add PDCRevocation dump files

cleanup comments
This commit is contained in:
2022-08-18 15:39:28 -04:00
parent 215a41fa05
commit d382ad80dd
+19 -12
View File
@@ -1,14 +1,14 @@
## When deleting temp files en masse, only delete files/folders older than the number of days specified here # When deleting temp files en masse, only delete files/folders older than the number of days specified here
$OlderThan = 7 $OlderThan = 7
$TimeDelta = New-TimeSpan -Days $OlderThan $TimeDelta = New-TimeSpan -Days $OlderThan
## Only run this section if we have administrative privileges # Only run this section if we have administrative privileges
If ( IsAdmin ) If ( IsAdmin )
{ {
LogMsg "Running with administrative privileges" LogMsg "Running with administrative privileges"
## Remove all *.evtx files from $SysTemp # Remove all *.evtx files from $SysTemp
$EventLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Filter *.evtx $EventLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Filter *.evtx
If ( $EventLogs ) If ( $EventLogs )
{ {
@@ -16,7 +16,7 @@ If ( IsAdmin )
ForEach ( $EventLog in $EventLogs ) { Remove-Item $EventLog -Force -ErrorAction SilentlyContinue } ForEach ( $EventLog in $EventLogs ) { Remove-Item $EventLog -Force -ErrorAction SilentlyContinue }
} }
## Remove misc logs and error reports # Remove misc logs and error reports
$MiscLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Include "${Env:COMPUTERNAME}-*.log", "AppxErrorReport_*.txt" $MiscLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Include "${Env:COMPUTERNAME}-*.log", "AppxErrorReport_*.txt"
If ( $MiscLogs ) If ( $MiscLogs )
{ {
@@ -24,7 +24,7 @@ If ( IsAdmin )
ForEach ( $MiscLog in $MiscLogs ) { Remove-Item $MiscLog -Force -ErrorAction SilentlyContinue } ForEach ( $MiscLog in $MiscLogs ) { Remove-Item $MiscLog -Force -ErrorAction SilentlyContinue }
} }
## Remove archived CBS logs # Remove archived CBS logs
$CBSLogs = Get-ChildItem -Path "${Env:SystemRoot}\Logs\CBS\*" -File -Include "CbsPersist_*.log", "CbsPersist_*.cab" $CBSLogs = Get-ChildItem -Path "${Env:SystemRoot}\Logs\CBS\*" -File -Include "CbsPersist_*.log", "CbsPersist_*.cab"
If ( $CBSLogs ) If ( $CBSLogs )
{ {
@@ -33,7 +33,7 @@ If ( IsAdmin )
} }
## Remove all system temp files older than 7 days # Remove all system temp files older than 7 days
$OldTempFiles = Get-ChildItem -Path "${Env:SystemRoot}\TEMP" | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } $OldTempFiles = Get-ChildItem -Path "${Env:SystemRoot}\TEMP" | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) }
If ( $OldTempFiles ) If ( $OldTempFiles )
{ {
@@ -41,7 +41,7 @@ If ( IsAdmin )
ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue } ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue }
} }
## Turn off system hibernation if it's in use # Turn off system hibernation if it's in use
If ( Test-Path "${Env:SystemDrive}\hiberfil.sys" ) If ( Test-Path "${Env:SystemDrive}\hiberfil.sys" )
{ {
LogMsg "Turning off system hibernation" LogMsg "Turning off system hibernation"
@@ -49,7 +49,14 @@ If ( IsAdmin )
Catch { LogErr $_.Exception.Message } Catch { LogErr $_.Exception.Message }
} }
## Remove Genetec application crash dumps # Remove PDCRevocation dump files
$PDCRevocationDumpFiles = Get-ChildItem -Path "${Env:SystemRoot}\LiveKernelReports\*" -File -Include "PDCRevocation-*.dmp"
If ( $PDCRevocationDumpFiles ) {
LogMsg "Deleting PDCRevocation dump files from ${Env:SystemRoot}\LiveKernelReports"
ForEach ( $PDCRevocationDump in $PDCRevocationDumpFiles ) { Remove-Item $PDCRevocationDump -Force -ErrorAction SilentlyContinue }
}
# Remove Genetec application crash dumps
If ( Test-Path "${Env:ProgramData}\Genetec\Dumps" ) { If ( Test-Path "${Env:ProgramData}\Genetec\Dumps" ) {
$GenetecCrashDumps = Get-ChildItem -Path "${Env:ProgramData}\Genetec\Dumps" $GenetecCrashDumps = Get-ChildItem -Path "${Env:ProgramData}\Genetec\Dumps"
If ( $GenetecCrashDumps ) If ( $GenetecCrashDumps )
@@ -60,7 +67,7 @@ If ( IsAdmin )
} }
} }
## Remove AutoCAD temp files # Remove AutoCAD temp files
If (-not (IsRunning -Name "acad") ) { If (-not (IsRunning -Name "acad") ) {
$AutoCADTempFiles = Get-ChildItem -Path "${Env:SystemDrive}\Users" | Where-Object { $_.PSIsContainer -eq $true } | ForEach-Object { Get-ChildItem -Path $($_.FullName + "\AppData\Local\Temp\*") -File -Include '*.ac$' -ErrorAction SilentlyContinue } $AutoCADTempFiles = Get-ChildItem -Path "${Env:SystemDrive}\Users" | Where-Object { $_.PSIsContainer -eq $true } | ForEach-Object { Get-ChildItem -Path $($_.FullName + "\AppData\Local\Temp\*") -File -Include '*.ac$' -ErrorAction SilentlyContinue }
If ( $AutoCADTempFiles ) { If ( $AutoCADTempFiles ) {
@@ -70,12 +77,12 @@ If ( IsAdmin )
} }
} }
## Only run this section if we don't have administrative privileges # Only run this section if we don't have administrative privileges
Else Else
{ {
LogMsg "Running without administrative privileges" LogMsg "Running without administrative privileges"
## Remove all system temp files older than 7 days # Remove all system temp files older than 7 days
$OldTempFiles = Get-ChildItem -Path $Env:TEMP | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } $OldTempFiles = Get-ChildItem -Path $Env:TEMP | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) }
If ( $OldTempFiles ) If ( $OldTempFiles )
{ {
@@ -83,7 +90,7 @@ Else
ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue } ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue }
} }
## Remove AutoCAD temp files # Remove AutoCAD temp files
If (-not (IsRunning -Name "acad") ) { If (-not (IsRunning -Name "acad") ) {
$AutoCADTempFiles = Get-ChildItem -Path "${Env:TEMP}\*" -File -Include '*.ac$' -ErrorAction SilentlyContinue $AutoCADTempFiles = Get-ChildItem -Path "${Env:TEMP}\*" -File -Include '*.ac$' -ErrorAction SilentlyContinue
If ( $AutoCADTempFiles ) { If ( $AutoCADTempFiles ) {