PowerShell Where-Object – Complete Guide

PowerShell Where-object is a very important command you frequently use to filter data efficiently. It allows users to filter objects from a collection based on specified criteria, working in a way similar to SQL ‘WHERE’ clauses or LINQ methods in .NET. In this tutorial, you will learn everything about PowerShell Where-Object with examples.

Where-Object in PowerShell is a command used to filter objects based on their properties or expressions. It allows you to specify conditions that the objects must meet, returning only those that match the criteria. This cmdlet is commonly used in pipelines to refine the output of commands, making it easier to work with the exact data you need.

Understanding Where-Object in PowerShell

Where-Object in PowerShell filters objects from a collection based on specified conditions. It is often used in the pipeline to allow users to process only items that meet certain criteria.

The syntax for Where-Object includes a script block in which the conditions for filtering objects are defined. The script block can contain one or more conditions, and only the objects that satisfy all conditions will be passed down the pipeline. Below is an example of its syntax:

Get-Process | Where-Object { $_.CPU -gt 100 }

In this example, Get-Process generates a list of running processes, and Where-Object filters this list to return only the processes consuming more than 100 units of CPU time.

Here you can see the output in the screenshot below:

PowerShell Where-Object

Important characteristics of Where-Object:

  • Performant Filtering: By filtering objects on the left side of the pipeline, Where-Object improves efficiency by reducing the amount of data passed along the pipeline.
  • Flexibility: It accepts complex expressions, allowing users to perform detailed and nuanced filtering.
  • Versatility: It can be used with any PowerShell cmdlet that outputs objects to the pipeline.

Where-Object plays a crucial role in effective PowerShell scripting, especially when handling large datasets or performing operations involving resource-intensive tasks. The ability to filter early (filter left) maximizes performance by reducing the number of objects passed to subsequent cmdlets in the pipeline.

Basic Usage of PowerShell Where-Object

The Where-Object cmdlet in PowerShell is a flexible and powerful command used to filter objects from a collection based on specified conditions. It is typically used in the pipeline to select objects with certain attributes or satisfying a particular set of criteria.


The Where-Object cmdlet’s basic syntax is straightforward. It takes a FilterScript block, which is a script block that evaluates each object in the pipeline and returns True if the object should be included in the output. The syntax can be expressed as:

Where-Object {<FilterScript>}

For example, if a user wants to retrieve a list of services that are currently running, they might use the following command:

Get-Service | Where-Object {$_.Status -eq 'Running'}

In this instance, $_ represents each object passed to Where-Object from the pipeline, and -eq is the operator for equality.

FilterScript Block

A FilterScript block is a set of conditions defined in a script block {} that filters objects. The script block receives each object from the pipeline and uses comparison operators to evaluate it, producing a boolean result ($True or $False).


{ $_.<PropertyName> -<Operator> <Value> }

Operators include:

  • -eq: equals
  • -ne: not equals
  • -gt: greater than
  • -lt: less than
  • -ge: greater than or equals
  • -le: less than or equals


To select files that are larger than 1MB, the following FilterScript can be used:

Get-ChildItem | Where-Object {$_.Length -gt 1MB}

The Length property stores the size of the file, and the -gt operator is used to compare it with 1MB. If the condition returns True, the object is included in the output.

Comparison Operators

PowerShell Where-Object cmdlet leverages comparison operators to evaluate conditions and filter objects.

Standard Comparison Operators

Standard comparison operators in PowerShell perform comparisons in a case-insensitive manner by default. This means that when comparing two values, the case of the characters is not considered. Common operators include:

  • -eq: equals
  • -ne: not equals
  • -gt: greater than
  • -lt: less than
  • -ge: greater than or equal to
  • -le: less than or equal to

Here is the standard syntax for a comparison statement:

\$Object | Where-Object { $_.Property -Operator Value }

For example,

Get-Process | Where-Object { $_.PriorityClass -eq "Normal" }

This will list processes with a priority normal class, regardless of whether “Normal” is capitalized in the original property value.

Case-Sensitive Comparison Operators

When case sensitivity is a requirement, PowerShell provides case-sensitive variants of its comparison operators. These operators are prefixed with a ‘c’ to signify their case-sensitive nature. The list includes:

  • -ceq: case-sensitive equals
  • -cne: case-sensitive not equals
  • -cgt: case-sensitive greater than
  • -clt: case-sensitive less than
  • -cge: case-sensitive greater than or equal to
  • -cle: case-sensitive less than or equal to

Utilizing these operators requires explicit intent to compare values with attention to case sensitivity. An example of a case-sensitive comparison statement:

Get-Service | Where-Object { $_.Status -ceq "Running" }

This command retrieves only the services whose status exactly matches “Running” with case sensitivity, excluding those labeled as “running” or “RUNNING”.

Using Wildcards and Regular Expressions

When utilizing PowerShell’s Where-Object command, wildcards and regular expressions offer flexibility in filtering output. They enhance pattern-matching capabilities significantly.

The -Like and -NotLike Operators

The -Like and -NotLike operators in PowerShell allow the user to compare a string against a pattern using wildcards. The most common wildcard is the asterisk *, which represents any number of characters. A question mark ? wildcard represents a single character.

For example:

Get-Process | Where-Object { $_.Name -Like 's*' }

This command filters processes whose names start with the letter ‘s’.

In contrast, -NotLike excludes items matching the pattern:

Get-Service | Where-Object { $_.DisplayName -NotLike '*Network*' }

This command lists all services that do not contain the word “Network” in their display name.

The -Match and -NotMatch Operators

The -Match and -NotMatch operators in PowerShell use regular expressions for more complex pattern matching. Regular expressions, or regex, are sequences of characters that form a search pattern. They can be used to check if a string contains a specific sequence of characters.

For instance:

Get-Process | Where-Object { $_.Name -Match '^s.*' }

This command selects processes whose names start with ‘s’ (^ denotes the start of a string in regex).

Alternatively, -NotMatch filters out strings that meet the regex criteria:

Get-Process | Where-Object { $_.Name -NotMatch 'svc$' }

This collects processes where names do not end with ‘svc’ ($ denotes the end of a string in regex).

Advanced Filters using PowerShell Where-Object

When working with PowerShell, advanced scripting techniques often require script blocks and logical operators to create more complex filters. These methods enhance the capabilities of Where-Object to manage and manipulate objects effectively.

Using Script Blocks for Complex Filters

Script blocks are pivotal in advanced PowerShell scripting. They allow users to specify more sophisticated conditions when filtering objects. A script block is denoted by curly braces {} and can contain a sequence of PowerShell commands. When used with Where-Object, script blocks enable the evaluation of complex expressions, facilitating powerful filtering mechanisms.

For example:

Get-Process | Where-Object { $_.CPU -gt 100 -and $_.ProcessName -eq "notepad" }

In this command, the script block filters processes with a CPU usage greater than 100 and a process name of “notepad”.

Chaining Multiple Conditions

Chaining conditions is a method to apply a series of filters using logical operators such as -and, -or, and -not. This allows for a nuanced approach to filtering objects, where one can combine multiple criteria into a single query. Effective use of these operators can lead to more selective and precise results.

Example with multiple chained conditions:

Get-Service | Where-Object { $_.Status -eq "Running" -and ($_.StartType -eq "Automatic" -or $_.StartType -eq "Manual") }

This command selects services that are currently running and have a start type of either Automatic or Manual, demonstrating the use of -and and -or operators within a script block to create a complex filter.

Utilizing Pipelines and Objects

In PowerShell, pipelines allow for the passing of objects from one cmdlet to another, facilitating streamlined data manipulation. The Where-Object cmdlet is pivotal for filtering objects within this workflow.

Filtering Objects with Get-Command

PowerShell’s Get-Command cmdlet retrieves a list of all commands available in the session. When using it within a pipeline, Where-Object can filter these commands based on specific criteria. For instance:

Get-Command | Where-Object { $_.CommandType -eq 'Cmdlet' }

This command lists all cmdlets available to the user. Where-Object employs script blocks, { }, containing conditions that filter the output of Get-Command based on the CommandType property.

Combining Where-Object with ForEach-Object

For further manipulation of filtered objects, one can combine Where-Object with ForEach-Object. This allows for the execution of a script block on each item in the pipeline.

Get-Command | Where-Object { $_.CommandType -eq 'Function' } | ForEach-Object { $_.Name }

This sequence retrieves all PowerShell functions and then pipes them to ForEach-Object, which extracts the name of each function. By chaining these cmdlets, one can filter and then act upon the data efficiently.

Using Select-Object in conjunction with these cmdlets can help in selecting specific object properties, which further refine the output. Additionally, using aliases can shorten the commands, making them succinct; for example, foreach is an alias for ForEach-Object, and ? is an alias for Where-Object. It’s important to note that while aliases can speed up command typing, their use in scripts can reduce readability and maintainability.

Working with Specific Object Types in Where-Object

PowerShell’s Where-Object cmdlet serves as a versatile tool for filtering objects of specific types, such as files, directories, processes, and services. By utilizing its capabilities, one can query and manage system resources efficiently.

Filtering Files and Directories

In PowerShell, Get-ChildItem is commonly paired with Where-Object to filter files and directories based on properties like name, date, and LastWriteTime. For instance, to retrieve files modified within the last week, one might use:

Get-ChildItem -Path C:\ -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

Listing files filtered by extension can be achieved as follows:

Get-ChildItem -Path C:\*.txt -RecurseLists all text files in the C: drive.
`…Where-Object { $_.Name -like ‘report‘ }`

Finding empty directories becomes a matter of checking the object’s attributes:

Get-ChildItem -Path C:\ -Recurse | Where-Object { $_.PSIsContainer -and $_.GetFiles().Count -eq 0 }

Working with Processes and Services

When filtering processes, Get-Process coupled with Where-Object allows the listing of processes by status or name. For instance, to find active processes with a specific name:

Get-Process | Where-Object { $_.Name -eq 'notepad' }

Services are managed using Get-Service. One can filter these by Status or StartType:

Get-Service | Where-Object { $_.Status -eq 'Running' }

To display services set to start automatically but currently stopped:

Service PropertyFilter CriteriaPowerShell Command
StatusEquals ‘Stopped’`Get-Service
StartTypeEquals ‘Automatic’`…

Filtering results effectively relies on understanding the properties of the objects in question and constructing precise comparison expressions.

Best Practices for using PowerShell Where-Object

When utilizing Where-Object in PowerShell, users should adhere to a consistent set of best practices to ensure optimal performance and readability.

Firstly, they should be concise in their use of script blocks. Using {} signifies a script block, which is a powerful tool, but when overused it can lead to decreased performance. Preferring -Filter when available can be more efficient as it operates on the provider side.

In their queries, users must be specific with parameters to avoid confusion. Named parameters offer clarity, especially when a function accepts multiple parameters. They encourage self-documenting code, making it easier for others to understand.

Utilizing common parameters consistently can enhance scripts. Common parameters like -Verbose and -ErrorAction provide additional information that can be invaluable for debugging and logging.

A table to highlight key parameters:

-EQRepresents equality
-LT, -GTDenote less than and greater than respectively
-ContainsChecks if a collection contains a specific element
-LikeAllows wildcard matching

Being case-insensitive is the default behavior in PowerShell, which aids users who work across different platforms and systems. This enhances portability and reduces issues related to case sensitivity.

Lastly, they should always pass objects through the pipeline with care. Chaining Where-Object can be a useful way to filter results, but an overabundance of chained commands can impact readability and performance. They must strive for a balance between functional scripting and clear, maintainable code.

PowerShell Where-Object Examples

When working with Windows PowerShell 3.0, Where-Object serves as an indispensable filter for PowerShell data streams. It applies conditions to objects passed through the pipeline, allowing users to isolate items of interest. Below are practical applications of Where-Object with various comparison operators:

  1. Filtering with Equality
    • To list all services that are currently stopped, one may use: Get-Service | Where-Object { $_.Status -eq 'Stopped' }
  2. Date Comparisons
    • We can identify files modified more than 30 days ago with the AddDays method, coupled with -lt (less than): Get-ChildItem | Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-30) }
  3. Numerical Filtering
    • Finding processes using greater than 100 MB of memory uses -gt (greater than): Get-Process | Where-Object { $_.WS -gt 100MB }
  4. Combining Filters
    • Compounding conditions might involve listing users created in the last year but not recently modified: Get-ADUser | Where-Object { $_.whenCreated -gt (Get-Date).AddDays(-365) -and $_.whenChanged -eq $_.whenCreated }
  5. Exclusion via Not-Equals
    • To remove items from a collection that do not match a condition: $collection | Where-Object { $_ -ne "unwantedValue" }

Frequently Asked Questions

How can I use multiple conditions with the Where-Object cmdlet in PowerShell?

Multiple conditions are integrated into a single Where-Object cmdlet by using logical operators. -and, -or, and -not allow the combination of various expressions to refine filtering.

Can you provide an example of using Where-Object in a PowerShell command?

Certainly. To filter processes with more than 100 MB of memory usage, one might use: Get-Process | Where-Object {$_.WS -gt 100MB}.

What is the best way to filter strings that contain a specific substring using Where-Object?

To filter strings containing a specific substring, the -like operator is typically utilized along with wildcard characters: | Where-Object {$_ -like "*substring*"}.

How do I select objects that start with a certain string in PowerShell using Where-Object?

One selects objects starting with a specified string by applying the -like operator with the appropriate pattern: | Where-Object {$_ -like "string*"}.

What is the method to check for the presence of an item in an array using Where-Object?

To check for an item’s presence in an array, use -contains or -in operator: $array -contains 'item' or 'item' -in $array.

How does the ‘starts with’ and ‘in list’ functionality work with Where-Object in PowerShell?

The ‘starts with’ functionality uses -like paired with a wildcard suffix, and ‘in list’ leverages the -contains operator to evaluate if the array includes the specified element.


The Where-Object cmdlet enables users to filter objects based on specified criteria.

  • It accepts input directly from the pipeline or via the -InputObject parameter.
  • Utilizes script blocks {} to define conditions.

Key Points:

  • Versatility: Where-Object can handle various comparison operators (-eq, -gt, -lt, etc.).
  • Performance: For large datasets, using the .where() method on collections can offer performance benefits.
  • Script Blocks: Complex conditions can be applied using script blocks, providing a robust way to filter outputs.

Effective Usage:

  • Keep conditions as simple as possible.
  • For optimal performance, filter as early as possible in the pipeline.
  • Remember to combine conditions with logical operators (-and, -or) for refined control.

Example Usage:

Get-Process | Where-Object {$_.CPU -gt 100}

In this line of code, Where-Object filters processes consuming more than 100 CPU units.

I hope from this tutorial, you have a complete idea of how to use the PowerShell Where-Object.

You may also like: