# G-Scan in NinjaOne Three ready-made scripts that run G-Scan from NinjaOne without a browser, a port or a key. They use `gscan.com`, the command-line companion of `gscan.exe` that ships with G-Scan 1.14 and later. The same approach works from any RMM, a scheduled task or a runbook. | Script | What it does | Exit code | |---|---|---| | [`GScan-DiskReport.ps1`](GScan-DiskReport.ps1) | scans a drive and fills custom fields: a summary, free space in percent, what a safe clean-up frees, and an HTML report with the largest folders and the findings | 0 filled, 1 scan failed | | [`GScan-DiskAlert.ps1`](GScan-DiskAlert.ps1) | checks free space first; only when it is low does it scan, and the output says where the space went | 0 fine, 1 low | | [`GScan-Export.ps1`](GScan-Export.ps1) | writes the largest files, the file types and the findings as CSV to a locked-down folder, optionally copied to a share | 0 written, 1 failed | None of them deletes anything. Exit code 2 always means the same: `gscan.com` was not found, or the input was wrong. --- ## 1. Install G-Scan on the devices The MSI installs silently, so it goes out like any other application in NinjaOne: ``` msiexec /i G-Scan--x64.msi /qn CONTEXTMENU=0 ``` `gscan.com` then sits in `C:\Program Files\GariaNetTools\G-Scan\`, which is where the scripts look. Installed somewhere else, pass `-GScan "D:\Tools\G-Scan\gscan.com"`. ## 2. Add a script Create a new PowerShell script in NinjaOne's automation library, paste the contents of the file, and set it to **run as System**. As System, G-Scan reads every folder on the machine and uses turbo mode, which reads a whole NTFS drive in seconds. Every setting is a parameter with a sensible default. Pass them as preset parameters - for example `-Drive D:\ -MinFreePercent 15` - or define script variables with the same name (`drive`, `minFreePercent`, ...): the scripts read those from the environment. ## 3. The report: create the custom fields first `GScan-DiskReport.ps1` writes to device custom fields. Create them before the first run, and allow automations to write to them: | Field | Type | Holds | |---|---|---| | `gscanSummary` | Text | `C:\: 1.5 TB used of 1.8 TB, 374.3 GB free (20%), safe clean-up 12.0 GB, largest C:\Users 301.9 GB. Scanned 2026-09-11 22:10.` | | `gscanFreePercent` | Integer | `20` | | `gscanCleanableGb` | Decimal | `12.0` - Recycle Bin, temporary files and downloaded updates together | | `gscanReport` | WYSIWYG | two tables: the largest folders with their share, and the findings with their largest location | Other names? Pass `-SummaryField`, `-FreePercentField`, `-CleanableField` and `-ReportField`. An empty name skips that field. The script calls NinjaOne's `Ninja-Property-Set-Piped`, or `Ninja-Property-Set` when only that one is there. Without either - in an ordinary PowerShell window - it prints the values instead, which is the way to try it before it goes into NinjaOne. A schedule of once a day is plenty; the numbers do not change by the minute. ## 4. The alert `GScan-DiskAlert.ps1` asks Windows for the free space, which costs nothing, and ends with exit code 0 when there is enough. Below the threshold - 10% by default, and optionally a number of GB with `-MinFreeGb` - it runs G-Scan and ends with exit code 1. The output is then the alert text: ``` LOW DISK SPACE: 9.8 GB free on C:\ (4.1%), below 10%. Largest folders: 601.3 GB 39% C:\Program Files (x86) 301.9 GB 20% C:\Users ... Findings: 45.1 GB Downloads folder has got out of hand C:\Users\anna\Downloads 12.0 GB Recycle Bin has never been emptied C:\$Recycle.Bin ... Safe to clean now (Recycle Bin, temporary files, downloaded updates): 12.4 GB ``` Run it on a schedule and let NinjaOne raise an alert or a ticket when the script fails, so the ticket already says what to look at. ## 5. The export `GScan-Export.ps1` writes three files per run, named `---files.csv` (and `-types`, `-advice`), to `%ProgramData%\GariaNet\G-Scan\reports`. Add `-Share \\server\reports\disk` to copy them there as well; as System that share is reached as the computer account, which then needs write access. Before it writes, the script locks the folder down to SYSTEM and Administrators, and it refuses a folder that is, or sits under, a link or junction, or that is owned by another account. Files of its own older than `-KeepDays` (30) are removed; nothing else in the folder is touched. --- ## Doing it yourself The scripts are an example, not a requirement. The core is five lines: ```powershell $gscan = "$env:ProgramFiles\GariaNetTools\G-Scan\gscan.com" [Console]::OutputEncoding = [Text.Encoding]::UTF8 $r = (& $gscan --scan C:\ --out -) -join "`n" | ConvertFrom-Json if ($LASTEXITCODE -ne 0) { exit 1 } '{0:N1} GB used, largest folder {1}' -f ($r.meta.used / 1GB), $r.tree.c[0].n ``` - **`gscan.com`, not `gscan.exe`.** `gscan.exe` is a program without a console, and PowerShell does not wait for those: the script would carry on while the scan runs, and `$LASTEXITCODE` would mean nothing. `gscan.com` waits and passes the exit code on. - **`--out -`** writes the result to standard output, so nothing lands on disk. Set `[Console]::OutputEncoding` to UTF-8 first, or file names with accents come back mangled on machines whose console uses an older code page. The three scripts sidestep that by reading the output as UTF-8 directly. - **`--out file.csv --what files|types|advice`** writes a CSV instead. The JSON is the same as `/api/result` in [`api/API.md`](../../api/API.md): `meta`, `tree`, `exts`, `files`, `advice`. - **Exit codes:** 0 done, 1 the scan or writing failed (the reason is on standard error), 2 wrong arguments. ## Security - The scripts only read. Nothing is deleted; the command line has no way to delete. - **Do not write output as System into a folder ordinary users can write to.** G-Scan writes a file by creating a new one next to the target and renaming it into place, so a link planted *at* the target is replaced rather than followed. A junction planted *higher up* in the path is not something a program can rule out on its own. Standard output avoids the question entirely; `GScan-Export.ps1` checks the folder itself. - Over SSH the command line signs in with a key only - the key of the account the script runs as. There is no way to pass a password on the command line, on purpose: it would be visible to every local user in the process list. ## What was tested, and what was not Tested on Windows 11 under Windows PowerShell 5.1 - what NinjaOne runs by default - as an administrator, with a stand-in for NinjaOne's field command: every exit code, the fields and their values, the alert on both sides of the threshold, the export with its folder lock, the refusal of a junction and of a share that does not exist. **Not tested inside NinjaOne itself.** If a field stays empty, check the field name, its type, and that automations are allowed to write to it.