Hex wrapper in powershell object
I am trying to get hex output. This code:
get-wmiobject -class "Win32_LoggedOnUser" -namespace "root\CIMV2" -Property * | `
Select @{Name="Antecedent";Expression={$_.Antecedent.Split('=').replace("`"","")[2]}}, `
@{Name="Dependent";Expression={$_.Dependent.Split("`"")[1]}}
Creates two columns, login and logonID as follows:
Antecedent Dependent
---------- ----------
SYSTEM 999
LOCAL SERVICE 997
NETWORK SERVICE 996
<user> 347528
<user> 6842494
<user> 46198354
<user> 46171169
DWM-2 223575
DWM-2 223551
Event Viewer uses the hexadecimal representation of the logonID, for example "SYSTEM" would be represented by 0x3e7 versus 999 or in PowerShell
ps> '{0:x}' -f 999
I am trying to match this.
I'm trying to do something along these lines:
get-wmiobject -class "Win32_LoggedOnUser" -namespace "root\CIMV2" -Property * | `
Select @{Name="Antecedent";Expression={$_.Antecedent.Split('=').replace("`"","")[2]}}, `
@{Name="Dependent";Expression={'{0:x}' -f $_.Dependent.Split("`"")[1]}}
But no luck yet.
source to share
.Split()
is a string method. So the output $_.Dependent.Split()
will be [string]
and you want to convert from int
to hex
. Thus, before converting, you will want to go to int
. A quick look Dependent
also looks like the numbers are too big for [int32]
, so it [int64]
will be better. Also, as @LotPings pointed out, you will want to add a prefix 0x
to the formatting string.
Get-WmiObject -Class "Win32_LoggedOnUser" -Namespace "root\CIMV2" -Property Antecedent,Dependent |
Select @{
Name = 'Antecedent'
Expression = {$_.Antecedent.Split('=').replace('"','')[2]}
}, @{
Name = 'Dependent'
Expression = {'0x{0:x}' -f [int64]$_.Dependent.Split('"')[1]}
}
source to share
Final code updated from @LotPings and @BenH
get-wmiobject -class "Win32_LoggedOnUser" -namespace "root\CIMV2" -Property * | `
Select @{Name="Antecedent";Expression={$_.Antecedent.Split('=').replace("`"","")[2]}}, `
@{Name="Dependent";Expression={'0x{0:x}' -f [int64]$_.Dependent.Split("`"")[1]}}
source to share
Here's one way to do what I think you want to do:
Get-WmiObject Win32_LogonSession | ForEach-Object {
[PSCustomObject] @{
"Account" = $_.GetRelated("Win32_Account").Name
"LogonId" = "{0:X}" -f ([Int] $_.LogonId)
}
}
It looks like the property LogonId
is a string, so you need to specify how Int
. You can add a prefix if needed 0x
.
source to share