►
From YouTube: PSS: Custom Default Formats with Jeremy Smith
Description
PowerShell Saturday is a training event for all things PowerShell. The event was held in Raleigh North Carolina and hosted by Research Triangle PowerShell User Group.
In this session Jeremy Smith discusses how to customize the default format that PowerShell uses. What PowerShell normally outputs works most the time.
The files for Jeremy's slides and code can be found on our github page:
https://github.com/rtpsug/PowerShell-Saturday/tree/master/2019-NC.State/
A
Okay:
let's
go
ahead
and
get
started.
Welcome.
My
name
is
Jeremy
Smith
thanks
for
coming
out
to
the
PowerShell
Saturday,
don't
forget
to
take
a
look
stop
by
the
sponsor
booths.
We're
really
appreciative
of
them.
Helping
to
you
know,
help
help
put
this
event
on
for
so
many
people,
okay,
so
I'm
going
to
talk
about
default
formats
and
when
and
how
you
might
want
to
customize
them
some.
A
You
know
pros
and
cons
about
using
them,
and
so
this
this
is
kind
of
a
101
in
in
that
sense
that
it's,
it
is
sort
of
foundational
to
what
PowerShell
is
doing
for
you,
and
hopefully
this
lets.
You
understand
a
little
bit
more
about
what's
going
on,
but
it's
not
a
101
in
terms
of
like
here's,
all
the
syntax
and
stuff
you'll,
hopefully
get
a
sense
of
that
from
the
examples.
If
you
have
any
questions,
try
to
hold
them
till
the
end.
A
Just
so
we're
all
talking
about
the
same
thing
in
terms
of
formatting
and
then
I'm
gonna
go
over
basics
of
a
PowerShell
object
pipeline
and
then
we'll
talk
about
default
formatting
and
what
role
it
plays
and
then
we'll
get
into
the
meat
of
it
of
different
ways.
You
might
want
to
customize
that
output.
So
let's
get
right
into
it
with
types
and
objects
that
sounds
very
developer.
Ii
and
you
know
a
lot
of
PowerShell
users
are
not
developers,
so
don't
be
afraid
of
types
of
objects.
A
We'll
try
to
keep
it
pretty
pretty
simple,
just
enough
knowledge
to
really
help
you
be
more
productive,
so
you
can
think
of
a
type,
it's
kind
of
a
template
that
describes
what
to
expect
out
of
an
object
and
all
I'll
get
into
that
in
just
a
minute.
It's
a
it's
a
mapping
between
a
name
and
just
a
set
of
members.
So
what
are
what
are
members?
A
A
So
for
anyone
who
is
messed
with
Active
Directory,
there's
a
really
good
module
for
a
powershell
for
Active
Directory,
so
here's
an
example:
I'm
just
getting
a
user
and
here's
the
object
that
comes
back
and
there's
a
whole
bunch
of
properties
on
this
object.
You
know
the
given
name,
the
name
say
the
account
name,
all
of
that.
If
I
take
this
command
the
get
Ad
user
and
pipe
it
to
get
member,
that's
one
of
the
the
core
functions
that
you
should
learn
to
love.
A
Name
again,
that
is
referencing,
okay,
so
kind
of
nervous
before
but
think
of
the
kind
of
like
the
cookie
cutter
example.
All
the
cookies
that
come
out
of
a
cookie
cutter
are
expected
to
look
the
same,
but
they
don't
always
look
the
same
right.
If
you're,
making
a
little
gingerbread
man
arm
breaks
off,
it
came
out
of
the
same
cookie
cutter,
but
it
was
changed
a
little
bit
after
it
was
made.
You
might
also
add
frosting
or
sprinkles
or
something-
and
you
know
add
some
stuff
to
it
after
it
was
made.
A
But
when
you
look
at
just
the
cookie
cutter,
you
should
be
able
to
expect
a
rough
idea
of
what
you're
getting
out
of
it.
So
that's
that's
kind
of
the
mental
model
to
go
with
you,
so
here's
our
ad
user
example
again,
looking
at
all
the
properties.
This
is
the
same
slide
we
just
saw
now.
If
I
change,
this
command,
get
ad
user
and
I
pull
back
all
the
properties
nicely.
The
list
of
members
has
grown
and,
and
but
the
type
name
is
the
same.
A
So
that's
that's
the
example
of
the
type
name
telling
PowerShell
here's.
What
to
expect,
but
it
won't
always
be
that
way,
and
so
again,
that's
a
benefit
of
looking
at
using
get
member
to
actually
inspect
your
objects
to
actually
see
what
is
really
there,
not
just
what
do
I
expect?
Okay,
so
that's
a
you
know:
fire
hydrant
blast
of
objects.
Now,
let's
do
a
quick
review
on
the
pipeline.
Basically,
the
the
PowerShell
pipeline
is
just
responsible
for
passing
objects
from
one
function
to
another.
We
do
that
with
the
pipe
operator.
A
So
you
see,
I've
got
three
functions
being
called
up
at
the
top
there
I'm
gonna
get
all
of
the
files
in
the
directory.
I'm
gonna
fill
I'm
going
to
pipe
that
over
to
where
object
and
filter
for
any
files,
but
name
matches
the
word
format
and
then
I'm
going
to
sort
all
of
those.
So
those
are
you
know,
function.
One
I
have
to
function
two
at
the
function.
Three,
that's
basically
the
the
object
pipeline
and
down
below
that
is
just
the
result.
A
An
example
result.
So,
let's
dive
into
to
this
pipeline,
that's
sort
of
underlying
this
whole
command
structure,
so
get
child
item
whose
alias
is
derp.
So
if
you're
used
to
use
in
Windows
command,
prompt
or
LS
and
the
UNIX
world
get
child
item
is
just
the
official
PowerShell
function
name
for
that,
it's
meaning
objects
file
objects
onto
the
pipeline
as
that's
what
it's
responsible
for
doing
it's
just
when
you
call
it
it's
just
throwing
out
objects.
Whatever
the
results
are
onto
that
pipeline.
A
The
pipeline,
then,
is
sending
those
objects
in
as
input
into
the
next
function,
and
so
then
the
where
object
receives
those
those
objects
that
are
coming
over
and
then
it
uses
for
each
object.
It's
saying:
hey,
look
at
the
name
property.
If
it
matches
format,
then
send
it
on
its
way
and
if
it
doesn't
match
format,
then
just
discard
it,
and
so
there
could
be
less
objects
coming
out
of
the
where
object
function.
Dang
went
into
it,
so
the
pipeline
then
sends
those
objects
into
the
sort
object
function
that
is
responsible
for
reordering
the
results.
A
But
then
the
question
is
what
happens
at
the
end
of
that
I.
Only
typed
out
those
three
commands.
There's
some
there's
like
magic
going
on
between
that
point
and
what
you
see
on
your
screen
and
that's
where
the
fault
formatting
comes
into
play,
is
that
in
between
what
you
see
on
the
screen
and
what
you've
typed
there.
A
So
it
called
contrast
this
with
explicit
formatting,
so
here's
the
exact
same
command,
but
now
I've
piped
it
to
one
of
the
formatting
functions:
I
piped
it
to
a
format,
table
or
format
list
or
format
wide
any
of
those
you're
telling
the
engine.
Here's
exactly
how
I
want
it
formatted,
don't
do
anything
automatically
for
me
versus
if
you
don't
specify
a
format,
that's
where
the
default
format,
income,
okay,
here's
a
slightly
different
variation
where
I've
got
this
pipeline,
it's
the
exact
same
one,
but
I'm
setting
it
to
into
a
variable
called
result.
A
Okay,
so
in
this
case
the
pipeline
kind
of
starts
at
get
child
item,
it
runs
all
the
way
through
and
then
it
shoves
all
those
results
into
the
variable.
But
there's
no
formatting
that
happens
so
there's
it's
still
just
the
variable
is
just
the
raw
objects.
When
you
view
the
variable
it's
like
a
mini
pipeline
and
then
you
get
the
default
formatting
or
you
could
pipe
the
variable
into
format,
table
or
format
list
or
any
of
those
functions.
Okay.
A
So
so
now,
let's
get
into
some
of
the
default
formatting
options
or
things
that
that
control
default
formatting.
So
you've
got
this
thing
called
format.
Data
which
is
defined
in
XML
files
and
I
know
we're
only
on
I
talked
about
pros
and
cons,
and
right
now
I'm,
you
know,
most
people
are
thinking
of
that's
a
con.
I,
don't
like
XML,
right
and
I
would
agree,
but
there
may
be
times
when
it's
worthwhile
to
dig
in
there
so
we'll
get
into
that.
But
there's
also
a
thing
called
default:
display
property
sets
that
you
could
use.
A
If
there's
no
format
data
defined,
then
the
system
is
looking
for
display
properties,
debts
that
are
set
for
that
type
and
then,
if
there's
no
property
set
to
find,
then
it'll
automatically
format
as
a
table
or
list
depending
on
the
number
of
properties.
If
there's
zero
to
four
properties
on
the
object,
it'll
format
it
as
a
table
and
if
there's
more
than
four
objects
on
the
object,
it
will
format
it
as
a
list.
A
Okay,
I'm,
going
to
dive
into
each
one
of
these
a
little
bit
more
in
depth
and
I
want
to
do
it
in
reverse
order.
Okay,
so
we're
gonna
go
through
the
table
versus
list
first
and
then
the
property
set
and
then
last
we'll
do
that
the
format
data,
so
here
I've,
just
created
a
custom
object
with
four
properties.
A
The
PS
custom
object
is
just
a
quick
way
to
create
your
own
object.
It's
I
forget
when
it
was
introduced
into
the
system,
but
it's
nice
concise
way
of
just
creating
your
own
arbitrary
objects.
So
I've
got
prop
one.
You
could
call
it
anything
you
want
and
then
a
value
and
so
I've
got
those
four
different
properties,
and
you
see
the
the
output
is
in
table
form
and
that's
because
there's
no
format,
data
or
display
property
set
defined
for
this
and
there's
four
or
less
properties.
If
I
add
a
fifth
property.
A
The
output
is
in
list
form.
That's
because
the
object
now
has
has
five
properties
on
it.
Okay,
so
that's
table
versus
list
pretty
straightforward.
Next,
let's
look
into
what
we
can
get
out
of
a
default
display
property
set.
Now
if
we
go
back
to
our
ad
user,
miss
linguine,
you
can
see
this
object.
That
I've
got
back.
Maybe
doesn't
have
all
the
information
that
I
want.
Maybe
you
know
I,
don't
know
I'm,
not
actually
a
service
desk.
A
You
know
member,
but
if
I
was
servicing,
people
who
had
you
know,
got
their
accounts
locked
out
or
maybe
their
password
needs
to
be
changed
or
something
at
like.
If
I'm
looking
up
users
all
the
time
and
those
are
the
properties
that
I
need
to
see,
it
would
be
great
if
that
was
just
here
by
default
and
not
you
I,
don't
have
to
go
searching
for
that.
A
So
the
first
thing
I'll
do
is
I'll
pipe
that
object
to
get
member
to
see
a
list
of
all
the
properties
that
are
available
and
to
get
the
type
name.
Okay,
so
I
need
to
know
the
type
name
and
then,
whichever
properties
I
want
so
I
go
and
pick
those
out
and
then
I
take
that
type
name
and
in
this
example,
I've
set
it
into
a
variable.
A
Just
so,
I
can
kind
of
keep
everything
kind
of
concise
here,
but
you
don't
have
to
do
it
that
way
and
then
I'm
setting
this
default
display
property
set
on
the
update
type
data
function
and
I'm
listing
out
those
properties
that
I
want
to
be
there
by
a
default.
So
you
could
do
whatever
you
want
here.
You
know
am
more
interested
in
password
kind
of
stuff.
So
when
I,
so
we've
mapped
this
type
name
to
an
expected
set
of
properties
that
should
be
displayed.
Okay,
I'm
gonna.
A
Let
me
go
one
level
deeper
here,
real
quick,
so
it's
a
bear
with
me:
I
run
the
function
and
everything's
blank,
because
I've
told
PowerShell
to
expect
these
properties,
but
those
properties
aren't
being
returned
by
the
function.
Ok,
so
the
object
that
was
created
doesn't
have
what
I
told
PowerShell
to
expect.
A
But
when
I
run
with
the
you
know,
calling
a
tea
user
with
all
the
properties,
and
now
it
fills
in
because
now
the
properties
are
there
on
the
object,
and
so
the
formatter
can
can
fill
those
values
into
what
I've
told
it
to
expect
you
could,
if
you
didn't
want
to
have
to.
But
if
you
wanted
to
use
this
sort
of
example,
you
didn't
want
to
have
to
define
property
star
every
time
or
your
your
explicit
list
of
properties.
A
You
could
set
a
global
default
for
the
function,
so
here
you
can
say
for
any
time,
I
call
it
get
a
tea
user
I
want
the
default
value
for
properties
to
be
star,
and
then
every
time
you
call
it
I'll
just
be
there.
So
it's
a
little
tip
if
you,
if
you
want
to
use
that,
so
let
me
change
it
and
switch
it
up
a
little
bit
and
maybe
I
only
need
four
properties
like
maybe
by
default.
A
I
want
I,
want
this
to
be
kind
of
in
a
tabular
form,
I'm
pulling
back
a
lot
of
users.
Maybe
my
my
function
is
actually
running
some
filter
instead
of
pulling
back
up.
Instead
of
searching
for
a
specific
user
name,
so
if
I
redefine
this
to
just
include
the
same
account
name
and
abled
name
and
distinguished
name
now,
when
I
run
the
function,
it's
an
in
tabular
form
and
I
only
have
those
four
properties.
A
So
this
is
just
an
example.
Hopefully
gets
your.
You
know
the
wheels
turning
about
how
it
might
be
useful
for
you
and
your
own
environment
cuz.
It's
definitely
gonna
be
different
for
everybody
based
on
your
goth
function,
based
on
how
often
you
use
this
like
if
you,
if
you
only
use
the
back
of
directory
command
lets,
you
know
once
in
a
blue
moon.
It's
not
worth
your
time
to
set
up
default
formats
right,
just
just
dive
in
in
the
moment
to
figure
that
out.
A
But
if
it's
something
you're
doing
daily,
it
might
be
more
and
more
worthwhile
for
you
to
look
into
this
kind
of
stuff.
Okay,
so,
lastly,
look
at
the
format
data-
and
here
the
example
is
looking
at
SSL
certificates,
specifically
the
the
root
certificate
authority,
so
I'm
saying
go,
find
all
the
rupees
and
filter
them
where
the
expiration
date,
the
not
after
property,
where
it's
before
today
so
find
all
the
Rue
de
thority
x'
that
have
already
expired.
Okay,
and
so
thanks
to
backwards.
A
Compatibility
on
Windows
part,
there's
several
on
every
default
system,
and
the
thing
that
is
missing
that
I
feel
like
is
most
important.
For
what
I'm
trying
to
do
here
is
the
date
that
actually
expired.
So
the
default
format-
that's
showing
up
here-
only
has
the
thumbprint
in
the
subject.
But
it
doesn't
tell
me
what
the
expiration
date
is.
Okay,
so
I
want
to
go.
Add
that
in
there
so
I'll
take
my
certificate
objects
and
I'll
type
them
in
to
get
member,
and
now
I'm
gonna
grab
the
type
name
here.
A
It's
nice
and
long
all
of
the
the.net
type
names
have
like
periods
in
between
different
levels
of
the
hierarchy.
So
it's
kind
of
a
pattern
that
helped
my
you
recognize
when
you're
looking
at
a
type
name
and
then
I'm
going
to
go
pick
out
all
of
the
the
properties
that
I
want
in
my
default
view.
So
I'm
gonna
pick
the
friendly
name,
not
after
the
expiration
date
and
then
the
thumbprint
okay.
So
I've
got
my
type
name
here:
I
call
update
type
data,
define
my
just
default
display
property
set.
A
This
is
exactly
what
we
did
for
the
ad
user
example.
I
run
my
function
again
and
nothing
changes.
Okay,
just
set
I
just
hold
PowerShell.
Here's
the
default
display
properties
that
I
want
you
to
use
and
it
accepted
it
and
then
it
ignored
it
can't
say
I'm
a
fan
of
that,
but
that's
how
it
works.
So
the
reason
is
because
there
already
exists
format,
data
for
certificates
and
for
a
lot
of
objects.
A
Okay,
there's
there's
a
bunch
of
XML
files,
there,
the
PSone
XML
files
that
are
find
in
the
PowerShell
home
directory
and
they
cover
default
formatting
for
a
lot
of
stuff.
So
there
may
be
a
lot
of
use
cases
where
the
default
formatting
is
already
what
you
want,
because
Microsoft
and
the
PowerShell
team
have
gone
in
and
and
tried
to.
You
know
think
ahead
on
your
behalf
and
figure
out
what
would
be
most
useful,
but
I
found
there's
always
some
edge
cases
where
you
just
need
a
certain
set
of
properties.
A
So
so
we
have
to
find
a
way
to
override,
what's
already
being
defined
for
certificates
and
that's
where
we
get
into
writing
a
little
bit
of
XML
so
but
on
your
XML
big
boy,
pants,
we're
gonna,
guys
step
through
it.
A
lot
of
the
information
on
line
refers
you
to
look
at
an
existing
XML
file,
the
format
XML
files.
Take
that
copy
it
and
then
trim
it
down
and
kind
of
craft
it
to
what
you
need.
I
found
that
as
easier
said
than
done,
because
a
lot
of
those
files
are
really
complicated.
A
They're
doing
I
mean
as
well
goes
really
deep,
with
the
capabilities
they're
so
tried
to
make
break
it
down
and
just
show
you
from
the
beginning
from
Ground
Zero.
What
do
you
actually
need?
Kind
of
get
the
bare
minimum
formatting
so
I
want
to
get
this
certificate
stuff.
I
want
three
properties
and
I
want
to
defined
as
a
table.
That's
that's
my
goal
in
doing
this.
So
with
XML,
you
always
need
a
start
tag
and
an
end
tag.
I
like
to
always
pair
those
at
the
same
time.
A
So
I,
don't
forget
to
add
them
later,
try
to
keep
the
indentation
in
and
it
is
case-sensitive
which
is
different
than
a
lot
of
the
way.
The
rest
of
powershell
works,
but
XML
just
by
nature
is
case.
Sensitive,
so
be
careful
there.
Okay,
so
we've
got
our
outer
elements
and
these
slides
will
should
be
available
after
the
talk.
So
the
font
just
is
gonna
shrink
a
little
bit
because
I
got
to
fit
a
lot
on
the
slide.
So
don't
don't
try
to
write
this
all
down?
Okay,
we'll
have
a
view
section
in
there.
A
So
the
configuration
of
view
configurations
is
kind
of
standard.
It's
got
to
be
there
one
one
profile
and
that's
it.
You
can
have
multiple
views
in
defined
in
a
file
for
this
example.
We
just
care
about
one,
so
things
I
need.
Excuse
me:
I
need
a
name
for
this
view,
just
any
arbitrary,
unique
name
so
I'm
calling
it
certificates
demo
and
then
I
need
to
say,
tell
PowerShell
when
to
use
this
view
and
so
I'm
defining
that
anytime.
You
see
this
type
of
object,
this
x.509
certificate,
then
you
should
use
this
view.
A
Okay,
so
those
are
the
key
things
that
you
might
need
to
replace
if
you're,
if
you're,
creating
multiple
format
files,
those
are
the
things
to
look
out
there.
I'm
gonna
be
creating
a
table
control.
So
there's
a
new
chunk
under
there,
a
lot
of
ceremony
in
the
XML
when
really
we
just
care
about
kind
of
the
content
of
the
headers
and
the
values
in
those
cells.
Okay,
so
I'm
gonna,
zoom
in
to
the
table,
control
section
there
and
we'll
talk
about
what
is
needed
for
defining
the
headers
and
the
columns.
A
Okay,
so
I've
got
three
properties
that
I
wanted
to
find
so
I've
got
three
column,
header
elements
or
table
column,
header
elements
up
there
and
then
three
separate
column
items
so
I'm
going
to
just
highlight
those
real,
quick
and
then
they've
got
to
be
paired
together.
So
the
first
table
column
header
element
is
paired
essentially
with
the
first
table
column
item
and
that's
all
it's
doing
is
saying:
hey.
You
use
this
property
as
the
first
column,
but
there's
there's
a
lot
of
fluff.
A
That
kind
of
has
to
be
done
in
order
just
to
say
that
that
phrase
and
then
the
second
set
prepared
together
and
then
the
last
set.
So
this
is
pretty
simple:
I.
Don't
actually
have
to
do
anything
inside
the
table.
Column,
header
element
because
I'm,
just
looking
for
a
property
all
I
want
to
do
is
format
this
as
a
table
because
I'm
referencing
the
property
on
the
object
power.
She
already
knows
what
to
call
it
call
it
the
property
name.
A
If
you
wanted
to
change
the
name
or
something
like
that,
then
you
might
have
to
add
more
stuff
to
the
column
header,
but
by
default.
This
is
kind
of
the
bare
minimum
that
you
would
need
for
that,
so
we'll
zoom
back
out
to
the
whole
XML
file.
It's
really
not
that
bad,
but
it
is
enough
that
I
had
to
shrink
the
sound-alike.
Eight
point
font,
and
the
only
things
in
here
that
we
care
about
are
that
name,
the
type
name
and
the
three
properties.
Basically,
so
that's
what
all
this
XML
file.
A
It
is
really
just
containing
okay,
so
I've
got
that
file
created
on
the
file
system.
Now,
I
need
to
tell
PowerShell
to
use
it,
so
I
call
update
format,
data
and
I
want
to
prepend
the
path
with
that
XML
file.
So
anytime,
you
call
update
format,
data,
it's
reloading,
all
of
the
formatting,
all
of
those
default
files
that
come
built-in
with
PowerShell.
It's
reloading
that
you
shouldn't
ever
change
those
and
then
prepending
says
I
want
to
use
mine
first
before
you
start
looking
at
the
ones
that
come
built-in.
A
You
could
also
do
append
paths
if
you
wanted
years
to
come,
as
you
know,
last
in
the
chain,
okay
and
so
now.
Finally,
when
I
call
that
function,
I
get
the
format
that
I've
wanted
all
along
to
see
this
now,
because
I
was
limited
in
slide.
Space
like
practically
I,
found
it
more
useful
to
add
in
things
the
issue
were
also
in
the
maybe
the
signature
algorithm
or
the
common
name.
A
Like
all
like,
if
you're
really
interested
in
certificate
stuff,
you
could
actually
make
this
a
little
more
practical
with
the
actual
you
know,
you
know,
1080
monitor,
you'll
have
plenty
of
room
to
get
all
the
fields
in
there.
Okay,
let's
say
I
I'm
still
trying
to
conserve
some
more
space
and
I,
really
don't
care
about
the
time
of
day
like
if
the
certificate
is
expiring,
like
I'm
looking
at
like
server
certificates
or
something-
and
it's
expiring
that
day,
it's
just
got
to
get
updated
right
it
does
it.
A
A
So
here
I'm
going
to
make
an
alteration
to
the
to
the
not
after
property
I'm
gonna
use
a
script
block
in
the
format
instead
of
calling
the
property
name.
Okay,
so
now
I
have
to
change
that
column
header
and
give
it
a
name
because
I'm
just
the
value
is
now
just
a
script
block.
It's
not
a
property
that
already
has
a
name
and
so
basically
I'm
just
printing
that
not
after
date
with
a
specific
format,
all
I
want
is
the
year
month
day
and
I
want
it
always
to
be
four-digit
year,
two-digit
month
two-digit
day.
A
So
that's
that
for
wise,
two
M's
and
2ds
format
and
then
I
still
use
the
same
name
as
the
normal
object
has
and
now,
when
I
run,
it
I
update
the
format,
data
to
reload
it
and
now
I
run
that
through
and
I've
got.
You
know
nice
constant
with
date
and
don't
have
to
worry
about
the
time.
So
you
can
kind
of
squeeze
more
columns
in
that
way.
Sometimes,
if
you
really
just
have
the
the
critical
information
that
you're
looking
for.
A
The
first
precedence
or
when
when
PowerShell
is
evaluating
the
pipeline
and
you
get
to
the
end,
it
looks
for
format
data
to
exist.
First,
you
can
customize
your
own
with
using
the
update
format.
Data
that
we
just
went
over
recommend
usually
prepending
the
path
for
that.
Then,
if
no
format
data
exists,
you
can
use
the
default
display
property
set
in
order
to
control
that
you
use,
update
type
data
and
then,
if
that
doesn't
exist
for
for
a
type,
then
it
defaults
back
to
a
table
or
list
any
on
the
number
of
properties
and.
A
But
if
you're
doing
that,
all
the
time
that
just
takes
up
a
lot
of
time
and
it
kind
of
distracts
you
from
the
task
at
hand
right
if
you're
trying
to
dig
into
the
event
log
and
troubleshoot
an
issue
and
every
time
you
want
to
look
at
a
bunch
of
event
records,
then
you
also
have
to
format
them
it.
Just
then
you
have
to
think
about.
A
What's
that
format,
expression
or
what's
the
syntax
there,
and
it
kind
of
distracts
you
from
what
you're
actually
trying
to
do,
and
so
it
really
just
depends
on
how
often
you
need
to
run
stuff
and
and
what
you
need
to
access
the
most
when
the
type
has
more
than
four
properties,
and
so
by
default,
it's
being
returned
as
a
list.
But
if
you
have
a
whole
bunch
of
those
properties
being
returned,
it's
just
scrolling
off
your
screen
and
maybe
all
of
those
items
are
really
short
values
and
maybe
they're
all
just
numbers.
A
But
it's
five
numbers
per
object,
and
so,
if
it's
better
served
as
a
table,
then
you
might
want
to
consider
a
default
format.
When
you
want
some
other
formatting
on
a
specific
property
or
some
human
readability
improvement,
then
you
might
also
want
to
consider
some
sort
of
formatting.
Oh
I,
don't
have
that.
You
can
example
included
about
color
coding,
there's
some
other
gotchas
there
that
I've
had
time
to
to
fully
go
into.
A
But
if
there's
a
a
lot
of
other
options,
you
might
want
to
look
into
for
custom
formats
for
specific
arrangements
of
things
on
the
screen.
You
based
on
whatever
it
is
you're
doing
so
those
are
some
reasons
when
you
would
want
to
use
it,
but
be
careful
any
time.
You're
changing
defaults,
not
just
for
format
stuff
when
your
machine
is
different.
You've
got
to
be
careful
about
when
you're
sharing
code
with
other
people,
because
now
you're
writing
code
in
an
environment
that
has
defaults,
you
kind
of
forget,
maybe
they
are
different
than
someone
else's
machine.
A
You
share
that
code
out.
Now
it's
going
to
produce
different
results,
it
might
if
you're
lucky,
throw
an
error
and
if
you're
unlucky,
it
might
just
do
the
wrong
thing
and
delete
the
wrong
user
or
who
knows
what
I
found
specifically
with
the
out
file
and
out
printer,
so
you
can
take
a
pipeline,
you
can
pipe
it
out
file.
A
Powershell
doesn't
really
know
the
engine
doesn't
know
that
much
information
about
what
properties
are
associated
with
the
type,
and
so
it
just
looks
at
the
very
first
one
that
comes
back
and
infers
from
that.
What
it
should
be
displaying
I've
got
an
example
for
that,
so
I've
got
three
custom
objects
here:
okay,
they're
in
an
array,
one
of
them
has
a
property
called
property.
One
prop
one:
a
separate
object
has
a
single
property
called
prop
two
and
another
object:
has
a
single
property
called
prop
three?
A
Okay,
so
they're
three
different
objects:
they
have
the
same
type
because
they're
all
the
PS
custom
object
type,
but
they
have
different
actual
definitions.
Only
the
very
first
one
is
printed.
So
when
I
and
I've
run
into
this
before,
and
it's
not
fun
to
to
troubleshoot
I
know,
I
have
three
objects
but
I'm
only
seeing
one
if
I
pipe.
All
of
that
to
measure
object
to
like
count.
How
many
are
there.
It
shows
me
that
there's
three,
but
because
the
first
time
that
the
default
display
we
go
back
to
this
one.
A
You
know
there's
that
magic
happening
at
the
end
because
I
didn't
say,
format,
list
or
format
table
or
anything
like
that.
It's
going
through
that
default
evaluation,
and
so
it's
just
picking.
Okay,
show
me
the
value
of
prop
one
for
every
object,
and
only
that
first
one
has
a
prop
one
property:
okay,
I,
don't
really
know
a
good
way
around
it,
except
to
try
to
make
sure
that
all
your
functions
would
ever.
A
Let
me
turn
one
type
of
object,
so
if
anybody
knows
some
tricks
for
dealing
with
these
I'm
very
interested,
but
that's
definitely
bitten
me
before
okay.
So
how
should
I
go
about
overriding?
The
defaults
I
would
always
suggest,
try
to
think
about
the
least
invasive
option
to
start
with
and
work
your
way
up
as
needed.
Okay,
you
want
to
keep
it
easy
enough
to
understand.
If,
if
you
really
are,
you
know
allergic
to
XML,
then
don't
they?
A
A
A
A
By
default,
this
this
length,
property
shows
up,
and
it's
just
the
number
of
bytes
and
I'm,
not
very
good
at
knowing
how
many
bytes
are
in
a
megabyte
and
like
that's
just
annoying
right
and
to
see
the
the
size
difference
between
kilobytes
and
megabytes
and
gigabytes
and
stuff
I
mean
I,
don't
know
if
anyone
has
terabyte
size
files,
but
I
put
that
in
there
too.
So
I
want
to
I
want
to
see
it
in
human,
readable
format,
and
then
I
would
see
that
next
to
the
path-
and
that's
really
all
I
want
to
do.
A
But
here
I've
got
a
complex
expression
to
to
do
that
in
line
in
the
format
table,
function
and
I
always
forget.
Like
okay
I
know,
it
needs
a
name,
but
is
it
name
or
label
like
I?
Forget
all
that
stuff
I
forget
how
the
the
syntax
is
for
the
expression,
so
I
always
have
to
google
it
just
for
this
I
added
in
that
I
could
write,
align
it,
but
I
like
I
forgot
that
it
was
even
an
option
to
do
so.
A
Maybe
if
you
know
you're
a
wizard
you've
got
this
on
lock,
but
there's
no
real
autocomplete
for
this
kind
of
stuff.
So
it's
definitely
tedious
to
get
a
format
it
just
the
way
you
want
so
I'd
encourage
you
to
if
you
have
to
do
this
kind
of
stuff
or
if
it's
useful,
try
to
save
this
out
as
some
sort
of
script
that
you
can
reuse,
that
and
and
not
have
to
be
bogged
down
by
the
minutiae
of
this
formatting
every
time.
A
So
here's
what
that
output
is
like
I
just
got
the
size
column
on
the
on
the
left.
You
can
see
that
it's
either
showing
you
kilobytes
or
one
of
the
files
has
bytes,
but
if
the
files
were
gigabytes
in
size,
they
would
show
you
just
how
many
gigabytes
there
were
I
just
stuck
with
that
that
format,
files
in
the
PowerShell
install
directory.
So
there's
not
too
many
large
files
there.
Ok,
so
so
I
want
to
capture
that
that
format
function
and
wrap
it
up.
So
I'm
going
to
create
a
a
custom
function.
A
A
The
way
this
is
gonna
work
and
I
apologize
is
this.
This
part
might
be
a
little
more
than
101,
but
when
those
when
the
function
first
starts,
it's
gonna
create
a
list
and
then
for
every
item
that
gets
sent
into
this
format.
Custom
file,
it's
going
to
accumulate,
it's
gonna!
Add
it
to
the
list.
Ok,
so
I've
got
all
the
items
coming
out
of
the
the
get
child
item,
function
and
they're
all
coming
in
here
and
before
their
process.
A
They're
all
put
into
this
list
so
that
at
the
very
end
I
can
take
that
all
variable.
That's
accumulated
all
these
items
and
then
I
wait
until
it
has
all
the
files
there
and
then
I
can
just
pipe
them
all
into
format
table
ok.
So
the
downside
of
this
is
if
you're
dealing
with
a
lot
of
files
is
that
you
have
to
accumulate
them
all
and
you
can't
just
kind
of
stream
it
all
the
way
through,
but
for
most
use
cases.
A
It's
kind
of
this
kind
of
pattern
works
just
fine,
and
here
now
I've
got
that
exact
same
code
that
I
had
before,
where
I'm
calling
format
a
table,
but
now
I
could
reuse
this
function.
You
know
whenever
I
want
and
all
I
have
to
do
is
do
whatever
filtering
I
want
and
then
just
pipe
it
to
format.
Custom
file
and
I'll
get
the
same
output,
so
I
could
have
different
types
of
formats
based
on
whatever
it
is.
I
was
doing
that
day.
A
Okay,
so
we
reviewed
all
of
those
trying
to
keep
it
to
the
least
invasive
option.
Keep
your
stuff
easy
to
understand.
Temporary
is
better
than
permanent,
be
mindful
of
sharing
code
with
others
and
how
your
defaults,
you
know,
might
affect
that.
But
don't
don't
be
too
afraid
of
changing
the
defaults
because
they
really
can
make
you
more
productive.
A
I
mean
I,
have
I,
have
a
whole
bunch
of
the
fault
set,
and
you
and
I
have
accumulated
them
over
time,
as
I've
done
things
repeatedly,
I've
heard
of
the
the
seven
1770
rule
or,
if
you're
doing
something
one
to
seven
times,
just
just
do
it
normally,
but
by
the
time
you
get
up
to
seven,
you
should
used
to
start,
like
you
know,
building
up
a
script
where
you
can
do
a
more
repeatable.
You
have
to
type
it
out
every
time
between
7
and
17.
C
A
And
unfortunately,
I
did
not
put
in
an
example
of
that,
but
I've
done
that
with
I
can
talk
about
it
for
a
second,
the
question
was
was
when
you,
when
you
want
to
format
stuff
with
colors?
How
does
that
work?
Basically,
the
only
way
I
found
forgot
to
work
reliably
on
Windows
is
using
right
host,
which
some
PowerShell
professionals
say
that
right
house
kills
puppies,
and
so
you
should
never
use
that,
and
so,
except.
A
A
So
that's
why
the
command
write
output
is
much
better
for
for
normal
usage,
but
once
you
get
to
that
tail
end
of
the
pipe
line
where
you're
talking
about
formatting
and
screen
display,
that's
when
it
could
be
appropriate
to
use
the
right
host
function
and
that
allows
you
to
color
code
things
so
yeah
in
looking
at
event.
Log
records
I
found
it
useful
to
color
code
that,
based
on
the
severity,
so
in
a
red
for
errors,
orange
for
warnings
and
then
and
format
it
in
kind
of
a
readable
view
with
the
message.
A
The
default
format
for
my
records
is
just
terrible
and
for
actually
trying
to
troubleshoot
something
so
I've
changed
that
up,
but
the
only
real
downside
and
I
didn't
actually
discover
it
until
I
was
prepping
for
this
presentation
is
that
right
is
that
the
out
file
and
out
printer
functions
use
the
default
formatting,
and
so,
if
you've
set
up
a
default
format
to
use
right
host
and
you
pipe
that
to
a
file.
You
get
nothing
in
the
file,
because
that
format
is
just
saying
this
is
redirected
to
the
host.
A
So
it's
kind
of
a
sharp
edge
that
I
didn't
have
enough
time
to
fully
explain
in
fly
form.
Oh,
but
if
your
use
case
is
hey,
I
only
use
this
on
my
screen
and
I
know
when
I'm
using
it.
It
could
be
really
useful.
I
mean,
though
I
think
there
could
be
all
kinds
of
good
use
cases
for
rye,
toast
with
color
coding.
C
A
D
D
A
That's
a
that's
a
great
idea
yeah
so
so
so
my
example
had
had
done
all
the
the
object,
conversion
and
the
formatting
bound
together,
and
thank
you
for
pointing
that
out.
Really,
it
would
have
been
better
and
more
reusable
to
do
the
formatting
in
a
separate
the
object
conversion
where
you
have
like
the
length
to
side
the
human
readable
size
do
that
separately
and
then
pipe
that
to
format
table
instead
of
kind
of
bundle.
All
of
that
together.
That
would
make
it
much
more
reusable.
A
B
A
There
are
a
whole
myriad
of
ways
to
change
things
and
another
way
might
be
to
you
know
if
I
needed,
you
could
add
a
member
to
an
object
so
like
that
conversion,
stuff,
I
guess
I
could
I
could
use
it
with
add
member
and
now
I've
got
this
member
on
the
original
object.
The
same
way,
yeah
I
could
just
select
out
the
properties.
The
object,
type
name
actually
changes
when
you
use
select
object
and
if
you've,
if
you've
typed
something
out
of
select
object
into
get
member,
it's
selected
dot
and
then
the
actual
type
name.