ExpandProperty on dynamic property (hash table)

PowerShell Help
1

Good Morning,

I have the following to attempt to determine the last logged on user of a machine:

$LastLoggedInUser = Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1

$CurrentUser = $LastLoggedInUser.User

Is it possible to get just the value without having to first store the object and then get the property of the object. If I try and expandproperty on the expression it doesn’t work and says the property cannot be found.

Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1

Is there a way of me just getting the value of User with this single line of code, I know normally I would use expandproperty to do this but as it is a generated name it does not allow me to do this unless I first store the object.

Hope that make sense.

Have a great day all :slight_smile:

2

Hi, welcome to the forum :wave:

For me, Select-Object -ExpandProperty and dot notation both work fine:

(Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | 
    Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and 
        ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | 
             Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1) | 
                 Select-Object -ExpandProperty User

(Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | 
    Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and 
         ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | 
              Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1).User
1 Like
3

Hi Matt,

Thanks for the warm welcome. It seems I was just using incorrect syntax, also using select-object twice is a new one on me.

Appreciate the help.

Cheers