Help with signed/unsigned Drivers script

by ab1000 at 2013-02-01 15:44:55

Hi,

I am trying to add two properties (from a separate command) to gwmi win32_baseservice. The two fields would be infName and isSigned, both of which come from the driverquery /S $_ /SI /FO csv | ConvertFrom-Csv command.

I would like it to run this against a target file of hosts and to export as a single .csv with each line containing SystemName, name, displayname, pathname, state, and the two from above (infName and isSigned) in order to do quick analysis about the characteristics of unsigned drivers.

The code I have so far is below. It runs but is very slow compared to running either command on their own, and seems to ignore most drivers. My loops are likely improperly positioned, and any suggestions would be great. Additionally, the deviceName property from the driverquery command matches perfectly with the displayName property from gwmi win32-baseservice, which is what I tried to filter on. Thanks for any help!

##############################################
function get-drivers
{
$hostyname = $_
$Drivers = driverquery /S $hostyname /SI /FO csv | ConvertFrom-Csv

foreach ($driver in $drivers)
{

$device_name = $driver.DeviceName
$signed_or_not = $driver.IsSigned
$inf_name = $driver.infName

gwmi win32_baseservice -ComputerName $hostyname -Filter "displayname=‘$device_name’" | <br>Add-Member -MemberType noteproperty -name _signed -Value $signed_or_not -Force -PassThru |
Add-Member -MemberType noteproperty -name _infName -Value $inf_name -Force -PassThru | `
select systemname, name, displayname, pathname, state, _signed, _infName
}
}
################################################
# To run it...
gc c:\targets.txt | foreach { get-drivers } | Export-Csv C:\drivers.csv -NoTypeInformation
by DonJ at 2013-02-02 10:03:32
As a note, you can use the CODE button in the toolbar to format your script in the forums.

From a naming perspective, consider "Get-Driver." It’s more consistent with PowerShell’s naming conventions.

I don’t see your loops being improper. WMI queries can sometimes take a while, is all. No suggestions for you there. In terms of ignoring most drivers, I also don’t have any suggestions. If Driverquery is returning everything, then it should have everything. If you could give me some more detail on what isn’t working, it’d help - I can’t run your code in my environment, so I’m just looking at it trying to guess.
by ab1000 at 2013-02-02 10:40:01
Driverquery and the gwmi win32_baseservice both return data on around 40 drivers when run individually, but when I run this script with the -filter option, only about 10 results come back. The slowness of the -filter is allowable but not the missing results, which is my main bit of confusion.
by DonJ at 2013-02-02 13:01:54
And you’re 100% sure there’s a 100% perfect match between what’s in $device_name and displayname?
by ab1000 at 2013-02-02 14:11:21
Drat, there is not. I just assumed there was 1:1…

So maybe if the functions get reversed, so that gwmi is called first, then we run driverquery below, put in a -query based on ($device_name -match $displayname) and add in the desired properties (path, startType, status, etc), it will work well enough. Would perhaps an IF statement be better than -query for speed?
by DonJ at 2013-02-02 14:17:33
I’m not sure what you mean by -query… sorry, I’m not following your proposed logic. If you’re referring to the -query parameter of Get-WmiObject, it can’t use the -match operator. It uses WQL.