Audit NTFS - Deleted files

Mails to admins about deleted files on windows server.

deleted_files_RUN.bat
@ECHO OFF
cd /D D:\scripts
powershell -executionpolicy unrestricted -file deleted_files_script.ps1
deleted_files_script.ps1
$date = Get-Date -format "yyyy-MM-dd"

$From = "[email protected]"
$To = "[email protected]"
$Server = "mail.yourserver.local"
$Subject = "[FS1] DELETED FILES - " + $date

$LogsPath = "d:\scripts\logs"
$logname = "DeletedFiles-"+$date+".txt"
$archname = "DeletedFiles-"+$date+".7z"

set-alias sz "$env:ProgramFiles\7-Zip\7z.exe"
$id = @{
    0x10000 = "DELETE"
}
$Body = Get-WinEvent -FilterHashtable @{LogName="Security";ID=4663;StartTime=([datetime]::ToDay)} | 
    where {$_.properties[6].value -notmatch ".*tmp"} | where {$_.properties[6].value -notmatch ".*~lock*"}| where {$_.properties[6].value -notmatch ".*~$*"} | 
    Foreach {
	"{0} {1} {2} {3}" -f ($_.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss")),($_.properties[2].Value + "/" + $_.properties[1].Value), $id[$_.properties[9].value],$_.properties[6].value
    } | Out-String
if($Body) {
    $Body | out-file $LogsPath\$logname -append
    sz a -t7z -mx9 -y "$LogsPath\$archname" "$LogsPath\$logname"
    Remove-Item "$LogsPath\$logname"
    Send-MailMessage -From $From -To $To -SmtpServer $Server -Body "[fs1.yourserver.local] DELETED files logs - $date" -Attachments "$LogsPath\$archname" -Subject $Subject -Encoding UTF8
}