Skip to content
PowerShell Commands

Where-Object

Where-Object [-Property*] <String> [[-Value] <Object>] -CContains* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CEQ* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CGE* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CGT* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CIn* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CLE* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CLT* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CLike* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CMatch* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CNE* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CNotContains* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CNotIn* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CNotLike* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -CNotMatch* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -Contains* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-EQ] [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-FilterScript*] <ScriptBlock> [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -GE* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -GT* [-In*putObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] -In* [-InputObject <PSObject>] [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -Is* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -Is*Not [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -LE* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -LT* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -Like* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -Match* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -NE* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -NotContains* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -NotIn* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -NotLike* [<CommonParameters>]
Where-Object [-Property*] <String> [[-Value] <Object>] [-In*putObject <PSObject>] -NotMatch* [<CommonParameters>]

The Where-Object cmdlet selects objects that have particular property values from the collection of objects that are passed to it. For example, you can use the Where-Object cmdlet to select files that were created after a certain date, events with a particular ID, or computers that use a particular version of Windows.

Starting in Windows PowerShell 3.0, there are two different ways to construct a Where-Object command. Script block . You can use a script block to specify the property name, a comparison operator, and a property value. Where-Object returns all objects for which the script block statement is true.

For example, the following command gets processes in the Normal priority class, that is, processes where the value of the PriorityClass property equals Normal.

`Get-Process | Where-Object {$_.PriorityClass -eq "Normal"}`

All Windows PowerShell comparison operators are valid in the script block format. For more information about comparison operators, see about_Comparison_Operators (http://go.microsoft.com/fwlink/?LinkID=113217). Comparison statement . You can also write a comparison statement, which is much more like natural language. Comparison statements were introduced in Windows PowerShell 3.0.

For example, the following commands also get processes that have a priority class of Normal. These commands are equivalent and can be used interchangeably.

`Get-Process | Where-Object -Property PriorityClass -eq -Value "Normal"`

`Get-Process | Where-Object PriorityClass -eq "Normal"`

Starting in Windows PowerShell 3.0, Where-Object adds comparison operators as parameters in a Where-Object command. Unless specified, all operators are case-insensitive. Prior to Windows PowerShell 3.0, the comparison operators in the Windows PowerShell language could be used only in script blocks.

Parameters

-CContains [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects from a collection if the property value of the object is an exact match for the specified value. This operation is case-sensitive.

For example: `Get-Process | where ProcessName -CContains "svchost"` CContains refers to a collection of values and is true if the collection contains an item that is an exact match for the specified value. If the input is a single object, Windows PowerShell converts it to a collection of one object.

This parameter was introduced in Windows PowerShell 3.0.

-CEQ [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is the same as the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CGE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is greater than or equal to the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CGT [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is greater than the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CIn [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value includes the specified value. This operation is case-sensitive.

For example: `Get-Process | where -Value "svchost" -CIn ProcessName` CIn resembles CContains , except that the property and value positions are reversed. For example, the following statements are both true.

"abc", "def" -CContains "abc"

"abc" -CIn "abc", "def"

This parameter was introduced in Windows PowerShell 3.0.

-CLE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is less-than or equal to the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CLT [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is less-than the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CLike [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value matches a value that includes wildcard characters. This operation is case-sensitive.

For example: `Get-Process | where ProcessName -CLike "*host"`

This parameter was introduced in Windows PowerShell 3.0.

-CMatch [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value matches the specified regular expression. This operation is case-sensitive. When the input is scalar, the matched value is saved in $Matches automatic variable.

For example: `Get-Process | where ProcessName -CMatch "Shell"`

This parameter was introduced in Windows PowerShell 3.0.

-CNE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is different than the specified value. This operation is case-sensitive.

This parameter was introduced in Windows PowerShell 3.0.

-CNotContains [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value of the object is not an exact match for the specified value. This operation is case-sensitive.

For example: `Get-Process | where ProcessName -CNotContains "svchost"`

"NotContains" and "CNotContains refer to a collection of values and are true when the collection does not contains any items that are an exact match for the specified value. If the input is a single object, Windows PowerShell converts it to a collection of one object.

This parameter was introduced in Windows PowerShell 3.0.

-CNotIn [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is not an exact match for the specified value. This operation is case-sensitive.

For example: `Get-Process | where -Value "svchost" -CNotIn -Property ProcessName` NotIn and CNotIn operators resemble NotContains and CNotContains , except that the property and value positions are reversed. For example, the following statements are true.

"abc", "def" -CNotContains "Abc"

"abc" -CNotIn "Abc", "def"

-CNotLike [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value does not match a value that includes wildcard characters. This operation is case-sensitive.

For example: `Get-Process | where ProcessName -CNotLike "*host"`

This parameter was introduced in Windows PowerShell 3.0.

-CNotMatch [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value does not match the specified regular expression. This operation is case-sensitive. When the input is scalar, the matched value is saved in $Matches automatic variable.

For example: `Get-Process | where ProcessName -CNotMatch "Shell"`

This parameter was introduced in Windows PowerShell 3.0.

-Contains [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if any item in the property value of the object is an exact match for the specified value.

For example: `Get-Process | where ProcessName -Contains "Svchost"`

If the property value contains a single object, Windows PowerShell converts it to a collection of one object.

This parameter was introduced in Windows PowerShell 3.0.

-EQ [<SwitchParameter>]

  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is the same as the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-FilterScript <ScriptBlock>

  • This value is required
  • Default value is None
  • Accepts pipeline input False

Specifies the script block that is used to filter the objects. Enclose the script block in braces ( {} ).

The parameter name, FilterScript , is optional.

-GE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is greater than or equal to the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-GT [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is greater than the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-In [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value matches any of the specified values.

For example: `Get-Process | where -Property ProcessName -in -Value "Svchost", "TaskHost", "WsmProvHost"`

If the value of the Value parameter is a single object, Windows PowerShell converts it to a collection of one object.

If the property value of an object is an array, Windows PowerShell uses reference equality to determine a match. Where-Object returns the object only if the value of the Property parameter and any value of Value are the same instance of an object.

This parameter was introduced in Windows PowerShell 3.0.

-InputObject <PSObject>

  • Default value is None
  • Accepts pipeline input ByValue

Specifies the objects to be filtered. You can also pipe the objects to Where-Object .

When you use the InputObject parameter with Where-Object , instead of piping command results to Where-Object , the InputObject value is treated as a single object. This is true even if the value is a collection that is the result of a command, such as `-InputObject (Get-Process)`. Because InputObject cannot return individual properties from an array or collection of objects, we recommend that, if you use Where-Object to filter a collection of objects for those objects that have specific values in defined properties, you use Where-Object in the pipeline, as shown in the examples in this topic.

-Is [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is an instance of the specified .NET Framework type. Enclose the type name in square brackets.

For example, `Get-Process | where StartTime -Is [DateTime]`

This parameter was introduced in Windows PowerShell 3.0.

-IsNot [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is not an instance of the specified .NET Framework type.

For example, `Get-Process | where StartTime -IsNot [System.String]`

This parameter was introduced in Windows PowerShell 3.0.

-LE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is less than or equal to the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-LT [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is less than the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-Like [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value matches a value that includes wildcard characters.

For example: `Get-Process | where ProcessName -Like "*host"`

This parameter was introduced in Windows PowerShell 3.0.

-Match [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value matches the specified regular expression. When the input is scalar, the matched value is saved in $Matches automatic variable.

For example: `Get-Process | where ProcessName -Match "shell"`

This parameter was introduced in Windows PowerShell 3.0.

-NE [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is different than the specified value.

This parameter was introduced in Windows PowerShell 3.0.

-NotContains [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if none of the items in the property value is an exact match for the specified value.

For example: `Get-Process | where ProcessName -NotContains "Svchost"` NotContains refers to a collection of values and is true if the collection does not contain any items that are an exact match for the specified value. If the input is a single object, Windows PowerShell converts it to a collection of one object.

This parameter was introduced in Windows PowerShell 3.0.

-NotIn [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value is not an exact match for any of the specified values.

For example: `Get-Process | where -Value "svchost" -NotIn -Property ProcessName`

If the value of Value is a single object, Windows PowerShell converts it to a collection of one object.

If the property value of an object is an array, Windows PowerShell uses reference equality to determine a match. Where-Object returns the object only if the value of Property and any value of Value are not the same instance of an object.

This parameter was introduced in Windows PowerShell 3.0.

-NotLike [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects if the property value does not match a value that includes wildcard characters.

For example: `Get-Process | where ProcessName -NotLike "*host"`

This parameter was introduced in Windows PowerShell 3.0.

-NotMatch [<SwitchParameter>]

  • This value is required
  • Default value is False
  • Accepts pipeline input False

Indicates that this cmdlet gets objects when the property value does not match the specified regular expression. When the input is scalar, the matched value is saved in $Matches automatic variable.

For example: `Get-Process | where ProcessName -NotMatch "PowerShell"`

This parameter was introduced in Windows PowerShell 3.0.

-Property <String>

  • This value is required
  • Default value is None
  • Accepts pipeline input False

Specifies the name of an object property.

The parameter name, Property , is optional.

This parameter was introduced in Windows PowerShell 3.0.

-Value <Object>

  • Default value is None
  • Accepts pipeline input False

Specifies a property value.

The parameter name, Value , is optional.

This parameter was introduced in Windows PowerShell 3.0.

<CommonParameters>

This cmdlet supports the common parameters: Verbose, Debug,ErrorAction, ErrorVariable, WarningAction, WarningVariable,OutBuffer, PipelineVariable, and OutVariable.

Inputs
System.Management.Automation.PSObject
You can pipe the objects to this cmdlet.
Outputs
Object
This cmdlet returns selected items from the input object set.
Examples
  1. Get stopped services:
    PS C:\> Get-Service | Where-Object {$_.Status -eq "Stopped"}
PS C:\>  Get-Service | where Status -eq "Stopped"

PS C:\> Get-Process | Where-Object {$_.WorkingSet -gt 25000*1024}
PS C:\>  Get-Process | Where-Object WorkingSet -gt (25000*1024)

    This command gets a list of all services that are currently stopped. The $_ symbol represents each object that is passed to the Where-Object cmdlet.

    The first command uses the script block format. The second command uses the comparison statement format. The commands are equivalent and can be used interchangeably. Example2: Get processes based on working setThis command lists processes that have a working set greater than 25,000 kilobytes (KB). Because the value of the WorkingSet property is stored in bytes, the value of 25,000 is multiplied by 1,024.

    The first command uses the script block format. The second command uses the comparison statement format. The commands are equivalent and can be used interchangeably.

  2. Get processes based on process name:
    PS C:\> Get-Process | Where-Object {$_.ProcessName -Match "^p.*"}
PS C:\>  Get-Process | Where-Object ProcessName -Match "^p.*"

    This command gets the processes that have a ProcessName property value that begins with the letter p. The match operator lets you use regular expression matches.

    The first command uses the script block format. The second command uses the comparison statement format. The commands are equivalent and can be used interchangeably.

  3. Use the comparison statement format:
    PS C:\> Get-Process | Where-Object -Property Handles -GE -Value 1000
PS C:\>  Get-Process | where Handles -GEe 1000

    This example shows how to use the new comparison statement format of the Where-Object cmdlet.

    The first command uses the comparison statement format. In this command, no aliases are used and all parameters include the parameter name.

    The second command is the more natural use of the comparison command format. The where alias is substituted for the Where-Object cmdlet name and all optional parameter names are omitted.

  4. Get commands based on properties:
    1. The first pair of commands gets commands that have any value for the **OutputType** property of the command:
      PS C:\> Get-Command | where OutputType
PS C:\>  Get-Command | where {$_.OutputType}

      They omit commands that do not have an **OutputType** property and those that have an **OutputType** property, but no property value.

    2. The second pair of commands gets objects that are containers:
      PS C:\> Get-ChildItem | where PSIsContainer
PS C:\>  Get-ChildItem | where {$_.PSIsContainer}

      It gets objects that have the **PSIsContainer** property with a value of $True and excludes all others.The "equals $True" (-eq $True) part of the command is assumed by the language. You do not need to specify it explicitly.

    3. The third pair of commands uses the Not operator (!) to get objects that are not containers:
      PS C:\> Get-ChildItem | where {!$_.PSIsContainer}
PS C:\>  Get-ChildItem | where PSIsContainer -eq $False

      It gets objects that do have the **PSIsContainer** property and those that have a value of $False for the **PSIsContainer** property.You cannot use the Not operator (!) in the comparison statement format of the command.This example shows how to write commands that return items that are true or false or have any value for a specified property. The example shows both the script block and comparison statement formats for the command.

  5. Use multiple conditions:
    PS C:\> Get-Module -ListAvailable | where {($_.Name -notlike "Microsoft*" -and $_.Name -notlike "PS*") -and $_.HelpInfoUri}

    This example shows how to create a Where-Object command with multiple conditions.

    This command gets non-core modules that support the Updatable Help feature. The command uses the ListAvailable parameter of the Get-Module cmdlet to get all modules on the computer. A pipeline operator (|) sends the modules to the Where-Object cmdlet, which gets modules whose names do not begin with Microsoft or PS, and have a value for the HelpInfoURI property, which tells Windows PowerShell where to find updated help files for the module. The comparison statements are connected by the And logical operator.

    The example uses the script block command format. Logical operators, such as And and Or , are valid only in script blocks. You cannot use them in the comparison statement format of a Where-Object command.

    For more information about Windows PowerShell logical operators, see about_Logical_Operators (http://go.microsoft.com/fwlink/?LinkID=113238). For more information about the Updatable Help feature, see about_Updatable_Help (http://go.microsoft.com/fwlink/?LinkID=235801).

Additional Notes
 Starting in Windows PowerShell 4.0, Where() operator behavior has changed. Collection.Where('property -match 
 name') no longer accepts string expressions in the format Property -CompareOperator Value. However, the 
 Where() * operator accepts string expressions in the format of a scriptblock; this is still supported. The 
 following examples show the behavior that has changed.

 The following two examples show Where() object behavior that is no longer supported.

 `(Get-Process).Where('ProcessName -match PowerShell')`

 `(Get-Process).Where('ProcessName -match PowerShell', 'Last', 1)`

 The following three examples show Where() object behavior that is supported in Windows PowerShell 4.0 and 
 subsequent versions of Windows PowerShell.

 `(Get-Process).Where({$_.ProcessName -match "PowerShell"})`

 `(Get-Process).Where{$_.ProcessName -match "PowerShell"}`

 `(Get-Process).Where({$_.ProcessName -match "PowerShell"}, 'Last', 1)`

This work is licensed under a Creative Commons Attribution 4.0 International. It is attributed to Microsoft Corporation and can be found here.

PowerShell Commands