0

This is my powershell command: powershell -noprofile -NonInteractive -Command "(gwmi win32_process | select ProcessID,ParentProcessID,@{e={$_.GetOwner().User}}, CommandLine) | ft -AutoSize"

When I run it I get the following output

C:\Users\Administrator>powershell -noprofile -NonInteractive -Command  "(gwmi win32_process | select ProcessID,ParentProcessID,@{e={$_.GetOwner().User}}, CommandLine) | ft -AutoSize"

ProcessID ParentProcessID $_.GetOwner().User CommandLine
--------- --------------- ------------------ -----------
        0               0
        4               0
      236               4 SYSTEM
      332             320 SYSTEM
      384             320 SYSTEM             wininit.exe
      392             376 SYSTEM
      420             376 SYSTEM             winlogon.exe
      476             384 SYSTEM
      484             384 SYSTEM             C:\Windows\system32\lsass.exe
      544             476 SYSTEM             C:\Windows\system32\svchost.exe -k DcomLaunch
      584             476 NETWORK SERVICE    C:\Windows\system32\svchost.exe -k RPCSS
      680             420 DWM-1              "dwm.exe"
...
     1256            1176 Administrator      "C:\cygwin64\bin\mintty.exe" -i /Cygwin-Terminal.ico -
     3052            3000 Administrator      \??\C:\Windows\system32\conhost.exe 0x4
     2760            2856 Administrator      "C:\cygwin64\bin\bash.exe"
     2104            1176 Administrator      "C:\Windows\system32\cmd.exe"
     1504            2104 Administrator      \??\C:\Windows\system32\conhost.exe 0x4
     2440            1108 Administrator      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
     1268            2440 Administrator      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="2440.0.15...
     2472            2440 Administrator      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image...
     1496            2440 Administrator      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image...
     2640            2840 user001             C:\Windows\system32\cmd.exe /c c:\windows\temp\tmpyaoyv0.bat
     1040            2640 user001             \??\C:\Windows\system32\conhost.exe 0x4

I want to be able to filter for the user001 process

If I use where-object, I got this error:

+ ...  where-object {$.e -eq user001} | ft -AutoSize
+                    ~~~
    + CategoryInfo          : ObjectNotFound: ($.e:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

If I use where, I got this:

}}, CommandLine) | where $_.GetOwner().User -eq 'user001' | ft -AutoSize"
You cannot call a method on a null-valued expression.
At line:1 char:1
+ (gwmi win32_process | select ProcessID,ParentProcessID,@{e={$_.GetOwner().User}} ..
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

So what is the proper way to filter on $_.GetOwner().User?

  • Did you mean $_. See stackoverflow.com/questions/3494115/… – Zoredache Mar 4 '15 at 1:15
  • It does not help me at all. I know $_ means this. How can I access the user information from $_? Do I suppose to use where or where-object? – Anthony Kong Mar 4 '15 at 1:18
  • If you know that $_ means that, then why are you trying to use $.e in your code? You need to look at your errors output again. – Zoredache Mar 4 '15 at 1:23
0

Your error are just a standard syntax error you got by not using the $_. If you do use the propper $_.attribute you will get another error because of your unquoted use of user001.

Ignoring the syntax errors what you probably need is to do is set a name for the value in the Select-Object expression. This way you can easily use it later.

(gwmi win32_process | `
 Select-Object ProcessID, ParentProcessID, `
               @{Name='Owner';
                Expression={$_.GetOwner().User}}, `
               CommandLine) | `
Where-Object {$_.Owner -eq 'user001'}
  • it does not work: powershell -noprofile -NonInteractive -Command '(gwmi win32_process | Select-Object ProcessID, ParentProcessID, @{Name="Owner"; Expression={$_.GetOwner().User}}, CommandLine) | Where-Object {$_.Owner -eq "dop001"} | ft -AutoSize ' Error message:'Select-Object' is not recognized as an internal or external command, operable program or batch file. – Anthony Kong Mar 4 '15 at 3:55

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.