Filtering PowerShell Objects with Where-Object

Filtering PowerShell Objects with Where-Object

The output of any PowerShell cmdlet is returned as objects. The Where-Object cmdlet is used in PowerShell to filter such objects. The Where-Object cmdlet allows filtering the output of the previous command using a pipeline.

In this article, we’ll show how to use the Where-Object cmdlet in PowerShell.

Using Where-Object

 For example, if we need to list the services running on the computer using the Get-Service cmdlet. To list only Windows services with a Running status, use the following command with Where-Object filter:

Get-Service | Where-Object Status -eq “Running”

Display all available cmdlet properties that can be used as a Where-Object filter using the command:

Get-Service | Get-Member -MemberType *Property*


There are two aliases for the Where-Object cmdlet — Where and the “?” character.

The following two PowerShell commands are the same as the first command:

Get-Service | Where Status -eq “Running”

Get-Service | ? Status -eq “Running”

Filter conditions

You may use different and multiple filter conditions in the Where-Object cmdlet.

For example, we need to find all running services that contain the words Remote or Policy in DisplayName:

Get-Service | Where-Object {$_.Status -eq ‘Running’ -and $_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’}

The number of conditions for filtering objects will be unlimited. If you need to use complex logic in a filter, limit the conditions with parentheses:

Get-Service | Where-Object {($_.Status -eq ‘Running’) -and ($_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’)}

Compare the results of the last two commands.

You can use different condition operators in the Where-Object cmdlet (the names of case-sensitive operators are shown in parentheses):

EQ (CEQ) — value is equal;

NE (CNE) — not equal;

GT (CGT) — the value is greater than;

LT (CLT) — less than;

LE (CLE) — less than or equal to;

GE (CGE) — more or equal;

Contains (CContains) — string entry;

NotContains (CNotContains) – occurrence in property;

Match (CMatch) — regular expression mask search;

not match (CNotMatch) — no match by mask in regular expression;

Like (CLike) — filter by mask;                                                             

IS, IsNot — commonly used to check data types ($array | where {$_ -IsNot [int]}).

For example, the following command will list running processes that use more than 50MB of RAM, and sort them in descending order:

Get-Process | ? {$_.WorkingSet -GT 50000*1024}|select processname,@{l=”Working Memory (MB)”; e={$_.workingset / 1mb}} |sort “Working Memory (MB)” -Descending

The Where-Object cmdlet is a powerful PowerShell filtering tool that comes in handy when you need to select objects with certain special from the returned objects.

Donate! If you like this Article and saved your Day...
BTC Addres:
  • Send only BTC to this deposit address.
  • Ensure the network is BNB Smart Chain (BEP20).

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter Captcha Here :