Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion reference/5.1/CimCmdlets/Register-CimIndicationEvent.md
Original file line number Diff line number Diff line change
Expand Up @@ -419,4 +419,3 @@ This cmdlet returns an **EventSubscription** object.
[New-CimSession](New-CimSession.md)

[about_WQL](../Microsoft.PowerShell.Core/About/about_WQL.md)

12 changes: 6 additions & 6 deletions reference/5.1/Microsoft.PowerShell.Core/Where-Object.md
Original file line number Diff line number Diff line change
Expand Up @@ -244,9 +244,9 @@ particular version of Windows.
Starting in Windows PowerShell 3.0, there are two different ways to construct a `Where-Object`
command.

- **Scriptblock syntax**. You can use a scriptblock to specify the property name, a comparison operator,
and a property value. `Where-Object` returns all objects for which the scriptblock statement is
true.
- **Scriptblock syntax**. You can use a scriptblock to specify the property name, a comparison
operator, and a property value. `Where-Object` returns all objects for which the scriptblock
statement is true.

For example, the following command gets processes where the value of the **PriorityClass**
property equals `Normal`.
Expand All @@ -256,9 +256,9 @@ command.
All PowerShell comparison operators are valid in the scriptblock format. For more information,
see [about_Comparison_Operators](./About/about_Comparison_Operators.md).

- **Simplified syntax**. To enable the simplified syntax, `Where-Object` includes 31 `[switch]`
- **Simplified syntax**. To enable the simplified syntax, `Where-Object` includes 31 switch
parameters that represent the comparison operators. The simplified syntax is easier to read and
write than the scriptblock syntax. You can combine one of the `[switch]` parameters with the
write than the scriptblock syntax. You can combine one of the switch parameters with the
**Property** and **Value** parameters to create a command that filters objects based on the
values of their properties.

Expand All @@ -271,7 +271,7 @@ command.

As shown in the example, the parameter names **Property** and **Value** are optional. The
**Property** parameter is a positional parameter mapped to position `0`. The **Value** parameter
is a positional parameter mapped to position `1`. The `[switch]` parameter, used to specify the
is a positional parameter mapped to position `1`. The switch parameter, used to specify the
comparison, can be used in any position.

The simplified syntax was introduced in Windows PowerShell 3.0. For more information, see
Expand Down
14 changes: 7 additions & 7 deletions reference/5.1/Microsoft.PowerShell.Diagnostics/Get-Counter.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,8 @@ Gets performance counter data from local and remote computers.
### GetCounterSet (Default)

```
Get-Counter [[-Counter] <String[]>] [-SampleInterval <Int32>] [-MaxSamples <Int64>] [-Continuous]
[-ComputerName <String[]>] [<CommonParameters>]
Get-Counter [[-Counter] <String[]>] [-SampleInterval <Int32>] [-MaxSamples <Int64>]
[-Continuous] [-ComputerName <String[]>] [<CommonParameters>]
```

### ListSetSet
Expand Down Expand Up @@ -244,11 +244,11 @@ Timestamp CounterSamples
5.35768447160776
```

The `Get-Random` cmdlet uses `Get-Content` to select 50 random computer names from the
`Servers.txt` file. The remote computer names are stored in the `$Servers` variable. The
`\Processor(*)\% Processor Time` counter's path is stored in the `$Counter` variable. `Get-Counter`
uses the **Counter** parameter to specify the counters in the `$Counter` variable. The
**ComputerName** parameter specifies the computer names in the `$Servers` variable.
The `Get-Random` cmdlet uses `Get-Content` to select 50 random computer names from the `Servers.txt`
file. The remote computer names are stored in the `$Servers` variable. The `\Processor(*)\%
Processor Time` counter's path is stored in the `$Counter` variable. `Get-Counter` uses the
**Counter** parameter to specify the counters in the `$Counter` variable. The **ComputerName**
parameter specifies the computer names in the `$Servers` variable.

### Example 8: Use the Path property to get formatted path names

Expand Down
76 changes: 46 additions & 30 deletions reference/5.1/Microsoft.PowerShell.Diagnostics/Get-WinEvent.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,28 +18,30 @@ Gets events from event logs and event tracing log files on local and remote comp

```
Get-WinEvent [[-LogName] <String[]>] [-MaxEvents <Int64>] [-ComputerName <String>]
[-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest] [<CommonParameters>]
[-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest]
[<CommonParameters>]
```

### ListLogSet

```
Get-WinEvent [-ListLog] <String[]> [-ComputerName <String>] [-Credential <PSCredential>] [-Force]
[<CommonParameters>]
Get-WinEvent [-ListLog] <String[]> [-ComputerName <String>] [-Credential <PSCredential>]
[-Force] [<CommonParameters>]
```

### ListProviderSet

```
Get-WinEvent [-ListProvider] <String[]> [-ComputerName <String>] [-Credential <PSCredential>]
[<CommonParameters>]
Get-WinEvent [-ListProvider] <String[]> [-ComputerName <String>]
[-Credential <PSCredential>] [<CommonParameters>]
```

### GetProviderSet

```
Get-WinEvent [-ProviderName] <String[]> [-MaxEvents <Int64>] [-ComputerName <String>]
[-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest] [<CommonParameters>]
[-Credential <PSCredential>] [-FilterXPath <String>] [-Force] [-Oldest]
[<CommonParameters>]
```

### FileSet
Expand Down Expand Up @@ -148,9 +150,9 @@ with the asterisk (`*`) wildcard to display each property.

### Example 3: Configure the classic Security log

This command gets an **EventLogConfiguration** object that represents the classic **Security** log. The
object is then used to configure settings for the log, such as max file size, file path, and whether the
log is enabled.
This command gets an **EventLogConfiguration** object that represents the classic **Security** log.
The object is then used to configure settings for the log, such as max file size, file path, and
whether the log is enabled.

```powershell
$log = Get-WinEvent -ListLog Security
Expand Down Expand Up @@ -193,11 +195,12 @@ ProviderLatency : 1000
ProviderControlGuid :
```

The `Get-WinEvent` cmdlet uses the **ListLog** parameter to specify the **Security** log. The object is
saved to a variable. The **MaximumSizeInBytes** property is set to 1 gigabyte on the object. The
The `Get-WinEvent` cmdlet uses the **ListLog** parameter to specify the **Security** log. The object
is saved to a variable. The **MaximumSizeInBytes** property is set to 1 gigabyte on the object. The
**SaveChanges** method is called to push the change to the system inside of a try block to handle
access violations. The `Get-WinEvent` cmdlet is called again on the **Security** log and piped to the
`Format-List` cmdlet to verify that the **MaximumSizeInBytes** property has been saved on the machine.
access violations. The `Get-WinEvent` cmdlet is called again on the **Security** log and piped to
the `Format-List` cmdlet to verify that the **MaximumSizeInBytes** property has been saved on the
machine.

### Example 4: Get event logs from a server

Expand Down Expand Up @@ -230,7 +233,8 @@ is a property of the object with a non-null value.

This example gets objects that represent the **Application** event logs on three computers:
Server01, Server02, and Server03. The `foreach` keyword is used because the **ComputerName**
parameter accepts only one value. For more information, see [about_Foreach](../Microsoft.PowerShell.Core/about/about_Foreach.md).
parameter accepts only one value. For more information, see
[about_Foreach](../Microsoft.PowerShell.Core/about/about_Foreach.md).

```powershell
$S = 'Server01', 'Server02', 'Server03'
Expand Down Expand Up @@ -341,7 +345,8 @@ This command lists the Event Ids that the **Microsoft-Windows-GroupPolicy** even
along with the event description.

```powershell
(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description
(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events |
Format-Table Id, Description
```

```Output
Expand All @@ -367,7 +372,8 @@ Event objects are stored in a variable and then grouped and counted by **Event I
```powershell
$Event = Get-WinEvent -LogName 'Windows PowerShell'
$Event.Count
$Event | Group-Object -Property Id -NoElement | Sort-Object -Property Count -Descending
$Event | Group-Object -Property Id -NoElement |
Sort-Object -Property Count -Descending
$Event | Group-Object -Property LevelDisplayName -NoElement
```

Expand Down Expand Up @@ -414,7 +420,7 @@ error or warning and the log name.

```powershell
Get-WinEvent -LogName *PowerShell*, Microsoft-Windows-Kernel-WHEA* |
Group-Object -Property LevelDisplayName, LogName -NoElement |
Group-Object -Property LevelDisplayName, LogName -NoElement |
Format-Table -AutoSize
```

Expand Down Expand Up @@ -507,10 +513,10 @@ Get-WinEvent -Path 'C:\Tracing\TraceLog.etl' -Oldest |

The `Get-WinEvent` cmdlet gets log information from the archived file. The **Path** parameter
specifies the directory and file name. The **Oldest** parameter is used to output events in the
order they're written, oldest to newest. The objects are sent down the pipeline to the
`Sort-Object` cmdlet `Sort-Object` sorts the objects in descending order by the value of the
**TimeCreated** property. The objects are sent down the pipeline to the `Select-Object` cmdlet that
displays the 100 newest events.
order they're written, oldest to newest. The objects are sent down the pipeline to the `Sort-Object`
cmdlet `Sort-Object` sorts the objects in descending order by the value of the **TimeCreated**
property. The objects are sent down the pipeline to the `Select-Object` cmdlet that displays the 100
newest events.

### Example 15: Get events from an event trace log

Expand All @@ -521,8 +527,9 @@ filter them with the same properties. The command requires the **Oldest** parame
reading from an `.etl` file, but the **Oldest** parameter applies to each file.

```powershell
Get-WinEvent -Path 'C:\Tracing\TraceLog.etl', 'C:\Test\Windows PowerShell.evtx' -Oldest |
Where-Object { $_.Id -eq '403' }
$logfiles = 'C:\Tracing\TraceLog.etl', 'C:\Test\Windows PowerShell.evtx'
Get-WinEvent -Path $logfiles -Oldest |
Where-Object { $_.Id -eq '403' }
```

The `Get-WinEvent` cmdlet gets log information from the archived files. The **Path** parameter uses
Expand All @@ -543,11 +550,16 @@ of the objects.
```powershell
# Using the Where-Object cmdlet:
$Yesterday = (Get-Date) - (New-TimeSpan -Day 1)
Get-WinEvent -LogName 'Windows PowerShell' | Where-Object { $_.TimeCreated -ge $Yesterday }
Get-WinEvent -LogName 'Windows PowerShell' |
Where-Object { $_.TimeCreated -ge $Yesterday }

# Using the FilterHashtable parameter:
$Yesterday = (Get-Date) - (New-TimeSpan -Day 1)
Get-WinEvent -FilterHashtable @{ LogName='Windows PowerShell'; Level=3; StartTime=$Yesterday }
Get-WinEvent -FilterHashtable @{
LogName = 'Windows PowerShell'
Level = 3
StartTime = $Yesterday
}

# Using the FilterXML parameter:
$xmlQuery = @'
Expand Down Expand Up @@ -576,7 +588,11 @@ For more information about hash tables, see

```powershell
$Date = (Get-Date).AddDays(-2)
Get-WinEvent -FilterHashtable @{ LogName='Application'; StartTime=$Date; Id='1003' }
Get-WinEvent -FilterHashtable @{
LogName = 'Application'
StartTime = $Date
Id = '1003'
}
```

The `Get-Date` cmdlet uses the **AddDays** method to get a date that's two days before the current
Expand All @@ -594,10 +610,10 @@ that occurred within the last week.
```powershell
$StartTime = (Get-Date).AddDays(-7)
Get-WinEvent -FilterHashtable @{
Logname='Application'
ProviderName='Application Error'
Data='iexplore.exe'
StartTime=$StartTime
LogName = 'Application'
ProviderName = 'Application Error'
Data = 'iexplore.exe'
StartTime = $StartTime
}
```

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ Creates a new Windows event for the specified event provider.
## SYNTAX

```
New-WinEvent [-ProviderName] <String> [-Id] <Int32> [-Version <Byte>] [[-Payload] <Object[]>]
[<CommonParameters>]
New-WinEvent [-ProviderName] <String> [-Id] <Int32> [-Version <Byte>]
[[-Payload] <Object[]>] [<CommonParameters>]
```

## DESCRIPTION
Expand Down
19 changes: 9 additions & 10 deletions reference/5.1/Microsoft.PowerShell.Host/Start-Transcript.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,22 +17,22 @@ Creates a record of all or part of a PowerShell session to a text file.
### ByPath (Default)

```
Start-Transcript [[-Path] <String>] [-Append] [-Force] [-NoClobber] [-IncludeInvocationHeader] [-WhatIf]
[-Confirm] [<CommonParameters>]
Start-Transcript [[-Path] <String>] [-Append] [-Force] [-NoClobber]
[-IncludeInvocationHeader] [-WhatIf] [-Confirm] [<CommonParameters>]
```

### ByLiteralPath

```
Start-Transcript [[-LiteralPath] <String>] [-Append] [-Force] [-NoClobber] [-IncludeInvocationHeader] [-WhatIf]
[-Confirm] [<CommonParameters>]
Start-Transcript [[-LiteralPath] <String>] [-Append] [-Force] [-NoClobber]
[-IncludeInvocationHeader] [-WhatIf] [-Confirm] [<CommonParameters>]
```

### ByOutputDirectory

```
Start-Transcript [[-OutputDirectory] <String>] [-Append] [-Force] [-NoClobber] [-IncludeInvocationHeader]
[-WhatIf] [-Confirm] [<CommonParameters>]
Start-Transcript [[-OutputDirectory] <String>] [-Append] [-Force] [-NoClobber]
[-IncludeInvocationHeader] [-WhatIf] [-Confirm] [<CommonParameters>]
```

## DESCRIPTION
Expand All @@ -45,7 +45,7 @@ By default, `Start-Transcript` stores the transcript in the following location u
name:

- Default location: `$HOME\Documents`
- Default filename: `PowerShell_transcript.<computername>.<random>.<timestamp>.txt`
The default filename is `PowerShell_transcript.<computername>.<random>.<timestamp>.txt`.

Starting in Windows PowerShell 5.0, `Start-Transcript` includes the hostname in the generated file
name of all transcripts. The filename also includes random characters in names to prevent potential
Expand Down Expand Up @@ -98,6 +98,7 @@ Start-Transcript
The full path to the transcript file is stored in the `$Transcript` preference variable. For more
information about the `$Transcript` preference variable, see
[about_Preference_Variables](../Microsoft.PowerShell.Core/About/about_Preference_Variables.md#transcript).

### Example 4: Start a transcript using a relative path on Windows systems

When you use a relative path with the **OutputDirectory** parameter on Windows, the path is relative
Expand All @@ -111,7 +112,6 @@ Start-Transcript -Path .\transcripts
Transcript started, output file is C:\Users\username\Documents\.\transcripts\PowerShell_transcript.HOSTNAME.8S6RpEfN.20251105152247.txt
```


## PARAMETERS

### -Append
Expand Down Expand Up @@ -258,8 +258,7 @@ Accept wildcard characters: False

### -WhatIf

Shows what would happen if the cmdlet runs.
The cmdlet isn't run.
Shows what would happen if the cmdlet runs. The cmdlet isn't run.

```yaml
Type: System.Management.Automation.SwitchParameter
Expand Down
19 changes: 10 additions & 9 deletions reference/5.1/Microsoft.PowerShell.Management/Add-Content.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,18 +21,18 @@ Adds content to the specified items, such as adding words to a file.

```
Add-Content [-Path] <string[]> [-Value] <Object[]> [-PassThru] [-Filter <string>]
[-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf]
[-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>]
[-Stream <string>] [<CommonParameters>]
[-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>]
[-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline]
[-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]
```

### LiteralPath

```
Add-Content [-Value] <Object[]> -LiteralPath <string[]> [-PassThru] [-Filter <string>]
[-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>] [-WhatIf]
[-Confirm] [-UseTransaction] [-NoNewline] [-Encoding <FileSystemCmdletProviderEncoding>]
[-Stream <string>] [<CommonParameters>]
[-Include <string[]>] [-Exclude <string[]>] [-Force] [-Credential <pscredential>]
[-WhatIf] [-Confirm] [-UseTransaction] [-NoNewline]
[-Encoding <FileSystemCmdletProviderEncoding>] [-Stream <string>] [<CommonParameters>]
```

## DESCRIPTION
Expand All @@ -55,7 +55,7 @@ Add-Content -Path .\*.txt -Exclude help* -Value 'End of file'

The **Path** parameter specifies all `.txt` files in the current directory, but the **Exclude**
parameter ignores file names that match the specified pattern. The **Value** parameter specifies the
text string that is written to the files.
text string that's written to the files.

Use [Get-Content](Get-Content.md) to display the contents of these files.

Expand All @@ -77,7 +77,7 @@ Tuesday, May 14, 2019 8:24:27 AM

The `Add-Content` cmdlet creates two new files in the current directory. The **Value** parameter
contains the output of the `Get-Date` cmdlet. The **PassThru** parameter outputs the added contents
to the pipeline. Because there is no other cmdlet to receive the output, it is displayed in the
to the pipeline. Because there is no other cmdlet to receive the output, it's displayed in the
PowerShell console. The `Get-Content` cmdlet displays the updated file, `DateTimeFile1.log`.

### Example 3: Add the contents of a specified file to another file
Expand Down Expand Up @@ -400,7 +400,8 @@ Accept wildcard characters: False
### -UseTransaction

Includes the command in the active transaction. This parameter is valid only when a transaction is
in progress. For more information, see [about_Transactions](../Microsoft.PowerShell.Core/About/about_Transactions.md).
in progress. For more information, see
[about_Transactions](../Microsoft.PowerShell.Core/About/about_Transactions.md).

```yaml
Type: System.Management.Automation.SwitchParameter
Expand Down
Loading