What is the -view parameter of Format-List? - powershell

Format-List apparently has a string parameter named "view", as can be seen here. What does it do, and how does it work? I cannot find any documentation beyond "The name of an alternate format or 'view.'"

The '-View' parameter on the various Format-* cmdlets allows you to get various different "views" or formattings of the data e.g.:
PS> Get-Process
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
672 56 272684 220692 975 141.45 8480 powershell
692 34 47184 60156 234 23.73 17048 powershell
751 82 217624 162780 1047 157.73 13336 powershell_ise
versus
PS> Get-Process | Format-Table -View StartTime
StartTime.ToShortDateString(): 1/14/2013
ProcessName Id HandleCount WorkingSet
----------- -- ----------- ----------
powershell 8480 672 225988608
StartTime.ToShortDateString(): 2/6/2013
ProcessName Id HandleCount WorkingSet
----------- -- ----------- ----------
powershell 17048 624 92418048
StartTime.ToShortDateString(): 1/17/2013
ProcessName Id HandleCount WorkingSet
----------- -- ----------- ----------
powershell_ise 13336 771 166686720
As for determining which commands support alternate views, you can usually find such info in the docs. Here's an excerpt from the Get-Process help:
You can also use the built-in alternate views of the processes
available with Format-Table, such as "StartTime" and "Priority", and
you can design your own views. For more information, see
T:Microsoft.PowerShell.Commands.Format-Table.
The PowerShell Community Extensions also includes a command called Get-ViewDefinition that can get this info when the docs aren't available (or of much help in this regards.

Related

How would I select the KB numbers in the output of the Get-WindowsUpdate command?

PS C:\Windows\system32> Get-WindowsUpdate
ComputerName Status KB Size Title
------------ ------ -- ---- -----
computer ------- KB890830 2MB Windows Malicious Software Removal Tool x64 - February 2020 (KB890830)
computer ------- KB4537759 21MB 2020-02 Security Update for Adobe Flash Player for Windows 10 Version 1909 for x64-based Systems (KB4537759)
computer ------- KB2267602 607MB Security Intelligence Update for Windows Defender Antivirus - KB2267602 (Version 1.309.835.0)
computer ------- KB4532693 84GB 2020-02 Cumulative Update for Windows 10 Version 1909 for x64-based Systems (KB4532693)
I have tried Get-WindowsUpdate | Select-Object KB, but it just returns the following:
KB
--
If you are using powershell version 3 or above you can get KB by calling the member directly:
(Get-WindowsUpdate).KB
Which will return:
KB890830
KB4537759
KB2267602
KB4532693
This is from the PSWindowsUpdate module. You have to run it elevated too, yuck. It seems to return collections you have to unravel:
(get-windowsupdate | select -first 1).gettype()
IsPublic IsSerial Name BaseType
-------- -------- ---- --------
True True Collection`1 System.Object
get-windowsupdate | foreach { $_ } | select kb
KB
--
KB890830
KB2267602

Why is Get-DnsClientServerAddress | select AddressFamily output not IPv4 and IPv6

When I type the cmdlet Get-DnsClientServerAddress I get all the interfaces my PC has like for example
InterfaceAlias Interface Address ServerAddresses
Index Family
-------------- --------- ------- ---------------
Ethernet 7 IPv4 {10.10.15.40, 10.10.25.44}
So when I type in Get-DnsClientServerAddress | where AddressFamily -Like "4" I would expect to see the Ethernet Adapter.
But for any reason it didn't show up. So I typed Get-DnsClientServerAddress | select AddressFamily and what I got was
AddressFamily
-------------
2
23
2
23
Can anyone explain this to me ?
As you found, the AddressFamily is categorised internally using a (not obvious) numbering scheme, where IPv4 addresses are type '2'. This comes from the underlying WMI type (MSFT_DNSClientServerAddress) and is not an issue with PowerShell.
The default display helps you out by translating this to IPv4, etc, but you can't filter on that as it's for display only. You can, however, still filter if you use the correct value:
Get-DnsClientServerAddress | Where-Object AddressFamily -Like 2
This formatting of data for display purposes happens all the time in PowerShell and is acheived through Format.ps1xml files. For example, compare the output of the Working Set values from Get-Process in table and list format:
PS C:\> Get-Process powershell
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
662 31 97928 110256 1.27 11452 2 powershell
PS C:\> Get-Process powershell | Format-List *
Handles : 705
VM : 2204040044544
WS : 113082368
PM : 100356096
NPM : 31512
The property (itself added by PowerShell for convenience) is called WS, but is shown as WS(K) in the table and the actual value is stored in bytes, but is displayed in KB, so some manipulation is going on for the default output.
Following from my comment, I would use Get-NetIPAddress instead.
Get-NetIPAddress -InterfaceAlias "Ethernet" | Select-Object FamilyAddress

PowerShell: Getting Help on Get-Process -Property CPU

With PowerShell 3, I tried to get help on what properties are available for CPU; while using Get-Process. I just tried a shot in the dark, as below:
Help Get-Process -Property CPU
But, failed. Any help, please!
What are you looking for? Information about your processor? Get-Process list running processes(e.g. internet explorer) on your computer, not info about your processor-chips(CPU). Ex:
Get-Process
Output:
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
284 25 7128 8748 103 1608 AppleMobileDeviceService
75 7 1136 1528 44 1588 armsvc
703 82 6612 7732 114 1,25 4212 AsusAudioCenter
Information about your processor can be found using:
Get-WmiObject Win32_Processor
Output:
Caption : Intel64 Family 6 Model 42 Stepping 7
DeviceID : CPU0
Manufacturer : GenuineIntel
MaxClockSpeed : 3400
Name : Intel(R) Core(TM) i7-2600 CPU # 3.40GHz
SocketDesignation : LGA1155
To get all properties about your CPU use Get-WmiObject Win32_Processor | fl *. To get a list of avaiable properties, use the Get-Member cmdlet to examine the object that Get-WmiObjectreturns:
Get-WmiObject Win32_Processor | Get-Member
Your shot in the dark missed. Also, since your description of what went wrong is nothing more than "But, failed.", I can only guess at what your problem might be. In order to better help you use help you need to help us by providing pertinent information about your problem such as error messages.
Firstly, Help (or the Get-Help cmdlet) does not have a -Property parameter. -Parameter might be what you looking for, however running Help Get-Process -Parameter CPU will reveal that the Get-Process cmdlet does not have a CPU parameter.
Secondly, Get-Process returns instances of the System.Diagnostics.Process class. The documentation or running Get-Process | Get-Member will show you what properties that class exposes. You can retrieve them by running something like...
Get-Process | Select-Object -Property (
'ProcessName',
'Id',
'ProcessorAffinity',
'UserProcessorTime',
'PrivilegedProcessorTime',
'TotalProcessorTime'
);
Finally, unlike previous versions PowerShell 3.0 does not install local help content. You need to run the Update-Help cmdlet to download and install help content. Alternatively, when running Get-Help you can pass the -Online parameter which will open the help content from MSDN in a web browser.

Powershell Test-Connection: different results when run AsJob vs straight-up

Short version: Why does Test-Connection provide only one result when running -AsJob?
Detailed version:
When the Test-Connection (ping!) command is run in Powershell (running as Administrator) it uses the default value of 4 for the Count parameter. This gives me the expected results (some irrelevant data removed for clarity):
PS C:\Windows\system32> Test-Connection www.stackoverflow.com
Destination IPV4Address IPV6Address Bytes Time(ms)
----------- ----------- ----------- ----- --------
www.stackove... 64.34.119.12 {} 32 117
www.stackove... 64.34.119.12 {} 32 113
www.stackove... 64.34.119.12 {} 32 111
www.stackove... 64.34.119.12 {} 32 113
However, when I run it with the -AsJob flag, it seems (when running Receive-Job, after waiting a few secs) the Count was only 1, but I expected it to be 4 and get similar results as above. Instead I get this:
PS C:\Windows\system32> Test-Connection www.stackoverflow.com -AsJob
Id Name State HasMoreData Location Command
-- ---- ----- ----------- -------- -------
1 Job1 Running False . Test-Connection
PS C:\Windows\system32> Receive-Job 1
Destination IPV4Address IPV6Address Bytes Time(ms)
----------- ----------- ----------- ----- --------
www.stackove... 64.34.119.12 {} 32 113
The AsJob variant always returns one row, even if you provide a specific value for Count.
My Google-fu and Get-Help-fu don't seem to be sufficient. Can someone please explain what's going on here, preferably with some pointers how and where to find this info myself (e.g. which help files or sources explain this behavior)?
Could be a bug. In v3 you get back 4 pings.

Can I use PowerShell 1.0 to list processes along with their PIDs and Command Lines?

EDIT by OP: My question presupposed that PowerShell was the best tool for this job. There is a simpler way of achieving my goal. A friend just told me about: iisapp.vbs. It displays exactly the info I need without requiring PowerShell.
I'm working with dozens of ASP.NET websites running locally and when I want to debug a particular website named, for example, foo.site.com I go through the following steps:
Run Process Explorer (from SysInternals) and find which w3wp.exe was started with foo.site.com on its command line.
Note the Process ID (PID) of that w3wp.exe process.
In Visual Studio attach to that process ID.
Is there a way to write a PowerShell script that will print the PID and Command Line Arguments of every w3wp.exe process running on my computer?
When I run get-process w3wp I get:
> get-process w3wp
Handles NPM(K) PM(K) WS(K) VM(M) CPU(s) Id ProcessName
------- ------ ----- ----- ----- ------ -- -----------
688 28 44060 64576 226 2.75 196 w3wp
750 26 48328 68936 225 3.38 1640 w3wp
989 36 54596 83844 246 4.92 1660 w3wp
921 33 54344 80576 270 4.24 5624 w3wp
773 27 48808 72448 244 2.75 5992 w3wp
No Command Line information :(
Thanks!
EDIT: I am looking for the command line arguments that were passed to w3wp.
gwmi win32_process -filter "name='w3wp.exe'" | select name,processId,commandLine
It should do the trick. I find it weird that powershell doesn't provide command line information by default. Note : I've only tested it in powershell 2.0, but as it use wmi, it should work in 1.0.
EDIT : the final version used by Tim Stewart (to avoid display problem, see comment) :
gwmi win32_process -filter "name='powershell.exe'" | format-table -autosize name,processId,commandLine
My first instinct was to use get-process and look at the startinfo property:
get-process w3wp | select-object id, path, #{Name="Args";Expression = {$_.StartInfo.Arguments}}
Unfortunately, this doesn't work because $_.StartInfo.Argments is always null. WMI works, though.
get-wmiobject win32_process -filter "name='w3wp.exe'" | select-object processid, commandline
This should work:
get-process | format-table Id,Path