{"id":297,"date":"2014-09-22T15:17:50","date_gmt":"2014-09-22T19:17:50","guid":{"rendered":"http:\/\/adsecurity.org\/?p=297"},"modified":"2014-09-23T18:58:46","modified_gmt":"2014-09-23T22:58:46","slug":"powershell-filter-operators","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=297","title":{"rendered":"Powershell Filter Operators"},"content":{"rendered":"<p>Once you get used to Powershell, you will want to do more and more with it.\u00a0 One of the keys to leveraging the power of PowerShell is filters.<br \/>\nPowerShell commandlets all support filters (well, most of them anyway).\u00a0 This means you can drill down to resulting data subsets.<br \/>\nIf you run into commandlets that don\u2019t support the native -filter you can always pipe to where-object (aka \u201cwhere\u201d).<\/p>\n<p>In other words you can do this: <em>get-service | Where {$_.Status -eq \u201cRunning\u201d}<\/em><br \/>\nThis takes the results of a generic get-service request which returns a full list of system services and pares it down to only the running services.<br \/>\nChange \u201cRunning\u201d to \u201cStopped\u201d and you get, obviously a list of services that are stopped.<\/p>\n<p>You can also pipe the service name into the get-service commandlet: <em>\u201cW32Time\u201d | get-service<\/em><\/p>\n<p>Here\u2019s a great chart I found on the <a href=\"http:\/\/blogs.msdn.com\/b\/adpowershell\/archive\/2009\/04\/14\/active-directory-powershell-advanced-filter-part-ii.aspx\">MSDN Blogs<\/a> that describes what each filter operator does:<\/p>\n<table border=\"1\" cellspacing=\"0\" cellpadding=\"1\">\n<tbody>\n<tr>\n<td valign=\"top\" width=\"112\"><strong>Logical Operator<\/strong><\/td>\n<td valign=\"top\" width=\"267\"><strong>Description<\/strong><\/td>\n<td valign=\"top\" width=\"178\"><strong>Equivalent LDAP operator\/<\/strong><strong>expression<\/strong><\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-eq<\/td>\n<td valign=\"top\" width=\"267\">Equal to. This will <strong>not<\/strong> support wild card search.<\/td>\n<td valign=\"top\" width=\"178\">=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-ne<\/td>\n<td valign=\"top\" width=\"267\">Not equal to. This will <strong>not<\/strong> support wild card search.<\/td>\n<td valign=\"top\" width=\"178\">! x = y<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-like<\/td>\n<td valign=\"top\" width=\"267\">Similar to -eq and supports wildcard comparison. The only wildcard character supported is: <strong>*<\/strong><\/td>\n<td valign=\"top\" width=\"178\">=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-notlike<\/td>\n<td valign=\"top\" width=\"267\">Not like. Supports wild card comparison.<\/td>\n<td valign=\"top\" width=\"178\">! x = y<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-approx<\/td>\n<td valign=\"top\" width=\"267\">Approximately equal to<\/td>\n<td valign=\"top\" width=\"178\">~=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-le<\/td>\n<td valign=\"top\" width=\"267\">Lexicographically less than or equal to<\/td>\n<td valign=\"top\" width=\"178\">&lt;=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-lt<\/td>\n<td valign=\"top\" width=\"267\">Lexicographically less than<\/td>\n<td valign=\"top\" width=\"178\">! x &gt;= y<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-ge<\/td>\n<td valign=\"top\" width=\"267\">Lexicographically greater than or equal to<\/td>\n<td valign=\"top\" width=\"178\">&gt;=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-gt<\/td>\n<td valign=\"top\" width=\"267\">Lexicographically greater than<\/td>\n<td valign=\"top\" width=\"178\">! x &lt;= y<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-and<\/td>\n<td valign=\"top\" width=\"267\">AND<\/td>\n<td valign=\"top\" width=\"178\">&amp;<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-or<\/td>\n<td valign=\"top\" width=\"267\">OR<\/td>\n<td valign=\"top\" width=\"178\">|<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-not<\/td>\n<td valign=\"top\" width=\"267\">NOT<\/td>\n<td valign=\"top\" width=\"178\">!<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-bor<\/td>\n<td valign=\"top\" width=\"267\">Bitwise OR<\/td>\n<td valign=\"top\" width=\"178\">:1.2.840.113556.1.4.804:=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-band<\/td>\n<td valign=\"top\" width=\"267\">Bitwise AND<\/td>\n<td valign=\"top\" width=\"178\">:1.2.840.113556.1.4.803:=<\/td>\n<\/tr>\n<tr>\n<td valign=\"top\" width=\"112\">-recursivematch<\/td>\n<td valign=\"top\" width=\"267\">Uses LDAP_MATCHING_RULE_IN_CHAIN (Win2k3 SP2 and above)<\/td>\n<td valign=\"top\" width=\"178\">:1.2.840.113556.1.4.1941:=<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Using filters is extremely helpful is narrowing down the scope to fine-tune the data you need to work with and this chart is one I frequently reference.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Once you get used to Powershell, you will want to do more and more with it.\u00a0 One of the keys to leveraging the power of PowerShell is filters. PowerShell commandlets all support filters (well, most of them anyway).\u00a0 This means you can drill down to resulting data subsets. If you run into commandlets that don\u2019t &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/adsecurity.org\/?p=297\">Continue reading<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,4],"tags":[102,575,122,117,118],"class_list":["post-297","post","type-post","status-publish","format-standard","hentry","category-powershell","category-technical-reading","tag-microsoftwindows","tag-powershell","tag-powershellfilters","tag-windows7","tag-windowsserver","item-wrap"],"_links":{"self":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=297"}],"version-history":[{"count":1,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/297\/revisions"}],"predecessor-version":[{"id":298,"href":"https:\/\/adsecurity.org\/index.php?rest_route=\/wp\/v2\/posts\/297\/revisions\/298"}],"wp:attachment":[{"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adsecurity.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}