So, I know that this is a little late, but I came across a post about a PowerShell April Fool’s joke that I thought was pretty funny and I wanted to share it. Now I am a fan of pranks, but I should preface this post with a warning… you should be sure to always know what a PowerShell command or script does before executing it. This might seem like a no-brainer, but I have worked with people who would copy lengthy scripts from GitHub or Pastebin and just execute them with no reluctance.

YOU HAVE BEEN WARNED!

Now, back to the prank. The command is a simple one, but I wanted to break it down because you might be someone getting into PowerShell or CLI scripting in general. The prank was that a person gave their coworker a PowerShell command to help with an issue they were dealing with. Well instead of getting a useful command they received this:

Get-Process | Where-Object {$_.MainWindowTitle -ne ""} | Stop-Process

Now executing this command kills all of your open programs. As the story goes, the person on the receiving end of this prank was not too happy.

The Breakdown

Let’s break down the command. This command is easily broken down into three sections. What divides these three sections is the “pipe” character. The pipe is the vertical line character (|). The way it works is you start with a single command and then “pipe” the output of the first command into the second command. In PowerShell, you will usually use this with a Where-Object in the second command to filter the output of the first command. When analyzing each object in the output, you can reference the current element with $_.

So for example, let’s say we have a command called “Print-Numbers” that prints the numbers 1 – 5 to the console window. Here is an example:

PS> Print-Numbers
PS> 1
PS> 2
PS> 3
PS> 4
PS> 5

Pretty handy command, right? Now what if we want to see the output with only numbers greater than 3. We will now pipe the first command into the second which will filter the output:

PS> Print-Numbers | Where-Object { $_ -gt 3 }
PS> 4
PS> 5

By using the pipe and the Where-Object statement, we were able to only print numbers greater than 3.

Now back to our command. In the first part of the command we run Get-Process which builds out a table with a few properties but all of the running processes on your computer. We then pump that table into the second command.

The second command contains a Where-Object command, which analyzes every object in the table and checks its MainWindowTitle property if it is NOT equal to an empty string (“”). A lot of times you will have a number of processes running even though you do not see them. A lot of these are very important system processes that you don’t want to kill, hence the reason they are filtering by the MainWindowTitle property. These processes that you don’t see will not have a MainWindowTitle so they will be excluded and ultimately not deleted.

This is where we get to the final command. The now filtered table is now “piped” into Stop-Process. I’m sure that you can guess what Stop-Process does! The end results in the remaining processes in the table being stopped.

Spit-Take

Pretty funny idea! I probably won’t be trying this one on my boss, haha. I did have an idea that builds upon this one. You could create an alias for a commonly used command that actually runs this one! Do you have any command line pranks? Let me know!