{"id":6711,"date":"2015-04-12T00:01:00","date_gmt":"2015-04-12T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2015\/04\/12\/weekend-scripter-use-powershell-to-work-with-embedded-objects\/"},"modified":"2019-02-18T10:29:55","modified_gmt":"2019-02-18T17:29:55","slug":"weekend-scripter-use-powershell-to-work-with-embedded-objects","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-to-work-with-embedded-objects\/","title":{"rendered":"Weekend Scripter: Use PowerShell to Work with Embedded Objects"},"content":{"rendered":"

Summary<\/b>: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to work with embedded objects.<\/span><\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. This morning I have my Zune 1.0 cranked up, and I am listening to some tunes. I have a nice cup of English Breakfast tea, and a warm croissant beside me. I also was able to score some homemade orange marmalade.<\/p>\n

Anyway, a few years ago, the Scripting Wife and I were in Maui, Hawaii, and we took an early morning drive up a winding road. We entered clouds, and it seemed like it was raining. I thought about turning back because of the rain, but there was no good place to turn. Then we emerged from the clouds, and the view was way cool. Here is a picture:<\/p>\n

\"Photo<\/a><\/p>\n

It was like another world that was hidden by the clouds below. In some respect, that is the way embedded objects in Windows PowerShell objects appear.<\/p>\n

Here is a basic example of embedded objects. When I use the Get-Process<\/b> cmdlet to look at a specific process, such as Notepad, Windows PowerShell returns basic information. Often the information like that shown here is enough:<\/p>\n

PS C:\\> Get-Process notepad<\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName                           <\/p>\n

——-  ——    —–      —– —–   ——     — ———–                           <\/p>\n

     85       8     1636       9800   113     0.05   6220 notepad     <\/p>\n

If I want to see more information, I pipe the resulting object to the Format-List<\/b> cmdlet and select all of the properties:<\/p>\n

PS C:\\> Get-Process notepad | fl *<\/p>\n

__NounName                 : Process<\/p>\n

Name                       : notepad<\/p>\n

Handles                    : 85<\/p>\n

VM                         : 118321152<\/p>\n

WS                         : 10035200<\/p>\n

PM                         : 1675264<\/p>\n

NPM                        : 8688<\/p>\n

Path                       : C:\\Windows\\System32\\notepad.exe<\/p>\n

Company                    : Microsoft Corporation<\/p>\n

CPU                        : 0.046875<\/p>\n

FileVersion                : 6.3.9600.16384 (winblue_rtm.130821-1623)<\/p>\n

ProductVersion             : 6.3.9600.16384<\/p>\n

Description                : Notepad<\/p>\n

Product                    : Microsoft® Windows® Operating System<\/p>\n

Id                         : 6220<\/p>\n

PriorityClass              : Normal<\/p>\n

HandleCount                : 85<\/p>\n

WorkingSet                 : 10035200<\/p>\n

PagedMemorySize            : 1675264<\/p>\n

PrivateMemorySize          : 1675264<\/p>\n

VirtualMemorySize          : 118321152<\/p>\n

TotalProcessorTime         : 00:00:00.0468750<\/p>\n

BasePriority               : 8<\/p>\n

ExitCode                   :<\/p>\n

HasExited                  : False<\/p>\n

ExitTime                   :<\/p>\n

Handle                     : 3132<\/p>\n

MachineName                : .<\/p>\n

MainWindowHandle           : 2361006<\/p>\n

MainWindowTitle            : Untitled – Notepad<\/p>\n

MainModule                 : System.Diagnostics.ProcessModule (notepad.exe)<\/p>\n

MaxWorkingSet              : 1413120<\/p>\n

MinWorkingSet              : 204800<\/p>\n

Modules                    : {System.Diagnostics.ProcessModule (notepad.exe),<\/p>\n

                             System.Diagnostics.ProcessModule (ntdll.dll),<\/p>\n

                             System.Diagnostics.ProcessModule (KERNEL32.DLL),<\/p>\n

                             System.Diagnostics.ProcessModule (KERNELBASE.dll)…}<\/p>\n

NonpagedSystemMemorySize   : 8688<\/p>\n

NonpagedSystemMemorySize64 : 8688<\/p>\n

PagedMemorySize64          : 1675264<\/p>\n

PagedSystemMemorySize      : 231168<\/p>\n

PagedSystemMemorySize64    : 231168<\/p>\n

PeakPagedMemorySize        : 1675264<\/p>\n

PeakPagedMemorySize64      : 1675264<\/p>\n

PeakWorkingSet             : 10072064<\/p>\n

PeakWorkingSet64           : 10072064<\/p>\n

PeakVirtualMemorySize      : 118374400<\/p>\n

PeakVirtualMemorySize64    : 2199141629952<\/p>\n

PriorityBoostEnabled       : True<\/p>\n

PrivateMemorySize64        : 1675264<\/p>\n

PrivilegedProcessorTime    : 00:00:00.0468750<\/p>\n

ProcessName                : notepad<\/p>\n

ProcessorAffinity          : 255<\/p>\n

Responding                 : True<\/p>\n

SessionId                  : 1<\/p>\n

StartInfo                  : System.Diagnostics.ProcessStartInfo<\/p>\n

StartTime                  : 4\/4\/2015 1:39:29 PM<\/p>\n

SynchronizingObject        :<\/p>\n

Threads                    : {4012}<\/p>\n

UserProcessorTime          : 00:00:00<\/p>\n

VirtualMemorySize64        : 2199141576704<\/p>\n

EnableRaisingEvents        : False<\/p>\n

StandardInput              :<\/p>\n

StandardOutput             :<\/p>\n

StandardError              :<\/p>\n

WorkingSet64               : 10035200<\/p>\n

Site                       :<\/p>\n

Container                  :<\/p>\n

As you can see, the<\/span> Modules<\/b>, <\/span>MainModule<\/b>, and <\/span>StartInfo<\/b> objects contain other objects. As an example, here is the <\/span>StartInfo<\/b> object:<\/span><\/p>\n

PS C:\\> Get-Process notepad | select startinfo<\/p>\n

StartInfo                                                                                       <\/p>\n

———                                                                                       <\/p>\n

System.Diagnostics.ProcessStartInfo       <\/p>\n

I can look up the object on MSDN, but I am not sure if it is worth the trouble. I can also use what I call “group and dot.”  All I need to do is put parentheses around the object, and select the StartInfo<\/b> property. When I do this, I can see everything that is contained in the object. This is shown here:<\/p>\n

PS C:\\> (Get-Process notepad).startinfo<\/p>\n

Verb                    :<\/p>\n

Arguments               :<\/p>\n

CreateNoWindow          : False<\/p>\n

EnvironmentVariables    : {ProgramW6432, Path, PROCESSOR_IDENTIFIER, TEMP…}<\/p>\n

RedirectStandardInput   : False<\/p>\n

RedirectStandardOutput  : False<\/p>\n

RedirectStandardError   : False<\/p>\n

StandardErrorEncoding   :<\/p>\n

StandardOutputEncoding  :<\/p>\n

UseShellExecute         : True<\/p>\n

Verbs                   : {}<\/p>\n

UserName                :<\/p>\n

Password                :<\/p>\n

Domain                  :<\/p>\n

LoadUserProfile         : False<\/p>\n

FileName                :<\/p>\n

WorkingDirectory        :<\/p>\n

ErrorDialog             : False<\/p>\n

ErrorDialogParentHandle : 0<\/p>\n

WindowStyle             : Normal<\/p>\n

One of the cool things I can do, is continue down the road. I can use a double dot (if you will), and select the WindowStyle<\/b> property from the ProcessStartInfo<\/b> object. Because I have already seen that (Get-Process notepad).StartInfo returns a ProcessStartInfo<\/b> object, I know that I can return a single property from this object. This technique is shown here:<\/p>\n

PS C:\\> (Get-Process notepad).startinfo.WindowStyle<\/p>\n

Normal<\/p>\n

Windows PowerShell also has a built-in method of handling this situation. I can use the –ExpandProperty<\/b> parameter from the Select-Object<\/b> cmdlet. This is faster (for me) than using the “group and dot” technique because I do not have to back up on the command line. Here is the command:<\/p>\n

PS C:\\> Get-Process notepad | select -ExpandProperty startinfo<\/p>\n

Verb                    :<\/p>\n

Arguments               :<\/p>\n

CreateNoWindow          : False<\/p>\n

EnvironmentVariables    : {ProgramW6432, Path, PROCESSOR_IDENTIFIER, TEMP…}<\/p>\n

RedirectStandardInput   : False<\/p>\n

RedirectStandardOutput  : False<\/p>\n

RedirectStandardError   : False<\/p>\n

StandardErrorEncoding   :<\/p>\n

StandardOutputEncoding  :<\/p>\n

UseShellExecute         : True<\/p>\n

Verbs                   : {}<\/p>\n

UserName                :<\/p>\n

Password                :<\/p>\n

Domain                  :<\/p>\n

LoadUserProfile         : False<\/p>\n

FileName                :<\/p>\n

WorkingDirectory        :<\/p>\n

ErrorDialog             : False<\/p>\n

ErrorDialogParentHandle : 0<\/p>\n

WindowStyle             : Normal<\/p>\n

This is good information, and it shows me what property contains, but it does not help me match it with the process name. What if I also want to see the process name? I specify the Property name<\/b> in addition to the property I want to expand:<\/p>\n

PS C:\\> Get-Process notepad | Select -Property name -ExpandProperty startinfo<\/p>\n

Name                    : notepad<\/p>\n

Verb                    :<\/p>\n

Arguments               :<\/p>\n

CreateNoWindow          : False<\/p>\n

EnvironmentVariables    : {ProgramW6432, Path, PROCESSOR_IDENTIFIER, TEMP…}<\/p>\n

RedirectStandardInput   : False<\/p>\n

RedirectStandardOutput  : False<\/p>\n

RedirectStandardError   : False<\/p>\n

StandardErrorEncoding   :<\/p>\n

StandardOutputEncoding  :<\/p>\n

UseShellExecute         : True<\/p>\n

Verbs                   : {}<\/p>\n

UserName                :<\/p>\n

Password                :<\/p>\n

Domain                  :<\/p>\n

LoadUserProfile         : False<\/p>\n

FileName                :<\/p>\n

WorkingDirectory        :<\/p>\n

ErrorDialog             : False<\/p>\n

ErrorDialogParentHandle : 0<\/p>\n

WindowStyle             : Normal<\/p>\n

What if I am only interested in the WindowStyle<\/b> property from the StartInfo<\/b> object? I can create a custom property by using a hash table with the Select-Object<\/b> cmdlet. This technique involves specifying a label and an expression. The label is a string, and it can be abbreviated as L<\/b>. The expression is a script block, and can be abbreviated as E<\/b>. Here is an example:<\/p>\n

Get-Process notepad | select -Property name, @{L="Style";E={$_.startinfo.WindowStyle}}<\/p>\n

When I run this, it returns the following custom object:<\/p>\n

\"Image<\/a><\/p>\n

This will work for all processes, for a single process, and for other embedded objects.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to work with embedded objects. Microsoft Scripting Guy, Ed Wilson, is here. This morning I have my Zune 1.0 cranked up, and I am listening to some tunes. I have a nice cup of English Breakfast tea, and a warm croissant beside me. I […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[51,3,4,61,45],"class_list":["post-6711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-getting-started","tag-scripting-guy","tag-scripting-techniques","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to work with embedded objects. Microsoft Scripting Guy, Ed Wilson, is here. This morning I have my Zune 1.0 cranked up, and I am listening to some tunes. I have a nice cup of English Breakfast tea, and a warm croissant beside me. I […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/6711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=6711"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/6711\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=6711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=6711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=6711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}