The Get‑ItemProperty is a PowerShell cmdlet used to
retrieve the properties of an item, whether that be a file,
registry key, or certificate in a PowerShell provider namespace.
Provider namespace is a structure that represents the datastore,
such as a filesystem or registry itself.
When you use the Get‑ItemProperty cmdlet,
you specify the path of the item you want to retrieve properties for
and the name of the properties you want to retrieve.
All right, we're going to look at this Get‑ItemProperty cmdlet.
We're going to run through a quick couple of demos.
First, we're just looking at one file.
We're looking at the calculator.
We're going to see what it brings back.
This first run through not a whole lot of information.
We just see that it has the a attribute,
which is for archive, just the LastWriteTime,
and a few other details.
So let's expand that out using that Select‑Object with the * command,
just to kind of get a little bit more detail on the application itself.
Now this brought back a ton of good information, right?
When it was created, when it was last accessed,
the write time, you're going to see some information here on the FileVersion,
the ProductVersion, a lot of good information there.
So this is how you get core information around the files within your filesystem.
So if you find a file that's in there that you have no idea what it is,
how it got there,
you could run this Get‑ItemProperty tool against it and
get all this good information on it.
Now we're going to jump down here to the next item,
and instead of looking at a single file,
we're going to look at an entire directory.
We're going to look at the Program Files directory.
We're going to get a lot of good information around what files
are in there and what their creation time is.
It would also be good if we went back and added the version.
So if we get the version of these tools, that would be just as well.
But that's how you see an entire folder.
So if you want to know what's in your servers,
what's in your desktops,
you can run this Get‑ItemProperty against an entire folder on
the remote computer on your local computer and pull what
files are in each of your systems.
So now we've looked at a file, we've looked at a folder,
let's bump that up one more,
and we're going to look at what's in this registry key.
So what's in the Uninstall folder?
Well, that's everything that you have installed,
and it tells the system how to uninstall it.
It includes a lot of information in the object on what the file is,
what version of the file, so when we look at it,
we're going to see three files in there.
We're going to see the version of those files,
who published it, and what data was installed on.
Now that's really key information there,
especially if it's a file you don't know what it is,
where it came from.
If you're seeing stuff in this uninstalled folder that you didn't install,
that's a red flag right there.
So we're going to expand this out a little bit more now.
And instead of just looking at these three key features,
what we're going to say is we're going to do this search on a remotecomputer.
So if you have a server, or if you have multiple servers,
you can run a loop here and input into there,
I want to pull the files in the Uninstall full of all these remote computers.
Once you do that, you're going to get the same information.
And what's key here is that version because if you can pull
the name of the file plus the version,
you could compare it to databases out there that tell
you what are the vulnerabilities, what you need to go and patch,
where can you get patches, what is the latest?
So there's a lot of good information that you can pull,
and it specifically tells you what software you have
installed that you may not even know you had.