4

I am trying to get SQL to execute some powershell commands using xp_cmdshell which has been working, however I'm running into an unusual problem. When I try to use a pipeline, it doesn't recognize the command after the pipeline. I tried this from the standard cmd line and can confirm that the same issue happens. This is the command I'm using:

powershell.exe -command get-eventlog -Newest 10 -LogName Application -Before "2018-04-18T22:02:23" -After "2018-04-17T22:02:23" -computername dk01sv1115 | Select Message

When I use the command without using | Select Message at the end, it works without issue. The issue is I'm not getting the full event message I've tried using Select and Format functions to try to get the full details but the pipe appears to be the issue. If you run the same command after starting powershell (IE run powershell.exe then run the command) it works without issue, however when you use SQL to run powershell.exe as a seperate line in SQL it runs indefinitely. EXAMPLE SQL:

Declare @command nvarchar(1000),@computername nvarchar(1000)

Set @computername = 'test'
Set @command = 'powershell.exe 
get-eventlog -Newest 10 -LogName Application -Before "' + REPLACE(Convert(VARCHAR(255),GETDATE(),120),' ','T') +'" -After "' + REPLACE(Convert(varchar(255),DateAdd(dd,-1,GETDATE()),120),' ','T') + '" -computername ' + @computername + '
exit'

exec xp_cmdshell @command
mklement0
  • 382,024
  • 64
  • 607
  • 775
Xanderu
  • 747
  • 1
  • 8
  • 30

2 Answers2

8

The | Select Message part is interpreted by cmd.exe, not PowerShell, because the pipe symbol (|) is special in cmd.exe as well (with roughly the same meaning), and you haven't enclosed it in "...".

The best approach to calling PowerShell from cmd.exe is to pass the entire PowerShell command as a single, double-quoted string ("...") to the -Command parameter:

powershell.exe -command "get-eventlog -Newest 10 -LogName Application -Before 2018-04-18T22:02:23 -After 2018-04-17T22:02:23 -computername dk01sv1115 | Select Message"

Tips regarding embedded quoting:

  • To quote literals, you can use '...' inside the overall "..." string.

    • Note that the values that were quoted in your original command didn't actually need quoting (e.g., "2018-04-18T22:02:23"), so I used them unquoted in my reformulation.

  • If you need to embed " chars., use \" (sic - even though PowerShell-internally it is ` that serves as the escape character).

mklement0
  • 382,024
  • 64
  • 607
  • 775
1

If you use the "PowerShell -command" form then place the complex command in quotes or curly braces.

Update: Adding the ^ escape character works through Invoke-SQLCommand:

Invoke-Sqlcmd -ServerInstance ECS-DCTS05 -Database Test -Query "xp_cmdshell 'powershell -command dir c:\ ^| format-list'"

This works from various places starting cmd.exe:

powershell -noprofile -command "get-childitem | format-list" # quoted

This does NOT use the format-list:

powershell -noprofile -command get-childitem | format-list # no quotes/braces

ADDED: Actually the following commands all work as expected on my Win7 PowerShell 5.1 machine:

Start search or WinKey+Run: cmd /k powershell -noprofile -command "get-childitem | format-table"

OR from a cmd prompt that is open: powershell -noprofile -command "get-childitem | format-list" powershell -noprofile -command "get-childitem | format-table"

In each case the format command words as expected.

If you are having trouble with quoting then the CMD escape OUTSIDE of quotes is ^, so sometimes prefixing the pipe with ^ will help in Cmd.exe (e.g., in cmd.exe for /f ...in ("command here with ^| pipe") do ... statements.

So does: powershell -noprofile -command "get-childitem | ForEach-Object FullName"

Which proves that PowerShell is running the 2nd element of the pipe.

EDITED: This also works but as a comment mentioned only from within PowerShell since CMD doesn't understand the curly braces:

powershell -noprofile -command { get-childitem | format-list } # curly braces added
HerbM
  • 521
  • 6
  • 14