The Author Online Book Forums are Moving

The Author Online Book Forums will soon redirect to Manning's liveBook and liveVideo. All book forum content will migrate to liveBook's discussion forum and all video forum content will migrate to liveVideo. Log in to liveBook or liveVideo with your Manning credentials to join the discussion!

Thank you for your engagement in the AoF over the years! We look forward to offering you a more enhanced forum experience.

netadmin (1) [Avatar] Offline
While working on some admin scripts, I noticed interesting behavior of WMI objects in PowerShell. Specifically, it's a way PowerShell presents the data returned by WMI objects. I am sure Bruce can explain if it's a bug or feature.

First, let's say I want to query event log and send this query:

> $a = Get-WmiObject -query 'select * from Win32_NTLogEvent where Logfile = "System" and SourceName = "Tcpip"'
> $a[0]

Category : 0
Category String :
Event Code :
Event Identifier :
Type Event :
Insertion Strings :
Log File :
Message : The system detected that network and has initiated normal <...>
Record Number :
Source Name :
Time Generated :
Time Written :
Type : information
User Name :

As you can see, some of the properties (ComputerName, Data) are not displayed at all and other properties don't display any data. You can still get the values with $a[0].Data or $a[0].TimeGenerated, but the behavior is strange. Note that if you query, for example, Win32_Process, all properties and values are displayed OK.

Another thing is date and time conversion. From previous example:

> $a | gm

TimeGenerated Property System.String TimeGenerated
TimeWritten Property System.String TimeWritten

As you can see, the property type was converted from System.DateTime to System.String. Same automatic conversion happens with other WMI objects, but never happens with .NET objects.

Interesting, huh?