Phone Get Quote
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to Get Last Modified File in Directory Using PowerShell and ADAudit Plus

Continuous monitoring of file modifications is essential to keep tabs on unauthorized changes and to identify anomalous file accesses. IT administrators need to keep track of all the changes made to critical files, not only to fulfill compliance requirements but to defend against external and internal data breaches

The following is a comparison between the procedures for obtaining the last modified file in Windows file server with PowerShell and ADAudit Plus.


How to get last modified file in directory using PowerShell

  • Identify the domain from which you want to retrieve the report.
  • Find the LDAP attributes you need to fetch the report.
  • Identify the primary DC to retrieve the report.
  • Compile the script.
  • Execute it in Windows PowerShell
  • The report will be exported in the specified format.
  • To obtain the report in a different format, modify the script accordingly.

Sample Windows PowerShell script

The following script fetches the name of the files and corresponding subfolders that have been modified in the 'Logs' folder within the past '1' day along with the time when the files were modified.

$NoOfDirs=Get-ChildItem $path | Where-Object {$_.PSIsContainer -eq $True}
ForEach($dir in $NoOfDirs )
Get-ChildItem  "$path\$($" -Recurse |
Where-Object {($_.LastWriteTime -gt ([DateTime]::Now.Adddays(-1))) -and ($_.PSIsContainer -eq $False) } |
Select-Object @{l='Folder';e={$dir.Name}},Name,LastWriteTime |
Sort-Object  -pro LastWriteTime -Descending |
Select -First 1
Out-File -FilePath C:\Windows\Logs\Report1.html
Click to copy entire script

(Mention the location where report needs to be saved)

To obtain the files last modified in a different folder, specify the appropriate folder path in the script.

$path="Desired folder path"

The report can be fetched in .csv or .txt format by altering the same.

Out-File -FilePath C:\Windows\Logs\Report1.csv

Sample output:


ADAudit Plus

Steps to get last modified file in directory using ADAudit Plus

  • Navigate to File Audit -> File Audit Reports -> Files Modified.
  • Select the required 'Domain' from the drop down option on the top right corner.
  • Select 'Export As' to export the report in any of the preferred formats (CSV, PDF, HTML, and XLS).

In addition to the name of the file and time of modification, the following are some of the details provided by AD Audit Plus:

  • Who modified the file.
  • Domain and server the file is located at.
  • File type.
  • Client IP and machine name.
  • Type of access.


Following are some limitations to obtaining a report on last modified file using native tools like Windows PowerShell:

  • We can run this script only from the computers which have Active Directory Domain Services role.
  • To monitor last modified file in different folders, the PowerShell code has to be executed each time. Altering the folder path each time is practically impossible while monitoring hundreds (or more) of folders in a domain.
  • Applying more filters will increase the LDAP query complexity.
  • In order to export the report in other formats, the script needs to be modified each time.
  • Getting reports in different date formats, and time zones can be challenging.

ADAudit Plus will automatically scan all DCs in the domain to retrieve information about last modified file, generate the report and present it in a simple and intuitively designed UI.

  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By