# ExpandProperty on dynamic property (hash table)

**URL:** <https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545>\
**Category:** PowerShell Help\
**Created:** [February 10, 2022, 8:11am UTC](https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545 "2022-02-10T08:11:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Swatto](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Swatto](https://forums.powershell.org/u/Swatto)\
**Post date:** [February 10, 2022, 8:11am UTC](https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545/1 "2022-02-10T08:11:03Z")

</div>

Good Morning,

I have the following to attempt to determine the last logged on user of a machine:

```auto
$LastLoggedInUser = Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1

$CurrentUser = $LastLoggedInUser.User

```

Is it possible to get just the value without having to first store the object and then get the property of the object. If I try and expandproperty on the expression it doesn’t work and says the property cannot be found.

```auto
Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1

```

Is there a way of me just getting the value of User with this single line of code, I know normally I would use expandproperty to do this but as it is a generated name it does not allow me to do this unless I first store the object.

Hope that make sense.

Have a great day all 🙂

---

<div class="post-metadata">

**Author:** ![matt-bloomfield](https://avatars.discourse-cdn.com/v4/letter/m/dec6dc/32.png) [@matt-bloomfield](https://forums.powershell.org/u/matt-bloomfield)\
**Post date:** [February 10, 2022, 8:38am UTC](https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545/2 "2022-02-10T08:38:02Z")

</div>

Hi, welcome to the forum 👋

For me, `Select-Object -ExpandProperty` and dot notation both work fine:

```auto
(Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | 
    Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and 
        ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | 
             Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1) | 
                 Select-Object -ExpandProperty User

```

```auto
(Get-WinEvent -FilterHashtable @{Logname='Security';ID=4672} | 
    Where-Object {($_.Properties[1].Value -ne 'SYSTEM') -and 
         ($_.Properties[1].Value -ne $env:COMPUTERNAME+'$')} | 
              Select-Object @{N='User';E={$_.Properties[1].Value}} -First 1).User

```

---

<div class="post-metadata">

**Author:** ![Swatto](https://avatars.discourse-cdn.com/v4/letter/s/839c29/32.png) [@Swatto](https://forums.powershell.org/u/Swatto)\
**Post date:** [February 10, 2022, 9:04am UTC](https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545/3 "2022-02-10T09:04:29Z")

</div>

Hi Matt,

Thanks for the warm welcome. It seems I was just using incorrect syntax, also using select-object twice is a new one on me.

Appreciate the help.

Cheers

---

<div class="post-metadata">

**Author:** ![dotnVo](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@dotnVo](https://forums.powershell.org/u/dotnVo)\
**Post date:** [May 16, 2024, 8:19pm UTC](https://forums.powershell.org/t/expandproperty-on-dynamic-property-hash-table/18545/4 "2024-05-16T20:19:34Z")

</div>