When I write PowerShell scripts, I have often found that I need to reference the date. For example, I have occasionally written scripts that pull Windows event logs from a particular date or scripts that archive aging data based on the date when a file was created. Those are just a couple of examples of how the date may need to be referenced within a PowerShell script. In this article, I want to show you a few tricks for working with dates in PowerShell.
Retrieving the date
It is simple to make PowerShell display the current date. To do so, just enter the Get-Date cmdlet. If you need to display the date in a certain way, then PowerShell offers a number of different options for doing so. The simplest method is to use a display hint. The DisplayHint parameter can be set to Date, Time, or DateTime. The image below shows how the basic Get-Date cmdlet works, and a few examples of using the DisplayHint parameter.
If you need a bit more control over the output, you can use the Format parameter or the UFormat parameter. The Format parameter is mostly used when you need to put the date into a certain format for the purpose of making a comparison. We won’t be using the Format parameter in this article, but it is still a good idea to be aware of its existence.
The UFormat parameter is used more for display purposes. It allows you to arrange the various elements that make up the date and time in a way of your choosing. All you have to do is to append various formatting characters to the UFormat parameter. The parameters that you can use include:
%M — Month (as a number)
%D — Date
%Y — Year
%A — The day of the week
%Z — The time zone, expressed as an offset from UTC or Zulu time. For example, -5 is Eastern Time in the United States.
You can see an example below of how the UFormat parameter works.
There are two things that are worth paying attention to in the image above. First, you will notice that everything following the UFormat parameter is enclosed in quotation marks. This is because I am not just specifying formatting characters, I can also use text. In the figure, I used a mixture of text and formatting characters.
The other thing to notice is that even though I live on the East Coast of the United States, which normally has a time zone offset of -5, the output in the figure above shows the offset as -4. This is because it is daylight saving time. But wouldn’t it be nice to be able to verify that? We can actually. Here is how it’s done:
As you can see in the image below, PowerShell shows a value of True, indicating that it is indeed daylight savings time.
What about the day of the year?
We can also use PowerShell to tell us what day of the year it is. Here is how that works:
If you really want to make things interesting, though, you can specify a date to find out what day of the year that date falls on. The date that you specify can be past or future. Here is an example:
Get-Date -Year 2018 -Month 8 -Daye 22).DayOfYear
You can see a couple of examples in the image below.
Making date comparisons
As I said earlier, it is possible to use PowerShell to make date comparisons. Although you can use the -Format parameter to put the date into a specific format prior to comparing it to another value, doing so is not always necessary. For example, comparing file write dates does not require the use of any special formatting.
Let’s suppose for a moment that you wanted to compare the last write time for a particular file to a date and time of your choosing to see if the file was written to more recently than the specified date.
In a situation like this, the first thing that we have to do is to map our target date to a variable. For the sake of demonstration, I will map January 2, 2017 (which is a random date), to the variable A$. I will then map a particular file to a variable, which I will call X$. It will then be possible to make comparisons between the two. So here are the commands that I am going to use:
$A = (Get-Date -Year 2017 -Month 01 -Day 02)
$X = Get-ChildItem Readme.txt
$X.LastWriteTime -GT $A
The first line of code maps the $A variable to January 2, 2017. The next line simply verifies that the variable contains the desired date. The third line of code maps the $X variable to a file named ReadMe.txt. The fourth line displays the last write time for the file. The final line of code makes a comparison between the two dates. It will show True is the file was written more recently than January 2, 2017. Otherwise, it will show a value of False. The screen capture below shows this in action. You will also notice that I have added another line to check to see if the file’s last write time is older than (-LT) January 2, 2017. Doing two separate comparisons makes it possible to see that the comparison really is doing what it is supposed to do.
Dates in PowerShell: More to learn
PowerShell actually allows you to do far more with regard to date formatting and comparisons than what I have talked about in this article. If you would like to learn more about using dates in PowerShell, a good place to start is Microsoft’s documentation for the Get-Date cmdlet.
More PowerShell Basics articles
- PowerShell Gallery: A great free resource for finding scripts
- Using JSON with PowerShell: A guide for IT professionals
- Reading text files with PowerShell and Linux bash shell
- How malicious PowerShell scripts evade detection
- Building PowerShell hash tables