SEC505
  • Welcome to "Securing Windows with PowerShell: A Deep Dive into SEC505"
    • Sec 505.1
      • Intro to Ps
      • Tips for Executing Commands
      • Getting Help in PowerShell
      • Aliases in PowerShell
      • Objects, Properties, and Methods
      • Get-Member (Alias: gm)
      • Drives and Environment Variables
      • Your Profile Script(s)
      • Functions, Cmdlets, and Modules
      • The PowerShell Gallery
      • Exporting, Importing, an d Converting Pages Reusable content Files Object Data
        • Select-Object (Alias: Select)
          • Arrays Are like In-Memory Database Tables
      • Search Event Logs
      • Hashtables and Splatting
      • Flow Control (All in one)
      • Functions
Powered by GitBook
On this page
  • 1. What is Get-Member, and Why is it Important?
  • 2. How Get-Member Works
  • 3. Using Get-Member with Different Object Types
  • 4. Alternative Ways to Use Get-Member
  1. Welcome to "Securing Windows with PowerShell: A Deep Dive into SEC505"
  2. Sec 505.1

Get-Member (Alias: gm)

PreviousObjects, Properties, and MethodsNextDrives and Environment Variables

Last updated 2 months ago

When working with PowerShell, it is crucial to understand the properties and methods of objects you are dealing with. One of the most useful cmdlets for this purpose is Get-Member. This cmdlet provides insights into the structure of objects, allowing users to interact effectively with them.


1. What is Get-Member, and Why is it Important?

Definition

Get-Member is a cmdlet in PowerShell that reveals the properties, methods, and events available on an object. Each object in PowerShell is based on a .NET class, and Get-Member allows users to inspect these objects to understand their capabilities.

Why Use Get-Member?

  • When working with unfamiliar objects, Get-Member helps identify the available properties and methods.

  • It enables users to discover how they can manipulate or retrieve data from an object.

  • It is useful when troubleshooting scripts, as it provides a clear view of what an object contains.

Example

Get-Process | Get-Member

This command retrieves a list of running processes and pipes them into Get-Member. The output displays:

  • The type/class name (System.Diagnostics.Process)

  • The list of properties and methods available for process objects.


2. How Get-Member Works

Basic Functionality

Whenever an object is piped into Get-Member, it inspects the first object in the pipeline and returns:

  1. The type or class name of the object.

  2. The properties and methods available for that object.

Example: Examining a Registry Item

$x = Get-Item HKLM:\
$x | Get-Member
  • Get-Item HKLM:\ retrieves an item from the registry.

  • Piping $x into Get-Member displays its available members.

This is useful when dealing with objects of unknown types.


3. Using Get-Member with Different Object Types

Inspecting a Collection vs. an Item Inside a Collection

When working with collections (arrays, lists, etc.), it is important to differentiate between inspecting an individual item and inspecting the collection itself.

Example 1: Inspecting the First Item in a Collection

$output = Get-ChildItem C:\
$output | Get-Member
  • This command retrieves items from C:\ (files and directories).

  • Piping $output into Get-Member shows the members of the first item in the collection.

Example 2: Inspecting the Collection Itself

Get-Member -InputObject $output
  • Using -InputObject $output inspects the array itself (System.Object[]), revealing members like Count, Length, and SyncRoot.

Understanding How Get-Member Handles Mixed Object Types

If multiple object types are piped into Get-Member, it does not list the members of every single object instance. Instead, it groups objects by type and displays the members for each unique type.

Example: Mixed Object Types

Get-ChildItem | Get-Member
  • If Get-ChildItem returns a mix of files and directories, Get-Member will display members separately for System.IO.FileInfo and System.IO.DirectoryInfo.


4. Alternative Ways to Use Get-Member

Using the -MemberType Parameter

To filter results, use the -MemberType parameter.

Get-Process | Get-Member -MemberType Property
  • This command displays only the properties of System.Diagnostics.Process.

Get-Process | Get-Member -MemberType Method
  • This command displays only the methods of System.Diagnostics.Process.

Using the -Name Parameter to Search for a Specific Member

Get-Process | Get-Member -Name HandleCount
  • This checks if HandleCount exists as a property or method.

Inspecting Static Members

[System.Math] | Get-Member -Static
  • This displays static methods and properties of System.Math.

Page cover image