PowerShell and the event log

One of the strengths of PowerShell is the easy access to WMI it provides at the command line. Before PowerShell, accessing WMI involved doing all the work from within VBScript and processing the results using the facilities available in the scripting language. PowerShell on the other hand is a built on top of the .Net framework so the manipulation of the results is far easier. I now find myself stepping away from the desktop and opening the console for a lot more tasks, I always believe that you should tell the machine what you want it to do rather than doing it yourself.

To demonstrate this the code example below will

• Query the application event log of a remote server
• Order the log entries by the date they occurred
• Return the first 5 results from the set

The cmdlet Get-WmiObject is the gateway to WMI and allowed me to complete the first step with this simple command

As the results from the WMI query are stored in an array, I’m now free to manipulate the result set further using the commands available in PowerShell. Completing items two and three on my list only requires this command


The big win here is being able to run a query on a remote server but manipulate the result set on my local machine. WMI has a large set of providers which are now only a query away from my console.

Powershell: Delete files containing a string

This is a handy PowerShell snippet. The first line creates a list of files containing a specified string, while the second line will delete each item in the list. For a sanity check, put -whatif after the rm command to see what will happen.


For my first attempt I tried to do the whole operation in one go but PowerShell threw an error. It took a little while for me to realise that the select-string command still had the file open which caused the delete to fail. Putting the list of files in to a variable fixed this quickly.

3 reasons for using PowerShell

I wish to learn PowerShell as Windows finally has a great shell making it possibile to automate tasks that are long winded using the GUI.

Here are three very simple task which were hard to achieve using the MS-DOS shell.

Connect to UNC paths

To browse a network share in cmd.exe you first had to map a drive. With PowerShell you can navigate to server shares as you would a local drive.

Easy to recurse folders and files

While it is possible to recursively delete files in cmd.exe, PowerShell has built in support for the ** operator making operations on sets of files very simple. For an example, the following will delete all files with the extension .bak from the C:\temp and all folders within it.

Controlling remote servers

Often I have to administer a service on a remote machine, a recent example is starting the W3SVC on a server which kept failing. As PowerShell has access to the Windows Management Interface API I can run this command instead of using IIS manager over Remote Desktop


In fact PowerShell finally provides a useful wrapper around those rich but hard to get at WMI APIs. The following script will enumerate all websites and display the path to their log file