Windows Server: Remove orphaned shares (server service does not start)

For a change, a small problem again today. The "Server" service on a Windows Server 2012 R2 file server could no longer be started, which meant that none of the shares were accessible. Only this warning could be found in the "Application" event log:

Source: Server

Event ID: 2511

The server service could not restore the share share name because the directory D:\Home\Share no longer exists. Execute the command "net share Share /delete" to delete the share or to create the directory D:\Home\Share.

There are obviously shares that point to a directory that no longer exists. In fact, the directories in question have been archived and the share has not been removed. Apparently the missing directories have irritated the server service somewhat, because after a longer waiting time, starting the service resulted in an error.

It's nice that the warning in the event log also gives the solution: net share share name /delete

However, the number of these warnings in the event log was somewhat unfavorable: 988, so it would have taken a little longer to manually copy all the commands from the event log to the command line and execute them.

I have created a quick & dirty script which extracts the "net share" command from the warning text and copies it into a batch file:

$events = Get-EventLog -LogName System -Newest 1000 -EntryType Warning -Source Server | where {$_.eventid -match "2511"}
foreach ($event in $events)
{
$sharepath = $event.ReplacementStrings[1]
$testpath = test-path $sharepath
if ($testpath -match "False")
{
write-warning "$sharepath does not exist"
$message = $event.message
$netcmd = $message.Split("`"")[1]
$netcmd | add-content c:\netcmd.bat
}
}
$csv = import-csv c:\netcmd.bat -header shares
($csv | group shares).name | set-content c:\netcmd.bat

The small script retrieves the warnings from the event log and extracts the "net share" command and copies it to the file "c:\netcmd.bat":

The batch file can then simply be executed and removes the faulty shares. The server service could be restarted immediately after the cleanup. I later adjusted the script a little: Duplicate entries are removed and it is checked whether the directory has really been removed.

Maybe it will help one or the other.