CODEWITHSUNDEEP
windowspowershell
Vish
Vish

Reputation: 466

Check if a script has run atleast once before

Is there a way to see if any PowerShell script has executed at-least once before, without the script itself creating any logs? I.e. is there some sort of a native record keeping mechanism for already executed scripts (an example would be an event generating and hence creating an event log), meaning a log of the script actually executed was made at runtime but externally?

For example : If script A was executed once today, check during the second execution (say 2 days later) of script A if it had already executed before.

Can this be done through any Event logs, or through environment variables?

EDIT: Please note, for this particular script, no text files or logs can be made. Is there a way to do this without actually leaving a trace "physically" but instead relying on any parameters being set when a script executes?

EDIT2: This script would be executing with the least of privileges, so not only an account which does not have admin permissions, but would also not have approved permissions to create text or log files.

Upvotes: 0

Views: 1057

Answers (1)

vonPryz
vonPryz

Reputation: 24071

How about self-modifying code? It's technically cheating, as the change is being done in the script file itself. No external logging is done, though.

write-host -nonewline "Script has started"
$src = get-content $MyInvocation.MyCommand
$header = $src[0]
if($header -notmatch "^#") {
  write-host " ...first time!" 
  $newScript = @()
  $newScript += "#"
  $newScript += $src
  set-content $MyInvocation.MyCommand $newScript
} else { write-host " ...nth time!" }

The script reads its own contents. If the first line doesn't start with a hash, it's the first invokation. The script then creates a new set of source code. The first line is a hash, original source comes after that. Then the original script is overwritten.

As a side note, the requirement to log-but-not-log is self-contradictory just as @Mathias R. Jessen pointed out. There is, however, process tracking audit available in Windows. Also, there is script block logging. In theory (and with proper permissions), one might search the Windows' event logs for previous run attempts.

I'd much rather pop the why stack and find out the underlying reason, as the requirement to eat and keep a cacke sounds very much like an XY problem.

Upvotes: 1

Related Questions