Powershell returns different information using remote connection

Question

On my target computer in PowerShell I run command $FolderSize =(Get-ChildItem "C:\Users\JDoe" -force -Recurse -ErrorAction SilentlyContinue | Measure-Object length -sum).sum

and I get a value of 0.76 gb, which accurately corresponds to the compressed size of the folder on disk. However, when I try to run the command on a remote computer using

$folderSize = Invoke-Command -ComputerName "computername" {(Get-ChildItem -Path "C:\Users\JDoe" -Recurse -force -ErrorAction SilentlyContinue | Measure-Object -Property Length -sum).sum} I get a different, MUCH larger number, 17 gb.

I tried running the first command in a pssession but still get the 17gb result. I also tried using

psexec \\\computername powershell "(Get-ChildItem "C:\Users\JDoe" -force -Recurse -ErrorAction SilentlyContinue | Measure-Object length -sum).sum" but still get the larger number.

I don't understand why the results obtained remotely are different than the actual size of the folder when I examine it locally. At least all the remote results are consistent, which tells me they are all measuring the same thing.

Answer 1

This is due to a junction in AppData\Local named Application Data that points back to AppData\Local

It appears that you can access this junction remotely (even from explorer using \\COMPUTER01\C$\Users\JDoe\AppData\Local\Application Data) so this is why you're getting different sizes, as it's recursively counting the same stuff up to the MAX_PATH limit.

Compare the following command's outputs on remote vs local:
Get-ChildItem 'C:\Users\JDoe\AppData\Local\Application Data' -Force

Local

PS C:\> Get-ChildItem 'C:\Users\JDoe\AppData\Local\Application Data' -Force
Get-ChildItem : Access to the path 'C:\Users\JDoe\AppData\Local\Application Data' is denied.
At line:1 char:1
+ Get-ChildItem 'C:\Users\JDoe\AppData\Local\Application Data' -Forc ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : PermissionDenied: (C:\users\JDoe\A...plication Data\:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

Remote

PS C:\> Invoke-Command -ComputerName COMPUTER01 -ScriptBlock { Get-ChildItem 'C:\Users\JDoe\AppData\Local\Application Data' -Force }


    Directory: C:\Users\JDoe\AppData\Local\Application Data


Mode                LastWriteTime         Length Name                        PSComputerName
----                -------------         ------ ----                        --------------
d--hsl        4/16/2020   4:46 PM                Application Data            COMPUTER01
d-----       10/31/2019   9:43 AM                ConnectedDevicesPlatform    COMPUTER01
d-----       10/31/2019   9:52 AM                ElevatedDiagnostics         COMPUTER01
d-----       10/31/2019   9:43 AM                Google                      COMPUTER01
d--hsl        4/16/2020   4:46 PM                History                     COMPUTER01
d-----        4/16/2020   4:50 PM                Microsoft                   COMPUTER01
d-----        9/16/2019   8:14 PM                Microsoft Help              COMPUTER01
d-----       10/31/2019   9:43 AM                MicrosoftEdge               COMPUTER01
d-----       10/31/2019   9:53 AM                OpenShell                   COMPUTER01
d-----        4/16/2020   4:47 PM                Packages                    COMPUTER01
d-----       10/31/2019   9:43 AM                PlaceholderTileLogoFolder   COMPUTER01
d-----       10/31/2019   9:43 AM                Publishers                  COMPUTER01
d-----        3/18/2019  11:52 PM                Temp                        COMPUTER01
d--hsl        4/16/2020   4:46 PM                Temporary Internet Files    COMPUTER01
d-----       10/31/2019   9:43 AM                VirtualStore                COMPUTER01

You will need to recurse separately from Get-ChildItem by using a recursive function like the one in this answer.

Answer 2

Thanks for all the suggestions! Ultimately, I opted to use Sysinternals "du" app and capture the output in a remote job, so as to minimize network traffic.

Thanks again!