For an overview of File Classification Infrastructure, check Classifying files based on location and content using the File Classification Infrastructure (FCI) in Windows Server 2008 R2.

Previously we showed you how to expire stale data using File Management Tasks in Windows Server 2008 R2. Now let’s look at what else can be done with them.

As stated previously, File Management Tasks are a mechanism  to apply a simple command to a selected set of files on a scheduled basis. The trick to applying an action other than Expiration to the selected files is simply to change a drop down box on the Task’s Action tab. You can see the default action right here

 

The other option in the drop down is “Custom.” You can then specify an arbitrary executable with a series of parameters that will be run for each file that matches the conditions of the File Management Task. The only restriction is that the executable as well as the folder structure the command is contained in (as in all parent folders) must be writable for Administrator and System only. If we did not impose this restriction a non-authenticated user would be able to replace the command being run and that would be bad.

Here we’ve configured the command to be cmd.exe. The parameters indicate a script file should be launched and a parameter should be passed to that. When editing the parameters, you can use the dropdown list of macros to add them to the parameter list. They will be replaced with the correct values when the action is run. In this case we only use the file path of the file that matches the criteria.

The script being run here is the following one:

@call :MOVE_FILE %1
@goto :EOF

:MOVE_FILE
if EXIST "C:\Secondary\%~pnx1" @echo Target file already exists! & goto :EOF
md "C:\Secondary\%~p1"
move %1 "C:\Secondary\%~p1"
mklink %1 "C:\Secondary\%~pnx1"
@goto :EOF

This script basically

• looks at the folder structure of the file passed in as a parameter,
• creates a new directory under C:\secondary with that path,
• moves the file into that new directory, and
• uses mklink to create a soft link to the file in its original location

Effectively we built a simple form of Hierarchical Storage management with a few lines of batch scripting.

Since this script does alter files, we need to set the custom action to run as Local System. However, if your executable needs lower permissions, you can restrict the account it runs in further.

Now what else can we do with this? We could use it to

• Compact database files that haven’t been modified in a year (custom action of compact.exe with a condition of not modified for 365 days and a file name of *.mdb)
• Remove the Everyone ACL from all files older than 3 days (custom action using icacls.exe with the condition of created 3 days ago)
• Run a PowerShell script of your own design on all files (custom action using powershell.exe with no conditions)
• Generate a report of all files containing the word “confidential” that have not been modified in a year (custom command cmd.exe with no parameters, a condition that references a classification property with an appropriate classification rule that searches for the word “Confidential,” and setting the File Management Task report to be generated in the appropriate formats)

Remember that these File Management Tasks are scheduled and can happen as often or as rarely as you would like.

Tell us you think you could leverage custom File Management Tasks.

 This post is provided "AS IS" with no warranties, and confer no rights. Use of included code samples are subject to the terms specified at Microsoft - Information on Terms of Use.  

Post by Matthias Wollnik