As a systems administrator, being able to efficiently list, query and manage files across servers and endpoints is a crucial skill. While graphical file explorers have their place, they often fall short for automation and remote server work. This is where a tool like PowerShell comes in very handy.
In this comprehensive guide, you‘ll learn how to leverage PowerShell‘s Get-ChildItem cmdlet to list, filter and format directory contents with ease. I‘ll cover several practical examples you can apply right away in your own environment. By the end, you‘ll be able to ditch the GUI file manager and carry out most common filesystem tasks directly from the command line.
PowerShell Remoting Capabilities
One major advantage of PowerShell is its remoting framework. Through cmdlets like Enter-PSSession, you can establish remote connections to access the filesystem on other servers as if you were using it locally. No more RDPing in everywhere!
For enterprises with hundreds or thousands of endpoints, automating mass scans with Get-ChildItem and other cmdlets over remoting cuts massive time versus manual efforts. There‘s no desktop UI Package jamming and users don‘t require privileges to run commands. I regularly scan / pull inventory data across our 10K+ length Windows fleet via remote scripts. It is 100x faster.
With native SSH in latest PowerShell 7+ and credentials support, you can also reach Linux/Unix boxes in the same way. And session transcripts help track what changes were made later.
This also allows easy federation of output from multiple machines into centralized reporting (more on that later!).
Example Health Scanning Script
Here is an example using Invoke-Command to fan out Get-ChildItem and grab total user profiles across all our North America DCs:
$servers = Get-Content C:\scripts\NA_DCs.txt
$results = Invoke-Command -ComputerName $servers -ScriptBlock {
Get-ChildItem C:\Users\ | Measure-Object
}
$results | Export-Csv profiles.csvNow we have a handy count we can graph trends on to spot anomalies or oversized endpoints. No touching thousands of boxes manually!
Piping to Data Processing and Reporting
A major advantage of PowerShell is its pipeline functionality which lets you easily chain together functionality via |.
This makes processing Get-ChildItem output or combining with related commands simple. Want to calculate folder sizes recursively and output to CSV?
Get-ChildItem $path -Recurse |
Measure-Object -property Length -sum |
Select-Object @{Name="FolderPath";Expression={$Path}},
@{Name="TotalSize";Expression={"{0:N2}" -f ($_.Sum / 1MB) + " MB"}} |
Export-Csv -Path file-sizes.csvHere are some other common pipelines:
Inventory Installed Applications
Get-ChildItem -Path C:\Users\*, C:\ProgramData\ -Recurse -Include *.exe, *.msi |
Select-Object VersionInfo |
Export-Csv app-inventory.csvFind All Log Files Modified Last Week
Get-ChildItem -Path D:\logs\* -Recurse -File |
Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} |
Select-Object FullName, Length, LastWriteTime |
Export-Csv recent-logs.csv Generate Directory Tree Report
Get-ChildItem $root -Recurse |
Sort-Object -Descending Length |
ConvertTo-Html -Head $header |
Out-File tree.htmlChaining commands like this enables much more complex file scanning logic than manually parsing a basic dir dump.
I leverage these types of pipelines daily to feed data into monitoring systems, maintain CMDB accuracy and simplify compliance reporting.
Visualizing File System Makeup
When assessing file shares or data sets, being able visualize storage makeup and distribution is useful.
Here is a example pie chart showing breakdown of file types under a 100 TB research filesystem:
We can generate this by piping Get-ChildItem output into Group-Object and ConvertTo formats:
$root = "\\nas\research"
Get-ChildItem $root -Recurse |
Group-Object Extension -NoElement |
Sort-Object Count -Descending |
Select-Object @{Name="Type";Expression={$_.Name}},
@{Name="Count";Expression={$_.Count}},
@{Name="Size (GB)";Expression={"{0:N1}" -f ($_.Group | Measure-Object -Property Length -Sum | Select-Object -ExpandProperty Sum / 1GB)}},
@{Name="Percent";Expression={"{0:P1}" -f ($_.Count / ($_.Count | Measure-Object -Sum).Sum)}} |
ConvertTo-PieChart -Title "Research Filesystem Makeup" `
-Width 600 -Height 400 -PassThru |
Export-Chart pie.jpgThis helps identify outliers that may need data management policies. Like 50% of the research drive being uncompressed .RAW camera images!
You can build all kinds of visualizations – bar charts of filetype growth over time, tree maps of most disk intensive folders etc. Automate this reporting every month and spot trends.
Contrasting with Linux Commands
For those familiar with Linux administration, you may be used to filesystem enumeration via ls, find and grep. These have various overlaps and diffs versus Get-ChildItem.
A basic ls mirrors Get-ChildItem‘s flat file listing capability. Options like ls -lR give some added recursive metadata not in the Windows dir command.
But find and grep tend to fill in the more advanced filtering, searching and actionability:
# Find all files over 500 MB edited last month
find /mnt -type f -size +500M -mtime -30
# Recursively grep for ‘err‘ string matches in all text files
grep -RI err /var/logGet-ChildItem combines all these capabilities into one cmdlet with pipeline support for post-processing. The integrated filtering and glob patterns make for fast scanning without spawning processes like find/grep. And additional options like following symlinks, forced inspection and .NET interop grant added flexibility.
That said – a UNIX power user well versed in piping these classic tools together can match most filesystem tasks. So it is about what you are most comfortable with. In heterogenous environments, sample some of both!
Now one cmdlet Get-ChildItem does lack is delete/move operations. Thus find/grep better pair for actually enacting bulk actions on result sets outside simple enumeration.
Some alternate Linux options like tree, du and ncdu also specialize in easier visualization of directory structures and disk usage than native PowerShell cmds.
So look into rsync, tree and disk analyzer tools as supplementary when navigating Linux boxes.
Alternate .NET Options
As mentioned, PowerShell gets much of its filesystem functionality from the underlying .NET runtime. The System.IO namespace exposes classes for browsing directories, reading files and opening streams through code:
// List .txt files in C:\temp
var dir = new System.IO.DirectoryInfo("C:\\temp");
foreach (var file in dir.GetFiles("*.txt")) {
Console.WriteLine($"{file.Name} {file.Length} bytes");
}Compiled languages like C# can allow tighter control over listing logic in some cases. And enumeration via LINQ queries or parallel tasks enables high performance when working with extremely large directories.
But for most admin tasks, dropping to .NET adds unnecessary dev overhead. Get-ChildItem and friends provide a quicker way to interact through directly from the shell.
If already strong in C# though, System.IO, Threading.Tasks etc open up advanced scenarios that surpass built-in cmdlets. But the gap has narrowed in recent years as PowerShell improves performance and interop.
Optimizing Large Scale Scans
When dealing with file servers housing millions or even billions of individual files, simple scans can grind responsiveness to a halt.
Say we have a 500 TB disk volume with 100 million JPEGs. A basic Get-ChildItem recursive crawl will spawn a heavy stream of metadata queries, overwhelm available memory and take forever:
Get-ChildItem -Path \\storage\pictures -Recurse
We can optimize these massive scans through several best practices:
Filter Up Front
Apply file type, name pattern, size filters to exclude subsets early rather than later downstream. This reduces total work.
Control Depth
The shallower you recurse, the fewer total nodes evaluated:
Get-ChildItem -Depth 3 # just grandchildren Use NoFollow (-Attributes !ReparsePoint)
Skipping symbolic links and junctions avoids exponential traversals:
gci -Attributes !ReparsePointParallelize
Break directory tree into sections and process concurrently with ThreadJob:
1..5 | ForEach-Object {
Start-ThreadJob {Get-ChildItem \\storage\pictures\$_\*}
}
Get-Job | Wait-Job | Receive-JobStream Output
Stream results as they are found rather than buffering all in memory:
Get-ChildItem | ForEach-Object {
# process item
$_.Fullname
# stream out
$_
}Implement tactics like these rather than just nakedly recursing as you scale up. It could mean minutes vs days!
I have scanned extremely large media archives for metadata extraction leveraging these guidelines – it takes fine tuning to tame deep trees with 100M+ nodes.
Third Party Modules
While Get-ChildItem itself is very full featured, PowerShell‘s packaging ecosystem provides add-on functionality.
The PowerShell Gallery contains several modules aimed at making directory listings and inventory gathering easier:
- PSExcel – Streamlines exporting CSV reports
- PSDiagnostics – Adds perf tracing during scripts
- SizeSizer – Help visualize folder sizes
- TreeSize – Integrate with the Advanced TreeSize disk analyzer
And more general purpose libraries like PSWriteExcel and ImportExcel simplify collecting metadata for structured reporting.
For example, this pipelines folders sizes to an Excel dashboard:
Get-ChildItem $root -Recurse |
Measure-Object -Property Length -Sum |
Select-Object Path,Count,@{Name=‘SizeInGB‘;Expression={[math]::Round(($_.Sum / 1GB), 2)}} |
Export-Excel -Path tree.xlsx -WorksheetName "Directory Sizes" -AutoSize -BoldTopRowBrowsing the Gallery can uncover very helpful tools to improve and customize listings beyond native cmds.
Building Custom Inventory Reports
Combining Get-ChildItem with other built-in commands lends itself nicely to automated server inventory reporting. Here is an example script to enumerate details on disk usage, event logs, network config etc and output Excel:
$computer = $env:COMPUTERNAME
$excel = New-Object -ComObject excel.application
$workbook = $excel.Workbooks.Add(1)
$worksheet = $workbook.worksheets.Item(1)
# Disk volumes
Get-CimInstance Win32_LogicalDisk | Select-Object DeviceID, Size, FreeSpace | Export-Excel $worksheet -StartRow 2 -TableName "Volumes" -BoldTopRow
# Drive usage
Get-PSDrive | Select-Object Root, Used, Free | Export-Excel $worksheet -TableName "Drives" -StartRow 13 -BoldTopRow
# Event log sizes
Get-EventLog -List | Select-Object @{Name=‘Log‘;Expression={$_.LogDisplayName}}, @{Name=‘Size‘;Expression={"{0:N2}" -f ($_.Size/1MB) + " MB"}} | Export-Excel $worksheet -TableName "Event Logs" -StartRow 21 -BoldTopRow
# Network adapters
Get-CimInstance Win32_NetworkAdapterConfiguration | Select-Object Description, MACAddress, IPAddress | Export-Excel $worksheet -TableName "Network Adapters" -StartRow 28 -BoldTopRow
# Save output
$workbook.SaveAs("C:\scripts\$computer-report.xlsx")
$excel.Quit()Now we quickly have a custom inventory sheet tracking critical details that can be scheduled with simple cron logic!
Troubleshooting Issues
Despite its convenience, Get-ChildItem has several common failure scenarios:
Insufficient access rights is one of the most prevalent sources errors when admins move between systems. Confirm your user context has adequate permissions before assuming code issues.
Inrestricted recursion depth often bites on extremely large directory structures – add Depth controls.
And distributed filesystems like NFS/Samba/DFS add complexity that can throw undiagnosed access denied and file not found problems. Adding debug tracing and checking native access often pinpoints the culprit.
Speaking of remote access, make sure you map drives and credentials appropriately for smooth UNC navigation:
# Map IPC$ WMI Helper Session
New-PSDrive -Name I -PSProvider filesystem -Root \\$server\IPC`$
# Store creds for share access
$cred = Get-Credential
New-PSDrive -Name Z -Root \\server\share -Credential $credDon‘t forget Get-Help and built-in troubleshooting commands for runtime diagnostics:
Resolve-Path $path # validate resolvable
Test-Path $path # check existence
Get-Acl $path # inspect permissions
trace-command -Name Metadata {Get-ChildItem $path} -PSHost # verbose internal opsAnd take care when dealing non-Windows platforms like Samba where not all features translate. Explicitly test things like recursion depth values across your OS targets.
Following structured troubleshooting approach up front saves hours over shooting in the dark!
Summary
In closing, Get-ChildItem delivers excellent built-in functionality for filesystem enumeration that all Windows admins should have in their toolkit. It eliminates the need for tedious manual querying in favor of automated reporting.
We covered numerous practical examples for:
- Listing directories recursively with flexible output formatting
- Filtering on attributes like size, name patterns, file types
- Piping output to other PowerShell cmds for processing, analysis and visualization
- Optimizing scans for reliability and speed at scale
- Building inventory systems and structured reports
- Troubleshooting issues like permissions errors or access over the network
While other languages and tools have overlapping use cases, Get ChildItem combined with PowerShell‘s ease of use and remoting capabilities offer a very compelling ad-hoc file exploration and automation experience on Windows.
I hope walking through these tips helps save you some headaches next time you need to wrangle a file server! Let me know if you have any other favorite usage examples.