I'm writing a PowerShell script that takes a series of remote computer names and runs a custom malware scan on a targeted subdirectory on each computer. I have successfully used psexec to accomplish this from the command line, but now want to use a PowerShell script. psexec resident on my computer and the antimalware application (MpCmdRun) is resident on the target computer:
"C:\Program Files (x86)\Sysinternals\psexec.exe" \\computername "C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" -scan -scantype 3 –File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\
My first attempt to use a PowerShell script used the Invoke-Command cmdlet:
Import-CSV D:\test.csv | ForEach-Object { $computer = $_.ComputerName Invoke-Command -computername $computer {"C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" -scan -scantype 3 -File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\} }
I received the following error message:
You must provide a value expression on the right-hand side of the '-' operator.
At H:\My Documents\PowerShell Scripts\specialscan2.ps1:15 char:112
+ Invoke-Command -computername $computer {"C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe" – < <<< scan -scantype 3 -File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\}
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : ExpectedValueExpression
I have had some success with the following script:
$computers = Get-Content "D:\ test.csv" ForEach ($computer in $computers) { if (Test-Connection -Computername $computer -quiet) { & "C:\Program Files (x86)\Sysinternals\psexec.exe" \\$computer "C:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan -scantype 3 -File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\ } else { "$computer is not online" } }
This script does run the desired antimalware scan but I still am getting this error:
psexec.exe :
At H:\My Documents\PowerShell Scripts\specialscan1A.ps1:10 char:6
+ & <<<< "C:\Program Files (x86)\Sysinternals\psexec.exe" \\$computer "C:\Program Files\Microsoft Security Client\MpCmdRun.exe" -scan -scantype 3 -File C:\ProgramData\Microsoft\Search\Data\Applications\Windows\
+ CategoryInfo : NotSpecified: (:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
What am I missing? Is there a better approach to this task (e.g. Get-Process or another cmdlet)?