1

A cyber attack generated thousands of files in SharePoint with this name "Read_me_now.htm".

In PowerShell with the command Find-PnPFile -Match * read_me_now.htm * I display them.

With what command can I search for them and then delete them? I tried with Remove-PnPFile -Match * read_me_now.htm * but it doesn't work.

1

Try using this PowerShell code:

#Get all matching files
$Files = Find-PnPFile -Match *read_me_now.htm

#Delete all files
ForEach ($File in $Files)
{
    Write-Host ("Deleting File: '{0}' at '{1}'" -f $File.Name, $File.ServerRelativeURL)
     
    #Delete Item
    Remove-PnPFile -ServerRelativeUrl $File.ServerRelativeURL -Force -Recycle
}

This will move files to recycle bin. If you want to permanently delete the files, change Remove-PnPFile line to this:

Remove-PnPFile -ServerRelativeUrl $File.ServerRelativeURL

Documentation:

  1. Find-PnPFile
  2. Remove-PnPFile
1
  • Hi @Tomato1287, did you try this PowerShell? Is it working for you? yesterday
0

Please run the below script to delete files with "read_me_now.htm" extension as an admin:

$SiteURL = "https://domain.sharepoint.com/sites/sitename"
$LibraryName = "Documents"

#Credentials: The account and password of the site administrator
Connect-PnPOnline -URL $SiteURL -Credentials (Get-Credential)

$Files = Find-PnPFile -List "Documents" -Match *read_me_now.htm

ForEach ($File in $Files)
{
    Write-Host ("Deleting File: '{0}' at '{1}'" -f $File.Name, $File.ServerRelativeURL)
    
    #Delete Item
    Remove-PnPFile -ServerRelativeUrl $File.ServerRelativeURL -Force -Recycle
        
}

#Empty Reycle Bins:Permanently deletes all the items in the 1st stage and 2nd Stage recycle bins of which the file names have the "read_me_now.htm" extension

Get-PnPRecycleBinItem | Where-Object LeafName -like "*read_me_now.htm" | Clear-PnpRecycleBinItem -Force

Reference:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.