Hi all,
I am trying to use PS for searching for a file.
If I do this:
dir pwsh.exe /s
I finds the file, output like this:
> C:\Users\Matt>dir pwsh.exe /s
> Volume in drive C has no label.
> Volume Serial Number is 08CA-237C
>
> Directory of C:\Users\Matt\AppData\Local\Microsoft\WindowsApps
>
> 08/13/2022 06:29 AM 0 pwsh.exe
> 1 File(s) 0 bytes
>
> Directory of C:\Users\Matt\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShell_8wekyb3d8bbwe
>
> 08/13/2022 06:29 AM 0 pwsh.exe
> 1 File(s) 0 bytes
>
> Total Files Listed:
> 2 File(s) 0 bytes
> 0 Dir(s) 95,454,371,840 bytes free
It finds the files.
When I do this:
Get-ChildItem C:\ -Recurse | Where {$_.Name -match “pwsh.exe”}
It does not find it:
> PS C:\> Get-ChildItem C:\ -Recurse | Where {$_.Name -match "pwsh.exe"}
> Get-ChildItem: Access to the path 'C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Configuration' is denied.
> Get-ChildItem: Access to the path 'C:\Program Files (x86)\Google\CrashReports' is denied.
> Get-ChildItem: Access to the path 'C:\Program Files (x86)\Google\Update\Install\{3514FE74-C32E-494B-AD28-064CF411C750}\CR_27118.tmp' is denied.
> Get-ChildItem: Access to the path 'C:\Users\postgres' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\appcompat\appraiser' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\appcompat\Programs' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\CSC' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\LiveKernelReports' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Logs\SystemRestore' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Minidump' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\ModemLogs' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\PLA\Reports' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\PLA\Rules' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\PLA\Templates' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Prefetch' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Provisioning\Autopilot' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Resources\Themes\aero\VSCache' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\security\audit' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\security\cap' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\ServiceProfiles\LocalService' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\ServiceProfiles\NetworkService' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\ServiceState' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\Com\dmp' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\config' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\Configuration' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\drivers\DriverData' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\DriverState' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\HvsiSettingsProviders\Stage' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\ias' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\LogFiles\WMI' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\MsDtc' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\networklist' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\SleepStudy' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\spool\PRINTERS' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\spool\SERVERS' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\sru' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\Tasks' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\Tasks_Migrated' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\wbem\MOF' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\System32\WDI' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SystemTemp' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\Com\dmp' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\config' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\Configuration' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\Msdtc' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\NetworkList' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\sru' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\SysWOW64\Tasks' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\Temp' is denied.
> Get-ChildItem: Access to the path 'C:\Windows\WUModels' is denied.
Any ideas why?
Thanks!
