{"id":13591,"date":"2011-06-18T00:01:00","date_gmt":"2011-06-18T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2011\/06\/18\/top-ten-favorite-powershell-tricks-part-1\/"},"modified":"2011-06-18T00:01:00","modified_gmt":"2011-06-18T00:01:00","slug":"top-ten-favorite-powershell-tricks-part-1","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/top-ten-favorite-powershell-tricks-part-1\/","title":{"rendered":"Top Ten Favorite PowerShell Tricks: Part 1"},"content":{"rendered":"

Create a Record of PowerShell Commands and Output, Find Hidden Objects, and Expand Properties<\/b><\/h2>\n

Summary<\/b>: Microsoft Scripting Guy, Ed Wilson, shares four of his top ten favorite Windows PowerShell tricks in this first of three blogs.<\/p>\n

Weekend Scripter<\/b><\/h2>\n

Microsoft Scripting Guy, Ed Wilson, is here. Without a doubt, I have the perfect job—at least for me. I get to play around with Windows PowerShell all day, and I get to do it every day. In addition, I get to talk to people from all over the world who are as excited about using Windows PowerShell as I am. Whenever two or more Windows PowerShell devotees get together, it is not very long before one of them drags out a laptop and begins to share something they have figured out using Windows PowerShell. It never fails. On Friday evening, following the last session of SQL Rally in Orlando, I sent a text message to the Scripting Wife to join me in the lobby of our hotel so we could go do dinner. The conversation went something like this:<\/p>\n

“Hello, Scripting Wife. Would you like to meet me in the lobby so we can go get dinner?” I asked.<\/p>\n

“Where have you been?” she asked.<\/p>\n

“I went to Mark’s session on data mining,” I replied.<\/p>\n

“Then what?” she queried.<\/p>\n

“Well, I was talking to Mark after the session,” I said.<\/p>\n

“Then what?”<\/p>\n

“Then nothing. I was talking to Mark.”<\/p>\n

“Oh. OK. Just wondering.”<\/p>\n

“I was answering a couple of questions he had about Windows PowerShell.”<\/p>\n

“I see. OK. I will see you in a few minutes.”<\/p>\n

When I looked at my watch, I saw what had made her curious—it was 7:30 at night, and the session had been over for two hours. Woops! Mark had a question about environmental variables, and that led to me showing him one of my favorite Windows PowerShell tricks.<\/p>\n

NOTE: This is part 1 of a three part series of articles on my Top Ten Favorite PowerShell Tricks. I talk about tricks 5 – 7 tommorow<\/a>, and tricks 8-10 <\/a>the following day.<\/p>\n

Trick #1: Use the transcript<\/h3>\n

When I am exploring Windows PowerShell, the first thing I do is create a transcript. The Start-Transcript<\/b> cmdlet will create a transcript file that contains every command you type and the output associated with that command. The transcript is a text file that is stored in your user profile location. The file name is based on the current date and time that the transcript was created. To stop the transcript, use the Stop-Transcript<\/b> cmdlet, or simply close the Windows PowerShell console.<\/p>\n

Why do I like the transcript? Well, if I am exploring, I am simply trying out different commands to see if I can find something useful. I do not know what I might find. By having a transcript, I have a complete record of everything I did. If I did find something useful, I have built in documentation for the commands. This facilitates training and learning. In addition, it is useful as a record of changes that I may have made to a system. The transcript shows the commands that are run and the results of those commands. A sample of transcript output is shown in the following image. Notice the header portion that gives user, computer, OS version, and time created information.<\/p>\n

\"Image<\/a><\/p>\n

It might be interesting to compare the output from the transcript log file with the commands typed in the Windows PowerShell console. As shown in the following image, the command and output correspond directly.<\/p>\n

\"Image<\/a><\/p>\n

Trick #2: Look for “hidden” objects<\/h3>\n

What do I mean by “hidden” objects? Well, perhaps I could have called them “embedded” objects. Let me explain, many Windows PowerShell cmdlets return objects that contain other objects. Some of these objects are rather obvious; others are not. For example, on my laptop I use Get-Process<\/b> to look for processes that begin with the letters wu and are followed by zero or more letters. The command and output are shown here.<\/p>\n

\n

PS C:\\> Get-Process -Name wu*<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

Handles  <\/span>NPM(K)    <\/span>PM(K)      <\/span>WS(K) VM(M)   <\/span>CPU(s)     <\/span>Id ProcessName<\/span><\/span><\/span><\/p>\n

——-  <\/span>——    <\/span>—–      <\/span>—– —–   <\/span>——     <\/span>— ———–<\/span><\/span><\/span><\/p>\n

    <\/span><\/span>213      <\/span>11     <\/span>1852       <\/span>6236    <\/span>60            <\/span>1268 WUDFHost<\/span><\/span><\/span><\/span><\/p>\n

    <\/span><\/span>211       <\/span>9     <\/span>1824       <\/span>5640    <\/span>37            <\/span>1360 WUDFHost<\/span><\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

PS C:\\><\/span><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

To hone in on one of those processes, I use the process ID and pipe the results to the Format-List<\/b> cmdlet. This command and output are shown here.<\/p>\n

\n

PS C:\\> Get-Process -id 1360 | fl * -Force<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

__NounName                 <\/span>: Process<\/span><\/span><\/span><\/p>\n

Name                       <\/span>: WUDFHost<\/span><\/span><\/span><\/p>\n

Handles                    <\/span>: 211<\/span><\/span><\/span><\/p>\n

VM                         <\/span>: 39145472<\/span><\/span><\/span><\/p>\n

WS                         <\/span>: 5775360<\/span><\/span><\/span><\/p>\n

PM                         <\/span>: 1867776<\/span><\/span><\/span><\/p>\n

NPM                        <\/span>: 9496<\/span><\/span><\/span><\/p>\n

Path                       <\/span>:<\/span><\/span><\/span><\/p>\n

Company                    <\/span>:<\/span><\/span><\/span><\/p>\n

CPU                        <\/span>:<\/span><\/span><\/span><\/p>\n

FileVersion                <\/span>:<\/span><\/span><\/span><\/p>\n

ProductVersion             <\/span>:<\/span><\/span><\/span><\/p>\n

Description                <\/span>:<\/span><\/span><\/span><\/p>\n

Product                    <\/span>:<\/span><\/span><\/span><\/p>\n

Id                         <\/span>: 1360<\/span><\/span><\/span><\/p>\n

PriorityClass              <\/span>:<\/span><\/span><\/span><\/p>\n

HandleCount                <\/span>: 211<\/span><\/span><\/span><\/p>\n

WorkingSet                 <\/span>: 5775360<\/span><\/span><\/span><\/p>\n

PagedMemorySize            <\/span>: 1867776<\/span><\/span><\/span><\/p>\n

PrivateMemorySize          <\/span>: 1867776<\/span><\/span><\/span><\/p>\n

VirtualMemorySize          <\/span>: 39145472<\/span><\/span><\/span><\/p>\n

TotalProcessorTime         <\/span>:<\/span><\/span><\/span><\/p>\n

BasePriority               <\/span>: 8<\/span><\/span><\/span><\/p>\n

ExitCode                   <\/span>:<\/span><\/span><\/span><\/p>\n

HasExited                  <\/span>:<\/span><\/span><\/span><\/p>\n

ExitTime                   <\/span>:<\/span><\/span><\/span><\/p>\n

Handle                     <\/span>:<\/span><\/span><\/span><\/p>\n

MachineName                <\/span>: .<\/span><\/span><\/span><\/p>\n

MainWindowHandle           <\/span>: 0<\/span><\/span><\/span><\/p>\n

MainWindowTitle            <\/span>:<\/span><\/span><\/span><\/p>\n

MainModule                 <\/span>:<\/span><\/span><\/span><\/p>\n

MaxWorkingSet              <\/span>:<\/span><\/span><\/span><\/p>\n

MinWorkingSet              <\/span>:<\/span><\/span><\/span><\/p>\n

Modules                    <\/span>:<\/span><\/span><\/span><\/p>\n

NonpagedSystemMemorySize   <\/span>: 9496<\/span><\/span><\/span><\/p>\n

NonpagedSystemMemorySize64 : 9496<\/span><\/span><\/span><\/p>\n

PagedMemorySize64          <\/span>: 1867776<\/span><\/span><\/span><\/p>\n

PagedSystemMemorySize      <\/span>: 70936<\/span><\/span><\/span><\/p>\n

PagedSystemMemorySize64    <\/span>: 70936<\/span><\/span><\/span><\/p>\n

PeakPagedMemorySize        <\/span>: 1961984<\/span><\/span><\/span><\/p>\n

PeakPagedMemorySize64      <\/span>: 1961984<\/span><\/span><\/span><\/p>\n

PeakWorkingSet             <\/span>: 5812224<\/span><\/span><\/span><\/p>\n

PeakWorkingSet64           <\/span>: 5812224<\/span><\/span><\/span><\/p>\n

PeakVirtualMemorySize      <\/span>: 40194048<\/span><\/span><\/span><\/p>\n

PeakVirtualMemorySize64    <\/span>: 40194048<\/span><\/span><\/span><\/p>\n

PriorityBoostEnabled       <\/span>:<\/span><\/span><\/span><\/p>\n

PrivateMemorySize64        <\/span>: 1867776<\/span><\/span><\/span><\/p>\n

PrivilegedProcessorTime    <\/span>:<\/span><\/span><\/span><\/p>\n

ProcessName                <\/span>: WUDFHost<\/span><\/span><\/span><\/p>\n

ProcessorAffinity          <\/span>:<\/span><\/span><\/span><\/p>\n

Responding                 <\/span>: True<\/span><\/span><\/span><\/p>\n

SessionId                  <\/span>: 0<\/span><\/span><\/span><\/p>\n

StartInfo                  <\/span>: System.Diagnostics.ProcessStartInfo<\/span><\/span><\/span><\/p>\n

StartTime                  <\/span>:<\/span><\/span><\/span><\/p>\n

SynchronizingObject        <\/span>:<\/span><\/span><\/span><\/p>\n

Threads                    <\/span>: {1364, 1368, 1372, 1376…}<\/span><\/span><\/span><\/p>\n

UserProcessorTime          <\/span>:<\/span><\/span><\/span><\/p>\n

VirtualMemorySize64      <\/span>  <\/span>: 39145472<\/span><\/span><\/span><\/p>\n

EnableRaisingEvents        <\/span>: False<\/span><\/span><\/span><\/p>\n

StandardInput              <\/span>:<\/span><\/span><\/span><\/p>\n

StandardOutput             <\/span>:<\/span><\/span><\/span><\/p>\n

StandardError              <\/span>:<\/span><\/span><\/span><\/p>\n

WorkingSet64               <\/span>: 5775360<\/span><\/span><\/span><\/p>\n

Site                       <\/span>:<\/span><\/span><\/span><\/p>\n

Container                  <\/span>:<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

PS C:\\><\/span><\/span><\/span><\/p><\/blockquote>\n

In the previous output, the StartInfo<\/b> property returns an object. The object is an instance of the ProcessStartInfo<\/b> object. The applicable line from the output is shown here.<\/p>\n

\n

StartInfo                  <\/span>: System.Diagnostics.ProcessStartInfo<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

To access this object, all one needs to do is to use “dotted notation,” which means I put parentheses around the command, and directly access the property. When I do this, the ProcessStartInfo<\/b> object will be revealed. I illustrate this technique here.<\/p>\n

\n

PS C:\\> (Get-Process -id 1360).StartInfo<\/p>\n

PS C:\\> (Get-Process -id 1360).StartInfo<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

Verb                    <\/span>:<\/span><\/span><\/span><\/p>\n

Arguments               <\/span>:<\/span><\/span><\/span><\/p>\n

CreateNoWindow          <\/span>: False<\/span><\/span><\/span><\/p>\n

EnvironmentVariables    <\/span>: {temp, processor_revision, processor_level, logonserver…}<\/span><\/span><\/span><\/p>\n

RedirectStandardInput   <\/span>: False<\/span><\/span><\/span><\/p>\n

RedirectStandardOutput  <\/span>: False<\/span><\/span><\/span><\/p>\n

RedirectStandardError   <\/span>: False<\/span><\/span><\/span><\/p>\n

StandardErrorEncoding   <\/span>:<\/span><\/span><\/span><\/p>\n

StandardOutputEncoding  <\/span>:<\/span><\/span><\/span><\/p>\n

UseShellExecute         <\/span>: True<\/span><\/span><\/span><\/p>\n

Verbs                   <\/span>: {}<\/span><\/span><\/span><\/p>\n

UserName                <\/span>:<\/span><\/span><\/span><\/p>\n

Password                <\/span>:<\/span><\/span><\/span><\/p>\n

Domain                  <\/span>:<\/span><\/span><\/span><\/p>\n

LoadUserProfile         <\/span>: False<\/span><\/span><\/span><\/p>\n

FileName                <\/span>:<\/span><\/span><\/span><\/p>\n

WorkingDirectory        <\/span>:<\/span><\/span><\/span><\/p>\n

ErrorDialog             <\/span>: False<\/span><\/span><\/span><\/p>\n

ErrorDialogParentHandle : 0<\/span><\/span><\/span><\/p>\n

WindowStyle             <\/span>: Normal<\/span><\/span><\/span><\/p><\/blockquote>\n

Trick #3: Use Select ExpandProperty<\/i><\/h3>\n

When examining objects in Windows PowerShell, some embedded objects are obvious—like the one in Trick #2 that I just discussed. Other objects are not so obvious. In the previous example, the StartInfo<\/b> property returns a ProcessStartInfo<\/b> object. In the output that follows, the EnvironmentVariables <\/b>property appears truncated.<\/p>\n

\n

EnvironmentVariables    <\/span>: {temp, processor_revision, processor_level, logonserver…} <\/span><\/span><\/span><\/p>\n<\/blockquote>\n

This information appears to be impossible to retrieve. A few common attempts for seeing all of the EnvironmentVariables <\/b>information are shown here.<\/p>\n

\n

PS C:\\> (Get-Process -id 1360).StartInfo | fl environmentVariables<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

EnvironmentVariables : {temp, processor_revision, processor_level, logonserver…}<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

PS C:\\> (Get-Process -id 1360).StartInfo | ft environmentVariables<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

EnvironmentVariables<\/span><\/span><\/span><\/p>\n

——————–<\/span><\/span><\/span><\/p>\n

{temp, processor_revision, processor_level, logonserver…}<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

PS C:\\> (Get-Process -id 1360).StartInfo | ft environmentVariables -Force<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

EnvironmentVariables<\/span><\/span><\/span><\/p>\n

——————–<\/span><\/span><\/span><\/p>\n

{temp, processor_revision, processor_level, logonserver…}<\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n

PS C:\\><\/span><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

Unfortunately, it seems that nothing can return all of this information—that is until I use the Select-Object<\/b> cmdlet with the ExpandProperty<\/i> parameter. In the example that follows, I use the Select<\/b> alias for the Select-Object<\/b> cmdlet. This results in the command that is shown here.<\/p>\n

\n

(Get-Process -id 1360).StartInfo | select -ExpandProperty environmentvariables<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

As shown in the figure that follows, this command opens an entire page of additional information.<\/p>\n

\"Image<\/a><\/p>\n

Trick #4 Group and dot<\/h3>\n

Earlier, I needed to hone in on the StartInfo<\/b> property of my process. I could have stored the process object in a variable, and then used a dotted notation to reference the StartInfo<\/b> <\/i>property. This technique is shown here.<\/p>\n

\n

$a = Get-Process -id 1360<\/span><\/span><\/span><\/p>\n

$a.StartInfo<\/span><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

But often that technique is not required. If a property returns a single item, I can use a pair of parentheses to group my command, and then use the dotted notation to return my desired property directly. The parentheses tell Windows PowerShell to process the command inside the parentheses first, then return the object, and then return the information from my property. This is illustrated here.<\/p>\n

\n

(Get-Process -id 1360).Startinfo<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

If I want to, I can continue to add additional dots. Because the StartInfo<\/b> property returns an object, there are additional members exposed via the returned object. If the property is a single item, I can add additional dots to return the additional properties. In general, I do not use this technique because I think it begins to get confusing. However, when exploring in an interactive fashion inside the Windows PowerShell console, I will play around with double-dotted notation, and at times even with triple-dotted notation. The following is an example of using this technique to explore a specific property from the StartInfo <\/b>object of a process object.<\/p>\n

\n

PS C:\\> (Get-Process -id 1360).Startinfo.loaduserprofile<\/span><\/span><\/span><\/p>\n

False<\/span><\/span><\/span> <\/span><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

Join me tomorrow for part 2 of my Top Ten Favorite PowerShell Tricks.<\/a><\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Create a Record of PowerShell Commands and Output, Find Hidden Objects, and Expand Properties Summary: Microsoft Scripting Guy, Ed Wilson, shares four of his top ten favorite Windows PowerShell tricks in this first of three blogs. Weekend Scripter Microsoft Scripting Guy, Ed Wilson, is here. Without a doubt, I have the perfect job—at least for me. […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[51,3,4,45],"class_list":["post-13591","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-getting-started","tag-scripting-guy","tag-scripting-techniques","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Create a Record of PowerShell Commands and Output, Find Hidden Objects, and Expand Properties Summary: Microsoft Scripting Guy, Ed Wilson, shares four of his top ten favorite Windows PowerShell tricks in this first of three blogs. Weekend Scripter Microsoft Scripting Guy, Ed Wilson, is here. Without a doubt, I have the perfect job—at least for me. […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13591","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=13591"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/13591\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=13591"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=13591"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=13591"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}