Filtering PowerShell Objects with Where-Object

The output of any PowerShell cmdlet is returns as objects. The Where-Object cmdlet is used in PowerShell to filter such objects. The Where-Object cmdlet allows you to filter the output of the previous command using a pipeline. In this article, we’ll show how to use the Where-Object cmdlet in PowerShell.

Let’s take a look at a simple example of using Where-Object. For example, we need to list the services running on the computer using the Get-Service cmdlet. To list only Windows services with a Running status, use the following command with Where-Object filter:

Get-Service | Where-Object Status -eq "Running"

powershell where filter

You can display all available cmdlet properties that can be used as a Where-Object filter using the command:

Get-Service | Get-Member -MemberType *Property*

powershell where object

There are two aliases for the Where-Object cmdlet — Where and the “?” character. The following two PowerShell commands are the same as the first command:

Get-Service | Where Status -eq "Running"

Get-Service | ? Status -eq "Running"

You can use multiple filter conditions in the Where-Object cmdlet. For example, we need to find all running services that contain the words Remote or Policy in DisplayName:

Get-Service | Where-Object {$_.Status -eq 'Running' -and $_.DisplayName -like 'Remote' -or $_.DisplayName -like '*Policy*'}

The number of conditions for filtering objects can be unlimited. If you need to use complex logic in a filter, limit the conditions with parentheses:

Get-Service | Where-Object {($_.Status -eq 'Running') -and ($_.DisplayName -like 'Remote' -or $_.DisplayName -like '*Policy*')}

Compare the results of the last two commands.

READ ALSO  PowerShell: Move Computer to OU

powershell where object filter

You can use different condition operators in the Where-Object cmdlet (the names of case-sensitive operators are shown in parentheses):

  • EQ (CEQ) — value is equal;
  • NE (CNE) — not equal;
  • GT (CGT) — the value is greater than;
  • LT (CLT) — less than;
  • LE (CLE) — less than or equal to;
  • GE (CGE) — more or equal;
  • Contains (CContains) — string entry;
  • NotContains (CNotContains) – occurrence in property;
  • Match (CMatch) — regular expression mask search;
  • NotMatch (CNotMatch) — no match by mask in regular expression;
  • Like (CLike) — filter by mask;
  • IS, IsNot — commonly used to check data types ($array | where {$_ -IsNot [int]}).

For example, the following command will list running processes that use more than 50MB of RAM, and sort them in a descending order:

Get-Process | ? {$_.WorkingSet -GT 50000*1024}|select processname,@{l="Working Memory (MB)"; e={$_.workingset / 1mb}} |sort "Working Memory (MB)" -Descending

where object filter in powershell

The Where-Object cmdlet is a powerful PowerShell filtering tool that comes handy when you need to select objects that match certain criteria from the returned objects.

Cyril Kardashevsky
READ ALSO  Accessing Domain Controller from Local DSRM Account

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.