Prof. Powershell

Turning In Your Homework

There are as many ways to do things with PowerShell cmdlets as there are ways to skin a cat.

There are almost always several ways to accomplish tasks in PowerShell and my homework assignments aren't any different.

The first assignment was to list Microsoft Word documents in your documents folder larger than 50 ½ kilobytes. Here's one solution:

PS C:\> dir "$env:userprofile\documents" -recurse -filter "*.doc" | where {$_.length -gt 50.5KB} | sort Length -descending | format-list fullname,@{label="Size(KB)"; Expression={$_.length/1kb}},@{label="LastModified"; Expression={$_.LastWriteTime}}

Using the environmental variable avoids hardcoding paths and makes this more reusable. On Windows XP you would have needed to use "$env:userprofile\my documents". Notice I'm using the -filter parameter with Get-ChildItem (alias of dir). I could have filtered the extension in the Where-Object expression, but early filtering using -filter is more efficient. Because the path names are long, at least for me, I elected to use Format-List to display the results. I used a hash table for the custom labels. You could also have used Select-Object and/or Format-Table.

The second task was to search the event log to determine when a computer started up. There are several possibilities you could have used. I chose to use EventID 6009 and the Get-Eventlog cmdlet. This cmdlet doesn't have filtering capabilities so I need to use Where-Object:

PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated | Select TimeGenerated

To take it to the next level I need to convert each TimeGenerated property into a short date string:

PS C:\> get-eventlog -log system | where {$_.EventID -eq 6009} | sort TimeGenerated |
>> foreach { $_.TimeGenerated.ToShortDateString()} | Select -Unique

PowerShell recognizes the TimeGenerated property as a [DateTime] object, so I can call the ToShortDateString() method. These strings are then piped to Select-Object which retains only the unique dates.

Finally, I challenged you to get some custom process information. You probably needed to look at process objects in Get-Member to figure out what properties to work with. Here's a potential answer:

PS C:\> get-process | where {$ -notmatch "Microsoft"} | sort Company | format-list -groupby Company ID,Name,Path,VM,WS,PM

You might have been able to use Format-Table, but I needed to use Format-List to avoid truncating data. Whenever you use -Groupby with the formatting cmdlets, you should sort the object first.

How did you do? The tasks themselves may not be useful, but hopefully some of the techniques will be.

About the Author

Jeffery Hicks is an IT veteran with over 25 years of experience, much of it spent as an IT infrastructure consultant specializing in Microsoft server technologies with an emphasis in automation and efficiency. He is a multi-year recipient of the Microsoft MVP Award in Windows PowerShell. He works today as an independent author, trainer and consultant. Jeff has written for numerous online sites and print publications, is a contributing editor at, and a frequent speaker at technology conferences and user groups.

comments powered by Disqus
Most   Popular