How to Get Last Modified File in Directory Using PowerShell and ADAudit Plus

How to get last modified file in directory using PowerShell

• Identify the domain from which you want to retrieve the report.
• Find the LDAP attributes you need to fetch the report.
• Identify the primary DC to retrieve the report.
• Compile the script.
• Execute it in Windows PowerShell
• The report will be exported in the specified format.
• To obtain the report in a different format, modify the script accordingly.

Sample Windows PowerShell script

The following script fetches the name of the files and corresponding subfolders that have been modified in the 'Logs' folder within the past '1' day along with the time when the files were modified.

$path="C:\Windows\Temp"
$NoOfDirs=Get-ChildItem $path | Where-Object {$_.PSIsContainer -eq $True}
ForEach($dir in $NoOfDirs )
{
Get-ChildItem  "$path\$($dir.name)" -Recurse |
Where-Object {($_.LastWriteTime -gt ([DateTime]::Now.Adddays(-1))) -and ($_.PSIsContainer -eq $False) } |
Select-Object @{l='Folder';e={$dir.Name}},Name,LastWriteTime |
Sort-Object  -pro LastWriteTime -Descending |
Select -First 1
}
Out-File -FilePath C:\Windows\Logs\Report1.html

(Mention the location where report needs to be saved)

To obtain the files last modified in a different folder, specify the appropriate folder path in the script.

$path="Desired folder path"

The report can be fetched in .csv or .txt format by altering the same.

Out-File -FilePath C:\Windows\Logs\Report1.csv

Sample output:

Steps to get last modified file in directory using ADAudit Plus

• Navigate to File Audit -> File Audit Reports -> Files Modified.
• Select the required 'Domain' from the drop down option on the top right corner.
• Select 'Export As' to export the report in any of the preferred formats (CSV, PDF, HTML, and XLS).

In addition to the name of the file and time of modification, the following are some of the details provided by AD Audit Plus:

• Who modified the file.
• Domain and server the file is located at.
• File type.
• Client IP and machine name.
• Type of access.