Author Posts

April 10, 2015 at 5:06 am

When I run the following code in the console it returns the desired output:

get-hotfix | format-wide -property "hotfixid" -column 7

Returning just the KB name in 7 columns. I'm running a script that gathers evidence of security hardening for our servers and it takes a screenshot of the patches.

But when I run it inside of a script with other pieces of code it returns the error:

out-lineoutput : The object of type "Microsoft.PowerShell.Commands.Internal.Format.FormatStartData" is not valid or not in the correct sequence. This
is likely caused by a user-specified "format-wide" command which is conflicting with the default formatting.
+ CategoryInfo : InvalidData: (:) [out-lineoutput], InvalidOperationException
+ FullyQualifiedErrorId : ConsoleLineOutputOutOfSequencePacket,Microsoft.PowerShell.Commands.OutLineOutputCommand


$svr = $env:computername
New-Item -ItemType directory -Path $pwd\Evidence\$svr

#step 1
cls
systeminfo |?{$_ -notmatch "`[[0-9]+`]"}
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step1_$svr.jpg -imagetype jpg
cls

#step 2
write-host "Computer name: $svr"

$patches = get-hotfix
get-hotfix | format-wide -property "hotfixid" -column 7

Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step2_$svr.jpg -imagetype jpg
cls

#step 3
write-host "Computer name: $svr"
ipconfig /all
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step3_$svr.jpg -imagetype jpg
cls

#step 4
write-host "Computer name: $svr"
w32tm /query /source
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step4_$svr.jpg -imagetype jpg
cls

#step 5
write-host "Computer name: $svr"
get-childitem c:\urt
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step5_$svr.jpg -imagetype jpg
cls

#step 6
& '.\Program Files\Common Files\McAfee\SystemCore\csscan.exe' -version
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step6_$svr.jpg -imagetype jpg
cls

#step 8

$service = get-service
get-service | format-wide -property "Name" -column 7
Take-ScreenShot -activewindow -file $pwd\Evidence\$svr\step8_$svr.jpg -imagetype jpg
cls

April 10, 2015 at 5:19 am

Once a script starts spewing the output of a Format command to the pipeline, the pipeline goes into "screen display mode," and it can't "take" anything else. In other words, once you format something, you're done. Don't produce any other output.

Alternately, you could pipe Format-Wide to something like Out-File, which would give you the text you want, but potentially allow other output from your script as well.

Format commands are a PITA sometimes.

April 10, 2015 at 5:44 am

Ah, I knew there were some issues with formating, but I thought it always meant no more commands in the pipe, not the whole script ;x

I've resolved it like you said by out-file -ing to a .txt then 'cat .\file.txt' and taking a screenshot while it's on screen.

Thanks again for the advice!