PowerShell 101, Lesson 3

Executive Summary: Windows PowerShell offers many different types of operators. For example, its comparison and logical operators let you create conditions that PowerShell evaluates to determine whether it should take specific actions. And its arithmetic operators let you not only perform mathematical calculations but also concatenate strings.

In PowerShell, you can connect cmdlets together to create a pipeline and use the Where-Object cmdlet to filter objects passed down that pipeline. For example, in the following statement, objects from the Get-ChildItem (referenced by the dir alias) cmdlet are piped to a Where-Object cmdlet (referenced by the where alias), which filters out all items in C:\Windows, except those larger than 500,000 bytes:

Notice that the Where-Object cmdlet includes an expression that’s enclosed in braces (\{ \}). The expression states that the current value of the Length property must be greater than 500,000. The value of the Length property is retrieved by using $_.length. The $_ symbol references the current object in the pipeline, and .length retrieves the value of the Length property. The expression then uses the -gt (greater than) operator to compare the Length property value to the value of 500,000.

As with any language, PowerShell provides a set of operators that let you create expressions you can incorporate into your statements. An expression is a block of code that PowerShell evaluates; the result of that evaluation determines what action to take. For example, in the preceding statement, PowerShell determines whether the Where-Object expression is true or false. When the expression evaluates to true—that is, the current object’s Length property value is greater than 500,000—that object is passed down the pipeline and displayed in the output. If the expression evaluates to false—that is, the current object’s Length property value isn’t greater than 500,000—the object is discarded and not displayed in the output.

PowerShell includes a variety of operators that you can use in your expressions. This lesson describes many of those operators and provides examples of how to use them. In addition, the Web-exclusive sidebar “How to Find Out a Cmdlet’s Properties,” www.windowsitpro.com, InstantDoc ID 98175, discusses how to find property names, such as those used in the Where-Object expressions in the examples provided.

Comparison Operators
As the name suggests, comparison operators compare values. When an expression contains a comparison operator, PowerShell compares the value to the left of the operator with the value to the right of it. You saw this idea in the preceding example, in which the Length property value is compared to 500,000. PowerShell provides many comparison operators, as Table 1, shows. Let’s examine some of those operators to see how they work.

The following statement does the opposite of the preceding example— it returns items whose lengths are smaller than 500,000 bytes:

As you can see, the only difference between the two statements is the comparison operator. This statement uses the -lt (less than) operator rather than the -gt operator.

Other comparison operators follow the same logic. The following statement uses the -eq (equal to) operator to compare the Responding property value to the string true in order to retrieve a list of responding processes:

For the Where-Object expression to evaluate to true, the Responding property value must equal true. As a result, only responding processes are returned, as Figure 1 shows.

By default, all comparison operators perform case-insensitive comparisons. If you want to be more precise in your code, you can add the letter i to a comparison operator (e.g., -ieq) to explicitly specify a case-insensitive comparison. However, because this is the default behavior, adding the i isn’t necessary.

You can make any comparison casesensitive by adding the letter c to the comparison operator (e.g., -ceq). For example, the statement

evaluates to true because it ignores case, whereas the statement

evaluates to false because it takes case into account.

I realize that these are very basic examples, but when working in a Windows environment, case often isn’t a concern because filenames, process names, and other item names are case-insensitive. But as you become more familiar with PowerShell and learn how to retrieve other types of lists in which case-sensitivity is important, you’ll find being able to make an operator casesensitive useful.

Another useful PowerShell feature is wildcards. For example, if you don’t know the exact name of an item when creating an expression to compare values, you can use wildcards in the compared value (the value after the operator). Table 2 describes the wildcards that PowerShell supports.

Continued on page 2

You implement wildcards through the use of the -like and -notlike comparison operators. (Note that -like and -notlike as well as -match, -notmatch, and -replace are sometimes referred to as pattern-matching operators.) For instance, suppose you want to find all Google-related processes on a computer. You can use the -like operator to return all processes created by companies whose name includes the string google:

The asterisk wildcard matches zero or more characters, so you’ll receive accurate results no matter whether the company name is stored in Windows as Google, Google Inc., or another variation. Figure 2 shows the results from this statement. If you were to use the -notlike operator instead of the -like operator, all non-Google processes would be returned.

In addition to wildcards, PowerShell supports regular expressions, which are based on the Microsoft .NET Framework regular expression classes. You implement regular expressions through the use of the -match and -notmatch operators. PowerShell’s support for regular expressions is quite extensive— as extensive as you would find in any .NET language. For this reason, a discussion about them is beyond the scope of this lesson. For information about them, see PowerShell’s about_regular_expression and about_comparison_ operators Help files.

Logical Operators
So far, I’ve discussed how to use comparison operators in expressions. When you use one of these operators, you create a condition that’s evaluated to determine whether to take a specific action. However, in some cases, you might want to create expressions that include multiple conditions. In other words, you might want to perform more than one comparison to determine whether to take that action.

To perform multiple comparisons in a single expression, you must use logical operators to link conditions together. Logical operators, which are described in Table 3, specify what logic to use when evaluating multiple conditions.

Let’s take a look at an example to illustrate how logical operators work. The following statement uses the Get- Process cmdlet to retrieve a list of running processes:

There are two conditions, each of which is enclosed in parentheses. The first condition ($_.handles -gt 500) specifies that the number of handles must be greater than 500 for a given process. The second condition ($_.pm -ne 0) specifies that the paged memory size must not equal 0. The -and logical operator connects these two conditions. As a result, both conditions must evaluate to true for the entire expression (enclosed in braces) to evaluate to true. Only those processes that meet both of these conditions are returned, as Figure 3 shows.

Now let’s take a look at the -or operator. The following statement is the same as the preceding example except that it uses -or instead of -and:

In this case, at least one of the conditions must evaluate to true for a process to be included. In other words, the process must have a handle count greater than 500 or the paged memory size must not equal 0 or both. As a result, many more processes are returned, as Figure 4 shows.

You can use the -not logical operator to indicate that a specified condition must not be true. For example, the following statement specifies that the handle count must be greater than 100 and the company name must not be Microsoft Corporation:

This statement returns all non-Microsoft processes, as Figure 5 shows.

Continued on page 3

Arithmetic Operators
PowerShell supports the use of arithmetic operators to perform mathematical calculations. Table 4 describes the operators and provides basic examples. In addition to using the operators for mathematical calculations, you can use some of the operators other ways. For example, you can use the + operator to concatenate string values:

Figure 6 shows the results of concatenating these two values. This figure also shows the results for the statement:

In this case, the * operator is used to multiply a string value four times. As a result, four copies of the value are returned, and those values are concatenated into one string.

My arithmetic-operator examples are very basic. As you work through the lessons, you’ll see more complex examples of how these operators can be used. This section is meant only to introduce you to the arithmetic operators so that you can begin to use them. To learn more about these types of operators, see the about_arithmetic_operators Help file.

Moving Forward
In this lesson, you learned that PowerShell supports a number of operators that let you create expressions and perform calculations. However, this lesson doesn’t cover all operators. For example, PowerShell also supports bitwise operators that perform binary operations and assignment operators that assign values to variables. I’ll be covering many of these operators as we progress through the lessons. In the meantime, refer to the Power-Shell Help files to learn more about the available operators.