Filtering PowerShell Objects with Where-Object

Filtering PowerShell Objects with Where-Object

The output of any PowerShell cmdlet is returned as objects. The Where-Object cmdlet is used in PowerShell to filter such objects. The Where-Object cmdlet allows filtering the output of the previous command using a pipeline.

In this article, we’ll show how to use the Where-Object cmdlet in PowerShell.

Using Where-Object

 For example, if we need to list the services running on the computer using the Get-Service cmdlet. To list only Windows services with a Running status, use the following command with Where-Object filter:

Get-Service | Where-Object Status -eq “Running”

Display all available cmdlet properties that can be used as a Where-Object filter using the command:

Get-Service | Get-Member -MemberType *Property*


There are two aliases for the Where-Object cmdlet — Where and the “?” character.

The following two PowerShell commands are the same as the first command:

Get-Service | Where Status -eq “Running”

Get-Service | ? Status -eq “Running”

Filter conditions

You may use different and multiple filter conditions in the Where-Object cmdlet.

For example, we need to find all running services that contain the words Remote or Policy in DisplayName:

Get-Service | Where-Object {$_.Status -eq ‘Running’ -and $_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’}

The number of conditions for filtering objects will be unlimited. If you need to use complex logic in a filter, limit the conditions with parentheses:

Get-Service | Where-Object {($_.Status -eq ‘Running’) -and ($_.DisplayName -like ‘Remote’ -or $_.DisplayName -like ‘*Policy*’)}

Compare the results of the last two commands.

You can use different condition operators in the Where-Object cmdlet (the names of case-sensitive operators are shown in parentheses):

EQ (CEQ) — value is equal;

NE (CNE) — not equal;

GT (CGT) — the value is greater than;

LT (CLT) — less than;

LE (CLE) — less than or equal to;

GE (CGE) — more or equal;

Contains (CContains) — string entry;

NotContains (CNotContains) – occurrence in property;

Match (CMatch) — regular expression mask search;

not match (CNotMatch) — no match by mask in regular expression;

Like (CLike) — filter by mask;                                                             

IS, IsNot — commonly used to check data types ($array | where {$_ -IsNot [int]}).

For example, the following command will list running processes that use more than 50MB of RAM, and sort them in descending order:

Get-Process | ? {$_.WorkingSet -GT 50000*1024}|select processname,@{l=”Working Memory (MB)”; e={$_.workingset / 1mb}} |sort “Working Memory (MB)” -Descending

The Where-Object cmdlet is a powerful PowerShell filtering tool that comes in handy when you need to select objects with certain special from the returned objects.

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter Captcha Here :