Mick Huxley

Powershell is your Friend

I originally found Powershell difficult to use.  It was not due to it being CLI as I’m a big fan of the command prompt, but more so because a number of calls to integrate System Information resulted in the need to use WMI. 

“Get-WmiObject win32_service | ft Name,StartMode,StartName,State –AutoSize” will output in table format all of the services running on the local machine.  Here is a small extract

You may notice the colour of the image above isn’t the usual Powershell blue and white.  This is because I’m using the Powershell ISE (Integrated Scripting Environment).  The ISE is a component of Powershell v2.0 which shipped with Windows 7 and Windows Server 2008 R2 and is also available as a download for earlier versions of Windows.  The ISE provides a scripting environment for writing scripts rather then simply one-liners, but I digress.

Looking at the output in the one-liner above I’ve “|” piped the command to ft which is shorthand for Format-Table.  Data can also be displayed as a list using the format-list cmdlet or simply fl.  I find fl really handy when I can’t remember the name of a property.   An Exchange example is finding out the last backup time for a database.  I know that it is a property of the database so initially I would run “Get-Mailboxdatabase –Identity Servername\StorageGroupName\Mailbox Database” | fl *backup*.  This one-liner will return all the properties of the selected Mailbox Database that contain the word backup.  From this output I can see that LastFullBackup is the property I really want to see.  I can now go and modify my one-liner to show me the Last Full Backup for all Mailbox Databases on a server or in my Organisation.  Let’s limit it to a server.  “Get-MailboxDatabase –Server ExchangeServer –Status | ft Name,LastFullBackup –Autosize”

A couple of items of note here.  Because the backup is an action performed against the database and it’s not an Active Directory attribute I have to add the –Status to ensure the data is read from the object and not Active Directory.  I also added –Autosize at the end to ensure that the columns are spaced correctly in the display.

-Autosize sometimes doesn’t cut it though, simply because there is too much data on to be displayed on the screen.   In Powershell v1.0 we needed to then export our data to a CSV file so it could be manipulated in your favourite editor or Excel.  Looking at our get-wmiobject one-liner again.  In this example we use the export-csv cmdlet to send the output to a CSV file.

“Get-WmiObject win32_service | Select-Object -Property Name,StartMode,StartName,State | Sort-Object -Property Name | Export-Csv ~\service.csv”

That’s cool as the data can not be manipulated, sorted multiple times or if you choose to displayed as a graph or pie chart.

Powershell v2.0 offers another option to output using out-gridview.  This feature requires the Microsoft .Net Framework 3.5 SP1.  From here I can again apply filters similar to Excel. Let’s see it in action with our one-liner again.  “Get-WmiObject win32_service | Select-Object -Property Name,StartMode,StartName,State | Sort-Object -Property Name | Out-GridView”

In this example I have selected the Properties to output and then piped that to the out-gridview.  With format-table (ft) or format-list (fl) I would add the properties I want directly after ft or fl.  With Out-GridView I need to select them first and pipe that out.  Export-CSV works in the same manner as Out-GridView

The more astute of readers may have noticed something that looked a little funny in my export-csv path.  The filename to output to was ~\services.csv.  What is ~.  Well in Powershell it represents the home path.  Okay you say, that’s great Mick, what is the home path.  The home path is a variable assigned to each user and represents the root of their data.  Usually this will be C:\users\username, but maybe different if using Mandatory or Roaming profiles.  It can be found a number of ways but a good location is in the registry at “HKCU\Volatile Environment”

Of course, we are talking about Powershell so using Regedit.exe doesn’t seem quite right.   Here is the one-liner “Get-ItemProperty -Path "hkcu:Volatile Environment"”  Note here I am actually using Powershell to hook directly into the Registry.

As you can see from these examples Powershell can be extremely powerful and all we’ve done here is extract information.  Before signing off this post I’ll give you a few tips which may help you to get started with Powershell.

1. Have a purpose.  Trying to teach yourself Powershell or the sake of it can be very difficult.  I found the best way to get started with Powershell was using it for Microsoft Exchange.  The Exchange Product Team have done an amazing job with Exchange 2007 and 2010 for that matter.  When completing a wizard in the console the final screen has the Powershell one-liner displayed.  This allows you to start to look at how simple tasks are performed.  Also, if you see something in the console the name will be the same in the Shell.  So you want to add a new Accepted Domain the cmdlet is new-accepteddomain.  A new Mailbox is new-mailbox, a new Mail User new-mailuser.

2. Read up on some basics.  Powershell cmdlets are all in the form of verb-noun.  Get-Service, Suspend-StorageGroupCopy, New-Mailbox, Start-Vm.

3. Use tab complete typing get- and hitting tab will auto complete and start scrolling through the options.

4. Get-Help is your friend.  Particularly with Powershell v2.0 there is now a get-help –examples property.  Try running “get-help out-gridview –examples | more”

5. Wildcards are good so use * to your hearts content.

6. Pipe, Pipe, Pipe, by using | the output from the previous cmdlet is used as input for the next.  So an example is “Get-Service | Where {$_.Status -eq "Running"} | Out-GridView”.  In this example I enumerated all the services on the computer, taken that data and selected only the “Running” services and then taken this cut down data and displayed it with Out-GridView.

On a final note, you may have noticed for the above cmdlet I used “Get-Service” whilst earlier we were using “Get-WmiObject win32_service”.  Well spotted if you picked that up, the reason is because the account used to run the Service, the StartName property in the first example, isn’t available as a property of “Get-Service”.