Prof. Powershell
Turning In Your Homework
There are as many ways to do things with PowerShell cmdlets as there are ways to skin a cat.
- By Jeffery Hicks
- 05/05/2009
There are almost always several ways to accomplish tasks in PowerShell and my homework assignments aren't any different.
The first assignment was to list Microsoft Word documents in your documents folder larger than 50 ½ kilobytes. Here's one solution:
PS C:\> dir "$env:userprofile\documents" -recurse -filter "*.doc" | where {$_.length -gt 50.5KB} | sort Length -descending | format-list fullname,@{label="Size(KB)"; Expression={$_.length/1kb}},@{label="LastModified"; Expression={$_.LastWriteTime}}
Using the environmental variable avoids hardcoding paths and makes this more reusable. On Windows XP you would have needed to use "$env:userprofile\my documents". Notice I'm using the -filter parameter with Get-ChildItem (alias of dir). I could have filtered the extension in the Where-Object expression, but early filtering using -filter is more efficient. Because the path names are long, at least for me, I elected to use Format-List to display the results. I used a hash table for the custom labels. You could also have used Select-Object and/or Format-Table.
The second task was to search the event log to determine when a computer started up. There are several possibilities you could have used. I chose to use EventID 6009 and the Get-Eventlog cmdlet. This cmdlet doesn't have filtering capabilities so I need to use Where-Object:
PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated | Select TimeGenerated
To take it to the next level I need to convert each TimeGenerated property into a short date string:
PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated |
>> foreach { $_.TimeGenerated.ToShortDateString()} | Select -Unique
PowerShell recognizes the TimeGenerated property as a [DateTime] object, so I can call the ToShortDateString() method. These strings are then piped to Select-Object which retains only the unique dates.
Finally, I challenged you to get some custom process information. You probably needed to look at process objects in Get-Member to figure out what properties to work with. Here's a potential answer:
PS C:\> get-process | where {$_.company -notmatch "Microsoft"} | sort Company | format-list -groupby Company ID,Name,Path,VM,WS,PM
You might have been able to use Format-Table, but I needed to use Format-List to avoid truncating data. Whenever you use -Groupby with the formatting cmdlets, you should sort the object first.
How did you do? The tasks themselves may not be useful, but hopefully some of the techniques will be.
About the Author
Jeffery Hicks (MCSE,MCSA,MCT) is a Microsoft MVP and an IT veteran with almost 20 years of experience, much of it spent as an IT consultant specializing in Windows server technologies. He works today as an independent author, trainer and consultant. Jeff has co-authored or authored several books, courseware, and training videos on administrative scripting and automation. His latest book is Managing Active Directory with Windows PowerShell: TFM (SAPIEN Press 2008). You can follow Jeff at twitter.com/jeffhicks and jdhitsolutions.com/blog.