Blog

<#
.SYNOPSIS
    Lists the largest files in a directory with a truncated display and full detail lookup.

.DESCRIPTION
    This script recursively scans a specified directory (or the current directory by default),
    sorts all files by size in descending order, and displays the top N largest files as specified by the user.
    It shows a truncated file name and full path for a neat table view.
    After displaying the table, the user can choose an index (or "all") to view full details of the file(s).

.NOTES
    Run as Administrator if scanning protected directories.
#>

# Function to convert bytes to a human-readable format.
function Convert-BytesToHumanReadable {
    param ([long]$bytes)
    if ($bytes -ge 1PB) {
        return "{0:N2} PB" -f ($bytes / 1PB)
    }
    elseif ($bytes -ge 1TB) {
        return "{0:N2} TB" -f ($bytes / 1TB)
    }
    elseif ($bytes -ge 1GB) {
        return "{0:N2} GB" -f ($bytes / 1GB)
    }
    elseif ($bytes -ge 1MB) {
        return "{0:N2} MB" -f ($bytes / 1MB)
    }
    elseif ($bytes -ge 1KB) {
        return "{0:N2} KB" -f ($bytes / 1KB)
    }
    else {
        return "$bytes B"
    }
}

# Function to truncate long strings.
function Truncate-String {
    param (
        [Parameter(Mandatory = $true)]
        [string]$str,
        [int]$maxLength = 50
    )
    if ($str.Length -gt $maxLength) {
        return $str.Substring(0, $maxLength - 3) + "..."
    }
    else {
        return $str
    }
}

# Prompt the user for the directory to scan (default is current directory).
$directory = Read-Host "Enter the directory to scan (or press Enter for current directory)"
if ([string]::IsNullOrWhiteSpace($directory)) {
    $directory = (Get-Location).Path
}

if (-not (Test-Path $directory)) {
    Write-Error "Directory '$directory' does not exist."
    exit
}

# Prompt the user for the number of items to list.
$numberOfItems = Read-Host "Enter the number of largest files to list"
if (-not [int]::TryParse($numberOfItems, [ref]$null)) {
    Write-Error "Invalid number entered. Please enter a valid integer."
    exit
}
$numberOfItems = [int]$numberOfItems

Write-Host "Scanning directory '$directory' for files..." -ForegroundColor Cyan

# Recursively retrieve all files within the specified directory.
try {
    $files = Get-ChildItem -Path $directory -File -Recurse -ErrorAction SilentlyContinue
} catch {
    Write-Error "Error retrieving files: $_"
    exit
}

if (!$files) {
    Write-Host "No files found in '$directory'."
    exit
}

# Sort the files by size (Length) descending and take the top N items.
$largestFiles = $files | Sort-Object Length -Descending | Select-Object -First $numberOfItems

# Build a table with an index and truncated file name and path.
$i = 1
$result = foreach ($file in $largestFiles) {
    [PSCustomObject]@{
        Index         = $i
        "File Name"   = Truncate-String -str $file.Name -maxLength 30
        "Full Path"   = Truncate-String -str $file.FullName -maxLength 60
        "Size (Bytes)"= $file.Length
        "Size (Human)"= Convert-BytesToHumanReadable -bytes $file.Length
    }
    $i++
}

# Display the results in a formatted table.
Write-Host "`nTop $numberOfItems largest files in '$directory':" -ForegroundColor Green
$result | Format-Table -AutoSize

# Allow the user to view full details if needed.
$choice = Read-Host "`nEnter a file index to view full details, type 'all' to view details for all files, or press Enter to exit"
if (-not [string]::IsNullOrWhiteSpace($choice)) {
    if ($choice -match '^(all)$') {
        Write-Host "`nFull details for all files:" -ForegroundColor Cyan
        $largestFiles | Format-List *
    }
    elseif ([int]::TryParse($choice, [ref]$null)) {
        $index = [int]$choice
        if ($index -ge 1 -and $index -le $largestFiles.Count) {
            Write-Host "`nFull details for file at index $($index):" -ForegroundColor Cyan
            $largestFiles[$index - 1] | Format-List *
        }
        else {
            Write-Host "Invalid index entered." -ForegroundColor Yellow
        }
    }
}

<#
.SYNOPSIS
    Audits local user accounts by listing their enabled/disabled status and last logon time.

.DESCRIPTION
    This script retrieves local user accounts using Get-LocalUser and then obtains last logon information
    for each account by parsing the output of the "net user" command. It outputs a table showing each account's name,
    whether it is enabled, and its last logon time (or "Never" if the account has not logged on).

.NOTES
    Run as Administrator if necessary.
#>

function Get-LastLogonNetUser {
    param (
        [Parameter(Mandatory = $true)]
        [string]$UserName
    )

    # Execute the "net user" command for the given user
    $netUserOutput = net user $UserName 2>&1

    # Look for a line that contains "Last logon"
    $lastLogonLine = $netUserOutput | Where-Object { $_ -match "Last logon" }
    if ($lastLogonLine) {
        # The expected format is something like:
        #   Last logon                   2/12/2021 3:45:30 PM
        # Remove the label text and trim spaces to isolate the date/time string.
        $logonValue = ($lastLogonLine -replace ".*Last logon\s+", "").Trim()
        if ($logonValue -match "Never") {
            return "Never"
        }
        else {
            # Attempt to parse the logon value as a DateTime.
            try {
                $dt = [DateTime]::Parse($logonValue)
                return $dt
            }
            catch {
                return $logonValue
            }
        }
    }
    else {
        return "Unknown"
    }
}

# Retrieve local user accounts.
try {
    $localUsers = Get-LocalUser
} catch {
    Write-Error "Failed to retrieve local users. Ensure this is run on a supported version of Windows with appropriate permissions."
    exit
}

# Prepare an array to store the audit results.
$result = @()

foreach ($user in $localUsers) {
    $userName = $user.Name
    $lastLogon = Get-LastLogonNetUser -UserName $userName

    $result += [PSCustomObject]@{
        Name      = $userName
        Enabled   = $user.Enabled
        LastLogon = $lastLogon
    }
}

# Output the results in a formatted table.
$result | Format-Table -AutoSize