Prof. Powershell

Turning In Your Homework

There are as many ways to do things with PowerShell cmdlets as there are ways to skin a cat.

• By Jeffery Hicks
• 05/05/2009

The first assignment was to list Microsoft Word documents in your documents folder larger than 50 ½ kilobytes. Here's one solution:

PS C:\> dir "$env:userprofile\documents" -recurse -filter "*.doc" | where {$_.length -gt 50.5KB} | sort Length -descending | format-list fullname,@{label="Size(KB)"; Expression={$_.length/1kb}},@{label="LastModified"; Expression={$_.LastWriteTime}}

Using the environmental variable avoids hardcoding paths and makes this more reusable. On Windows XP you would have needed to use "$env:userprofile\my documents". Notice I'm using the -filter parameter with Get-ChildItem (alias of dir). I could have filtered the extension in the Where-Object expression, but early filtering using -filter is more efficient. Because the path names are long, at least for me, I elected to use Format-List to display the results. I used a hash table for the custom labels. You could also have used Select-Object and/or Format-Table.

The second task was to search the event log to determine when a computer started up. There are several possibilities you could have used. I chose to use EventID 6009 and the Get-Eventlog cmdlet. This cmdlet doesn't have filtering capabilities so I need to use Where-Object:

PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated | Select TimeGenerated

To take it to the next level I need to convert each TimeGenerated property into a short date string:

PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated |
>> foreach { $_.TimeGenerated.ToShortDateString()} | Select -Unique

PowerShell recognizes the TimeGenerated property as a [DateTime] object, so I can call the ToShortDateString() method. These strings are then piped to Select-Object which retains only the unique dates.

Finally, I challenged you to get some custom process information. You probably needed to look at process objects in Get-Member to figure out what properties to work with. Here's a potential answer:

PS C:\> get-process | where {$_.company -notmatch "Microsoft"} | sort Company | format-list -groupby Company ID,Name,Path,VM,WS,PM

You might have been able to use Format-Table, but I needed to use Format-List to avoid truncating data. Whenever you use -Groupby with the formatting cmdlets, you should sort the object first.

How did you do? The tasks themselves may not be useful, but hopefully some of the techniques will be.