/archiving-file-shares-with-windows-powershell\/","title":{"rendered":"Archiving File Shares with Windows PowerShell"},"content":{"rendered":"

 <\/span> <\/span><\/p>\n

Summary:<\/span><\/b> Learn how to use Windows PowerShell to archive file shares.<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span><\/span>Hey, Scripting Guy! I am interested in using Windows PowerShell to archive file shares, is this something that can be done?<\/span><\/p>\n

— ST<\/span><\/p>\n

 <\/span><\/p>\n

\"Hey,<\/span><\/span><\/span><\/span><\/span><\/span>Hello ST, Microsoft Scripting Guy Ed Wilson here. Welcome to guest blogger week. We welcome back Tibor Soos one of our MVP’s in Hungary. To learn more about Tibor and see his first guest blog post please follow this link<\/span><\/a>. Without further ado, here is Tibor.<\/span><\/p>\n

<\/span><\/p>\n

I frequently give on-site presentations for System Administrators and for their managers so that they can discover the great potential of Windows PowerShell and how Windows PowerShell scripts can help them save lots of money and\/or time to reach their operational goals. In this article, I selected one of my favorite examples. <\/span><\/p>\n

The task is archiving data on file shares. File shares are still heavily used and the data on these shares are larger and larger continuously. Backing up this data and making sure that old, “historical” data is not deleted or modified unintentionally is always challenging. Therefore, I created a script that moves files that were not modified within the last 30 days (by default) from the “live” data folder or share to a read-only “archive” folder or share. Meanwhile, I leave a shortcut at the original location which points to the archived copy so that users can still access these files easily. The content of the read-only archive cannot be modified by users. Therefore, it only has to be backed up once after you run this script. This saves backup media and management costs. <\/span><\/p>\n

Here is the whole script:<\/span><\/p>\n

Backup-FileShares.ps1<\/strong><\/p>\n

param(<\/span><\/span><\/p>\n

    <\/span>[Parameter(<\/span><\/span><\/p>\n

        <\/span>Mandatory = $true,<\/span><\/span><\/p>\n

        <\/span>Position = 0,<\/span><\/span><\/p>\n

        <\/span>HelpMessage = “Root of the folders or share to archive”<\/span><\/span><\/p>\n

    <\/span>)]<\/span><\/span><\/p>\n

    <\/span>[String] $source,<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

    <\/span>[Parameter(<\/span><\/span><\/p>\n

        <\/span>Mandatory = $true,<\/span><\/span><\/p>\n

        <\/span>Position = 1,<\/span><\/span><\/p>\n

        <\/span>HelpMessage = “Path of the folder or share of archive”<\/span><\/span><\/p>\n

    <\/span>)]<\/span><\/span><\/p>\n

    <\/span>[string] $target,<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

    <\/span>[Parameter(<\/span><\/span><\/p>\n

        <\/span>Mandatory = $false,<\/span><\/span><\/p>\n

        <\/span>Position = 3<\/span><\/span><\/p>\n

    <\/span>)]<\/span><\/span><\/p>\n

    <\/span>[int] $days = 30<\/span><\/span><\/p>\n

)<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Object created for shortcut creation <\/span><\/span><\/p>\n

$wsh = new-object -comobject wscript.shell  <\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Get all the files from the source path, that are not shortcuts and older than the days set<\/span><\/span><\/p>\n

Get-ChildItem $source -Recurse |   <\/span><\/span><\/span><\/p>\n

        <\/span>Where-Object {!$_.psiscontainer -and ((get-date) – $_.lastwritetime).totaldays -gt $days -and $_.extension -ne “.lnk”} | <\/span><\/span><\/p>\n

            <\/span>ForEach-Object {<\/span><\/span><\/p>\n

# For each file build the destination path  <\/span><\/span><\/span><\/p>\n

                <\/span>$dest = $_.fullname -replace ([regex]::escape($source)), $target <\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Check if the destination file path has the parent directory, if not create it<\/span><\/span><\/p>\n

                <\/span>$parent = split-path $dest  <\/span><\/span><\/span><\/p>\n

                <\/span>if(!(test-path $parent)){<\/span><\/span><\/p>\n

                    <\/span>[void] (new-item -Path (split-path $parent) -Name (split-path $parent -leaf) -ItemType directory) <\/span><\/span><\/p>\n

                <\/span>}<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Save the modification date and the ACL of the file for later use<\/span><\/span><\/p>\n

                <\/span>$date = $_.lastwritetime<\/span><\/span><\/p>\n

                <\/span>$acl = $_ | Get-Acl<\/span><\/span><\/p>\n

# Try to move the file into the destination<\/span><\/span><\/p>\n

                <\/span>Move-Item -Path $_.fullname -Destination $dest -ErrorAction silentlycontinue<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# If successful create shortcut<\/span><\/span><\/p>\n

                <\/span>if($?){<\/span><\/span><\/p>\n

                    <\/span>$shortCut = $wsh.CreateShortCut(“$($_.fullname).lnk”)     <\/span><\/span><\/span><\/p>\n

                    <\/span>$shortCut.TargetPath = $dest  <\/span><\/span><\/span><\/p>\n

                    <\/span>$shortCut.Save()  <\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Set the “date modified” property of the shortcut same as date modified property of the original file<\/span><\/span><\/p>\n

                    <\/span>(Get-Item “$($_.fullname).lnk”).lastwritetime = $date<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

# Replace the access control entries on the shortcut, so that users have read only access to it                <\/span><\/span><\/span><\/p>\n

                 <\/span>   <\/span>$acl.SetAccessRuleProtection($true,$true)<\/span><\/span><\/p>\n

                    <\/span>$acl | Set-Acl -Path “$($_.fullname).lnk”<\/span><\/span><\/p>\n

                    <\/span>$acl = Get-Item “$($_.fullname).lnk” | Get-Acl<\/span><\/span><\/p>\n

                    <\/span>$acl.Access | where-object {“BUILTIN\\Administrators” -ne $_.identityreference -and “NT AUTHORITY\\SYSTEM” -ne $_.identityreference} | <\/span><\/span><\/p>\n

                        <\/span>ForEach-Object {<\/span><\/span><\/p>\n

                            <\/span>$identity = $_.identityreference<\/span><\/span><\/p>\n

                            <\/span>[void] $acl.RemoveAccessRule($_) <\/span><\/span><\/p>\n

                    <\/span>        <\/span>$restrictedACE = New-Object system.security.AccessControl.FileSystemAccessRule($identity,”ReadAndExecute”,,,”Allow”) <\/span><\/span><\/p>\n

                            <\/span>$acl.AddAccessRule($restrictedACE)<\/span><\/span><\/p>\n

                        <\/span>}<\/span><\/span><\/p>\n

                    <\/span>$acl | Set-Acl<\/span><\/span><\/p>\n

      <\/span>          <\/span>}<\/span><\/span><\/p>\n

# Else write error message<\/span><\/span><\/p>\n

                <\/span>else { write-host “Error moving $_” -ForegroundColor red}<\/span><\/span><\/p>\n

            <\/span>}<\/span><\/span><\/p>\n

 <\/span><\/p>\n

If you save this file as – for example, Backup-FileShares.ps1<\/b> – then you can call it from Windows PowerShell as follows:<\/span><\/p>\n

c:\\your-path-to-the-scriptfile\\Backup-FileShares.ps1 –source \\\\server1\\path-to-archive -target \\\\server2\\path-of-archive -days 60<\/span><\/span><\/p>\n

 <\/span><\/p>\n

Of course, you have to have the relevant admin rights on both the source server and the target server. You can also use local folder paths instead of UNC share names. I commented the source code, but let’s walk through the code so that I can make some additional comments.<\/span><\/p>\n

The first section is the parameter definition part. The source<\/i> and the target<\/i> are mandatory. If you omit the days<\/i> parameter, the default value is 30 days.<\/span><\/p>\n

Next, I define the wscript.shell<\/b> COM object. This helps me to create the shortcuts later. Then I list all the file objects under the source path that were not modified during the last given days and which are not shortcut files.<\/span><\/p>\n

With these files, I do a foreach-object<\/b> cycle, in which the first task is to define the new path of the file in the archive:<\/span><\/p>\n

$dest = $_.fullname -replace ([regex]::escape($source)), $target <\/span><\/span><\/p>\n

 <\/span><\/p>\n

I just replace the source part of the full path of the file with the destination path. As the paths generally include characters that are reserved for regex, I escape them by using the escape<\/b> static method of the Regex<\/b> class of the .NET Framework. This trick is rarely mentioned in Windows PowerShell books and articles but I found it very useful. So when you do not exactly know what you want to find or replace by regex, I recommend always escaping the search string. Here is an example of how it works:<\/span><\/p>\n

PS C:\\> [regex]::Escape(“\\\\server\\share\\somefile.ext”)<\/span><\/span><\/p>\n

\\\\\\\\server\\\\share\\\\somefile\\.ext<\/span><\/span><\/p>\n

 <\/span><\/p>\n

You can see that all problematic characters are escaped automatically.<\/span><\/p>\n

Next, as I want to place the files into the same folder structure in the archive as the original one, I have to build this structure there. So I define the $parent<\/b> variable to include the path of the parent folder of the archive-file-to-be by the Split-Path<\/b> cmdlet. Then I check whether this folder already exists. If not, then I create it with the New-Item<\/b> cmdlet. Let’s stop here for a moment! What happens if the file to be moved to the archive is located in a deep folder hierarchy such as this?<\/span><\/p>\n

\\\\server1\\share\\mainfolder\\subfolder\\subsubfolder\\thefile.docx<\/span><\/span><\/p>\n

 <\/span><\/p>\n

If the target is \\\\server2\\share, then the parent folder of the archived file is as follows:<\/span><\/p>\n

\\\\server2\\share\\mainfolder\\subfolder\\subsubfolder<\/span><\/span><\/p>\n

 <\/span><\/p>\n

But the parent folder of this folder may not exist yet either! Fortunately, the New-Item<\/b> cmdlet is clever enough to resolve this problem by creating all the necessary folder path elements including all nonexistent folders in the path. But this is true only for directories. Therefore, if you use –ItemType Directory<\/i> as the parameter, it is not for files! If I want to create a file in a nonexistent folder, New-Item<\/b> will give an error. But for now I do not have to create new files. I’m just moving existing ones. <\/span><\/p>\n

If New-Item<\/b> can create the folder successfully, it also gives an output which I’m not interested in, so I suppress it by converting the result to [void]<\/b>.<\/span><\/p>\n

Remark:<\/span><\/b> There are at least three ways of suppressing output; convert the output to [void]<\/b>, redirect it to $null<\/b> and send it to the Out-Null<\/b> cmdlet through the pipeline. I did an experiment to determine which is the most efficient. I measured the three options by the Measure-Command<\/b> cmdlet, here are the results:<\/span><\/p>\n

PS C:\\> measure-command {1..1000 | %{$_ > $null}} | Select-Object -ExpandProperty milliseconds<\/span><\/span><\/p>\n

238<\/span><\/span><\/p>\n

PS C:\\> measure-command {1..1000 | %{$_ | out-null }} | Select-Object -ExpandProperty milliseconds<\/span><\/span><\/p>\n

405<\/span><\/span><\/p>\n

PS C:\\> measure-command {1..1000 | %{[void] $_}} | Select-Object -ExpandProperty milliseconds<\/span><\/span><\/p>\n

180<\/span><\/span><\/p>\n

As you can see the type conversion method is the fastest so I selected this option in my script (not because I really needed that performance benefit here but just to satisfy my engineer self).<\/span><\/p>\n

So we are at the point where there is a parent folder for the file in the archive. Then I save the modification date of the file to be moved into variable $date<\/b> and its access control list into $acl<\/b> for later use, and I try to move the file into the archive. The file may be locked and therefore cannot be moved. I do not want to show the error message, I’d rather handle this situation myself, and so I used the silentlycontinue<\/b> error-handling method. I check the $?<\/b> automatic variable, this variable shows the success of the last command.If this is $true<\/b>, then I know that the move was successful. In this case, I first create the shortcut with the wscript.shell<\/b> object that was stored in the variable $wsh<\/b> before. The name of this shortcut is the same as the file name plus an additional extension of .lnk. The shortcut points to the destination path.<\/span><\/p>\n

As I want to point users to the original file as much as possible, I set the modification date of the shortcut to the modification date of the original file. This time stamp was stored in variable $date<\/b> before.<\/span><\/p>\n

I also want to map the access control on the shortcut to the access control of the original file. I want to enable read access to the shortcut only for those who had any access to the original file, but I do not want to change the access of the System or Administrators accounts. This is the relevant code from the script:<\/span><\/p>\n

$acl.SetAccessRuleProtection($true,$true)<\/span><\/span><\/p>\n

$acl | Set-Acl -Path “$($_.fullname).lnk”<\/span><\/span><\/p>\n

$acl = Get-Item “$($_.fullname).lnk” | Get-Acl<\/span><\/span><\/p>\n

$acl.Access | where-object {“BUILTIN\\Administrators” -ne $_.identityreference -and “NT AUTHORITY\\SYSTEM” -ne $_.identityreference} | <\/span><\/span><\/p>\n

ForEach-Object {<\/span><\/span><\/p>\n

$identity = $_.identityreference<\/span><\/span><\/p>\n

    <\/span>        <\/span>[void] $acl.RemoveAccessRule($_) <\/span><\/span><\/p>\n

    <\/span>        <\/span>$restrictedACE = New-Object     <\/span>          <\/span>   <\/span> <\/span>        <\/span>    <\/span>        <\/span>    <\/span>      <\/span>System.security.AccessControl.FileSystemAccessRule($identity,”ReadAndExecute”,,,”Allow”) <\/span><\/span><\/p>\n

$acl.AddAccessRule($restrictedACE)<\/span><\/span><\/p>\n

}<\/span><\/span><\/p>\n

$acl | Set-Acl<\/span><\/span><\/p>\n

 <\/span><\/span><\/p>\n

First I remove the inheritance flag by calling the SetAccessRuleProtection<\/b> method. With the two $true<\/b> parameters I copy the inherited access control entries as explicit entries. Then I commit these changes by setting this DACL to the shortcut. I need this step, because at this point the access control entries within this DACL still have the IsInherited<\/b> flag set to $true<\/b>. Unfortunately the RemoveAccessRule<\/b> method cannot move these kinds of ACEs and the IsInherited<\/b> property is read-only so this is the easiest way of resetting these ACEs.<\/span><\/p>\n

Remark:<\/span><\/b> The RemoveAccessRule<\/b> method does not give any error message when removing ACEs with the IsInherited<\/b> flag on, it even outputs $true<\/b>, indicating that the removal was successful. But when you check the ACEs you will discover that these entries are still there. This strange behavior caused me some headaches.<\/span><\/p>\n

I set the $acl<\/b> and re-read it back from the shortcut. Now it includes only explicit ACEs, all with the correct IsInherited<\/b> flags. Then I filter the ACEs by a where-object<\/b>, because I do not want to change the System and Administrator access. For all the other ACEs I save the user or group to $identity<\/b>, remove the ACE and put a replacement back for the same identity with a ReadAndExecute<\/b> entry. Finally, I set the new ACE to the shortcut object again.<\/span><\/p>\n

Actually, this is it. If the file move was unsuccessful, then I write a message on the console.<\/span><\/p>\n

The following figures detail the user experience. These are the files here before archiving:<\/span><\/p>\n

<\/span> <\/span><\/p>\n

<\/span><\/p>\n

And this figure shows the directory after archiving:<\/span><\/p>\n

<\/span> <\/span><\/p>\n

<\/span><\/p>\n

As you can see, the files that were older than 30 days are replaced by shortcuts. The Date modified column contains the same dates for the shortcuts as the original files. The icons are almost the same.<\/span><\/p>\n

Let’s analyze the archive location now as seen in the following figure:<\/span><\/p>\n

<\/span> <\/span><\/p>\n

<\/span><\/p>\n

It has all the archived files and the same folder structure as the original data share.<\/span><\/p>\n

This figure gives us a view the file permissions on the shortcuts:<\/span><\/p>\n

<\/span> <\/span><\/p>\n

<\/span><\/p>\n

As you can see the permissions include explicit permissions only, and even the ModifyGroup<\/strong> that has modify permissions on the original file, has read & execute permissions now.<\/span><\/p>\n

Of course, the script can be developed further to make adjustments to the access control list of the archive, but it is already useful in this form.<\/span><\/p>\n

If you liked this post and need some help creating scripts, you can contact me by email:<\/span><\/p>\n

<\/span><\/p>\n

Tibor Soós<\/span><\/b> (soost@IQJB.hu<\/span><\/a>)<\/span><\/p>\n

Windows PowerShell MVP<\/span><\/p>\n

www.IQJB.hu<\/span><\/span><\/a><\/span><\/p>\n

 <\/span> <\/span><\/p>\n

ST, that is all there is to using Windows PowerShell to archive file shares.  <\/span>Thank you Tibor, for your time and for sharing your knowledge with us. Guest blogger week will continue tomorrow when we will have Trevor Sullivan talk about dynamic method invocation. <\/span><\/p>\n

I invite you to follow me on Twitter<\/span><\/a> or Facebook<\/span><\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/span><\/a> or post them on the Official Scripting Guys Forum<\/span><\/a>. See you tomorrow. Until then, peace.<\/span><\/p>\n

 <\/span><\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/span><\/b> <\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

   Summary: Learn how to use Windows PowerShell to archive file shares.   Hey, Scripting Guy! I am interested in using Windows PowerShell to archive file shares, is this something that can be done? — ST   Hello ST, Microsoft Scripting Guy Ed Wilson here. Welcome to guest blogger week. We welcome back Tibor Soos […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[56,3,185,12,75,45],"class_list":["post-16231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-guest-blogger","tag-scripting-guy","tag-shared-folders-and-mapped-drives","tag-storage","tag-tibor-soos","tag-windows-powershell"],"acf":[],"blog_post_summary":"

   Summary: Learn how to use Windows PowerShell to archive file shares.   Hey, Scripting Guy! I am interested in using Windows PowerShell to archive file shares, is this something that can be done? — ST   Hello ST, Microsoft Scripting Guy Ed Wilson here. Welcome to guest blogger week. We welcome back Tibor Soos […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16231"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16231\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}