How do I handle file access authorization in powershell across a domain?

Question

I'm working on a Powershell script that starts from the Domain Controller of a network, and it accesses the local documents folder of every user on every workstation. All I need to do is list the contents of the documents directory, as well as the contents of any subdirectories. The initial access works well, and I'm able to get a readout of all the items for a user's documents dir, but as soon as I start accessing subdirs, I run into an UnauthorizedAccessException error, and I don't see an obvious reason why.

Add-Content : Access to the path '\\***-021.****.local\c$\Users\*******\Documents\CyberLink' is denied.
At C:\***\Powershell\DocuTriever\Docutriever v1.ps1:30 char:17
+                 Add-Content -Path $path "$($item.Name)"
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (\\***-021.****....ments\CyberLink:String) [Add-Content], UnauthorizedAccessException
    + FullyQualifiedErrorId : GetContentWriterUnauthorizedAccessError,Microsoft.PowerShell.Commands.AddContentCommand

(I've replaced some names for privacy's sake) I can see that the error points to the use of Add-Content, which implies it still was able to get the items with Get-childitem, but I don't understand why that command is failing. I'm accessing the name in a test-path check a few lines before.

Below I've posted the two main functions I use for this. Get-UserDocuments checks to see if a user even has documents, and sets up the output file. Show-FolderContents recursively goes into folders, and print out the contents into the out folder.

function Get-UserDocuments($path, $user, $computerName) {
    Write-Host "Working on user $($user.name)"

    $documents = "\\$($computer.DNSHostName)\c$\Users\$($user.Name)\Documents"
    if ((Test-Path -path $documents) -and (Test-Path -path "$documents\*")) {
        $path = "$path\$($user.Name).txt"
        New-Item -Path $path -ItemType file
        Show-FolderContents -path $path -folder $documents
    }
    else {
        Write-Host "$($user.name) has no local documents"
    }
}

function Show-FolderContents($path, $folder) {
    $items = get-childitem -path $folder | Select-Object Name

    if ($items) {
        Add-Content -Path $path $folder
        foreach ($item in $items) {
            if (Test-Path -Path "$folder\$($item.name)" -PathType Container) {
                Show-FolderContents -Path "$folder\$($item.name)" -Output $path
            }
            else {
                Add-Content -Path $path "$($item.Name)"
            }
        }
        Add-Content -Path $path ""
    }
    else {
        Add-Content -Path $path "$folder is empty"
    }

}

Anybody know what I've done wrong, or how to track down the source of the error?

Answer 1

Add-Content is what's throwing your error. This CMDLet is used to echo data onto the end of a file. (Similar to bash echo "value" >> file)

You're effectively attempting to write either a null value or "$folder is empty" into whatever is currently your $path variable with your Add-Content commands.

GCI (Get-ChildItem) already has a folder recursive feature. You can probably greatly simplify your code using that CMDlet.