1
00:00:01,240 --> 00:00:03,930
Hey everyone. Welcome back to the final part of my

2
00:00:03,930 --> 00:00:06,640
course on putting PowerShell to work.

3
00:00:06,640 --> 00:00:10,420
Hopefully you've seen how easy it is to find commands, figure out

4
00:00:10,420 --> 00:00:13,520
what kinds of things they write to the PowerShell pipeline, and how

5
00:00:13,520 --> 00:00:17,340
to manipulate and arrange PowerShell to get the results you want or

6
00:00:17,340 --> 00:00:19,540
accomplish a given task.

7
00:00:19,540 --> 00:00:23,240
Before I let you go though, we need to look at one more important concept,

8
00:00:23,240 --> 00:00:25,040
and that is filtering.

9
00:00:25,040 --> 00:00:27,770
Filtering is an important step in your PowerShell work and

10
00:00:27,770 --> 00:00:29,370
something that you're going to do all the time,

11
00:00:29,370 --> 00:00:33,240
even though you may not think of it as filtering.

12
00:00:33,240 --> 00:00:35,550
When you run a command like Get‑Process,

13
00:00:35,550 --> 00:00:40,140
you know you get a lot of results, but maybe you don't need to see everything.

14
00:00:40,140 --> 00:00:42,800
Filtering is the process of removing items from the

15
00:00:42,800 --> 00:00:44,290
pipeline that you don't need.

16
00:00:44,290 --> 00:00:45,200
In other words,

17
00:00:45,200 --> 00:00:49,130
you're telling PowerShell only show me these things that matter to me

18
00:00:49,130 --> 00:00:54,300
right now. Depending on what you're doing, there are also significant

19
00:00:54,300 --> 00:00:56,200
performance benefits when filtering.

20
00:00:56,200 --> 00:00:57,000
Conversely,

21
00:00:57,000 --> 00:01:01,640
the wrong kind of filtering, or not filtering at all, can slow you down.

22
00:01:01,640 --> 00:01:06,400
Here's what I'm talking about. When we talk about filtering in PowerShell,

23
00:01:06,400 --> 00:01:08,770
we really mean two kinds of filtering,

24
00:01:08,770 --> 00:01:12,350
typically referred to as early filtering and late filtering.

25
00:01:12,350 --> 00:01:15,840
Now these aren't commands, but rather concepts.

26
00:01:15,840 --> 00:01:19,390
Early filtering is where you do the filtering at the source,

27
00:01:19,390 --> 00:01:22,300
like a SQL query where you're asking for a specific set of

28
00:01:22,300 --> 00:01:25,620
data based on some criteria. You don't pull down the entire

29
00:01:25,620 --> 00:01:28,740
database, you only get what you need.

30
00:01:28,740 --> 00:01:32,440
Late filtering is done at the destination. Now this would be the

31
00:01:32,440 --> 00:01:35,930
equivalent of pulling down that entire database to your computer

32
00:01:35,930 --> 00:01:39,040
and then selecting just what you want.

33
00:01:39,040 --> 00:01:41,040
When using early filtering,

34
00:01:41,040 --> 00:01:45,900
all you get are your desired or filtered objects. In late filtering,

35
00:01:45,900 --> 00:01:48,520
your first command is getting everything,

36
00:01:48,520 --> 00:01:52,040
and then you have to filter on what you truly need.

37
00:01:52,040 --> 00:01:56,070
And of course there are performance implications to this. With early filtering,

38
00:01:56,070 --> 00:01:58,260
especially if you're acquiring for something from the

39
00:01:58,260 --> 00:01:59,920
network like a domain controller,

40
00:01:59,920 --> 00:02:03,320
it's better to have the server do the work and only transmit

41
00:02:03,320 --> 00:02:06,140
over the network what you really need.

42
00:02:06,140 --> 00:02:07,540
As a general rule,

43
00:02:07,540 --> 00:02:10,720
you don't do any late filtering until the initial

44
00:02:10,720 --> 00:02:13,540
data is brought to your computer.

45
00:02:13,540 --> 00:02:14,580
Now, that said,

46
00:02:14,580 --> 00:02:17,130
don't feel that you should never use late filtering

47
00:02:17,130 --> 00:02:20,240
techniques, sometimes that's your only option.

48
00:02:20,240 --> 00:02:21,420
I want to make sure, though,

49
00:02:21,420 --> 00:02:25,540
that you understand the different filtering philosophies.

50
00:02:25,540 --> 00:02:27,130
I mean, in practical terms,

51
00:02:27,130 --> 00:02:31,940
you might use both concepts in the same PowerShell expression.

52
00:02:31,940 --> 00:02:35,810
But the bottom line is that you should always try to filter first or

53
00:02:35,810 --> 00:02:39,040
as early as you can in your PowerShell expression.

54
00:02:39,040 --> 00:02:45,640
You might hear people refer to this as the filter left or filter first practice.

55
00:02:45,640 --> 00:02:48,710
This is something that you need to be in the habit of doing all the time.

56
00:02:48,710 --> 00:02:51,640
It should just be part of your PowerShell muscle memory.

57
00:02:51,640 --> 00:02:53,540
Late filtering, again, is not bad,

58
00:02:53,540 --> 00:02:56,810
and there are plenty of times when that's exactly what you want to do.

59
00:02:56,810 --> 00:02:59,860
It's only bad, per se, or if you will,

60
00:02:59,860 --> 00:03:02,420
if there are early filtering techniques that you could

61
00:03:02,420 --> 00:03:05,440
have or should have taken into account.

62
00:03:05,440 --> 00:03:08,440
One approach to filtering is via parameters.

63
00:03:08,440 --> 00:03:11,980
Consider these as early filtering techniques. Look for

64
00:03:11,980 --> 00:03:14,750
parameters in the command you are using that will help you

65
00:03:14,750 --> 00:03:19,240
limit the results, like filter, name, ID, and so on.

66
00:03:19,240 --> 00:03:21,340
These are some of the parameters that you'll see in

67
00:03:21,340 --> 00:03:23,840
a number of PowerShell commands.

68
00:03:23,840 --> 00:03:28,250
However, don't assume that they all work the same in all commands.

69
00:03:28,250 --> 00:03:31,520
You must read full command help and examples,

70
00:03:31,520 --> 00:03:33,840
especially for that filter parameter.

71
00:03:33,840 --> 00:03:35,360
That sounds like the perfect parameter,

72
00:03:35,360 --> 00:03:39,310
right? But how you use that parameter is going to vary on the

73
00:03:39,310 --> 00:03:42,060
command and where you might be using that command.

74
00:03:42,060 --> 00:03:45,440
That's why you really need to read the help.

75
00:03:45,440 --> 00:03:50,040
Where‑Object is the primary late filtering cmdlet.

76
00:03:50,040 --> 00:03:55,140
You pipe a bunch of things to find things where the object meets some criteria.

77
00:03:55,140 --> 00:03:58,830
The command has aliases of Where and the question mark, although I'm

78
00:03:58,830 --> 00:04:01,880
not a big fan of that last one. I guess I just never made the

79
00:04:01,880 --> 00:04:04,500
connection between question mark and Where.

80
00:04:04,500 --> 00:04:07,810
But feel free to use either alias when working at a

81
00:04:07,810 --> 00:04:13,000
PowerShell prompt. Where‑Object will compare the incoming

82
00:04:13,000 --> 00:04:15,540
objects to some sort of filtering test.

83
00:04:15,540 --> 00:04:17,640
If the object passes the test,

84
00:04:17,640 --> 00:04:21,240
it is passed on into the pipeline to the next command.

85
00:04:21,240 --> 00:04:28,000
Now even though Where‑Object is considered late filtering, I think you'll actually be using it often, so let me give you some details.