41 lines
2.1 KiB
PowerShell
41 lines
2.1 KiB
PowerShell
$ErrorActionPreference = 'Continue'
|
|
Write-Output "=== KFM Check: $env:COMPUTERNAME ==="
|
|
Write-Output ""
|
|
Write-Output "--- Logged on users ---"
|
|
query user 2>&1 | ForEach-Object { Write-Output $_ }
|
|
Write-Output ""
|
|
Write-Output "--- OneDrive.exe processes ---"
|
|
$odProcs = Get-CimInstance Win32_Process -Filter "Name='OneDrive.exe'" -EA SilentlyContinue
|
|
if ($odProcs) {
|
|
foreach ($p in $odProcs) {
|
|
$o = $p.GetOwner()
|
|
Write-Output " Running as: $($o.Domain)\$($o.User)"
|
|
}
|
|
} else { Write-Output " Not running" }
|
|
Write-Output ""
|
|
Write-Output "--- User profile OneDrive folders ---"
|
|
Get-ChildItem C:\Users -Directory -EA SilentlyContinue |
|
|
Where-Object { $_.Name -notin @('Public','Default','Default User','All Users') } |
|
|
ForEach-Object {
|
|
$od = Get-ChildItem $_.FullName -Directory -Filter 'OneDrive*' -EA SilentlyContinue
|
|
Write-Output " $($_.Name): $(if ($od) { $od.Name -join ', ' } else { 'no OneDrive folder' })"
|
|
}
|
|
Write-Output ""
|
|
Write-Output "--- Loaded HKU shell folders ---"
|
|
Get-ChildItem 'Registry::HKEY_USERS' -EA SilentlyContinue |
|
|
Where-Object { $_.Name -match 'S-1-5-21' -and $_.Name -notmatch '_Classes' } |
|
|
ForEach-Object {
|
|
$sid = $_.PSChildName
|
|
try { $un = ([System.Security.Principal.SecurityIdentifier]$sid).Translate([System.Security.Principal.NTAccount]).Value } catch { $un = $sid }
|
|
Write-Output " User: $un"
|
|
$sf = Get-ItemProperty "Registry::HKEY_USERS\$sid\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -EA SilentlyContinue
|
|
if ($sf) {
|
|
$d = $sf.Personal
|
|
$dt = $sf.Desktop
|
|
$dl = $sf.'{374DE290-123F-4565-9164-39C4925E467B}'
|
|
Write-Output " Documents: $d$(if ($d -like '*OneDrive*') { ' [KFM ACTIVE]' })"
|
|
Write-Output " Desktop: $dt$(if ($dt -like '*OneDrive*') { ' [KFM ACTIVE]' })"
|
|
Write-Output " Downloads: $dl$(if ($dl -like '*OneDrive*') { ' [KFM ACTIVE]' })"
|
|
} else { Write-Output " Shell Folders key not present (user not logged in or hive not loaded)" }
|
|
}
|