'DomainVHDaudit.vbs
On Error Resume Next 
Const ForWriting = 2
' Format date/time stamp for output file
strTimeDate = Year(Date) & "-" & Month(Date) & _
 "-" & Day(Date) & "~~" & Hour(Time) & "-" & _
 Minute(Time)
' Output file name and path
strLogFile = "C:\VHDaudit-" & strTimeDate & _
 ".txt"
 
wscript.echo("Audit started. This may take " & _
 "several minutes to hours to complete. You " & _
 "will receive a message once the script is finished.")

'Create Log File
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile (strLogFile, _
    ForWriting, True)
    
' Connect to domain and collect computer accounts
Const ADS_SCOPE_SUBTREE = 2
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection
set objRootDSE = GetObject("LDAP://RootDSE")
objCommand.CommandText = _
 "SELECT Name, Location FROM 'LDAP://" & _
 objRootDSE.Get("defaultNamingContext") & "'" _
 & "WHERE objectClass='computer'"
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Timeout") = 30
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE
objCommand.Properties("Cache Results") = False
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

' Output domain computer accounts, connect to each 
' computer, and enumerate virtual disk files or
' files larger than 800 MB
Do Until objRecordSet.EOF
 strComputer = objRecordSet.Fields("Name").Value
 objFile.WriteLine "System: " & strComputer
 Set objWMIsvc = GetObject("winmgmts:" &_
   "{impersonationlevel=impersonate}!\\" & _
   strComputer & "\root\cimv2")
 'Check for connection error. If systems are
 'unreachable, ensure that a software firewall
 'is not blocking WMI connections.
 If Err = 462 Then
   objFile.Writeline("*** System Unreachable ***")
   Err.Clear
 Else 
  'Enumerate VHDs and VMDKs
   set colFiles = objWMIsvc.ExecQuery _
    ("Select * from CIM_DataFile where Extension =" & _
    " 'vhd' or Extension = 'vmdk' or FileSize " & _
    "> 838860800") 
  ' Note: 838860800 is the byte value of 800 MB
  'List VHDs on host
   For Each objVHD In colFiles
     objFile.WriteLine(objVHD.Name & " -- " & _ 
      objVHD.FileSize & " bytes")
   Next     
 End If
 objfile.writeline("-------------------------------")
 objfile.writeline()
 objRecordSet.MoveNext
Loop
' All done!
WScript.Echo("Audit Complete!")