- SystoLOCK in review: Logging in to Active Directory with multi-factor authentication without passwords - Tue, Dec 5 2023
- New Group Policy settings in Windows 11 23H2 - Mon, Nov 20 2023
- Windows Server 2025 will support SMB over QUIC in all editions - Fri, Nov 17 2023
You may ask yourself why a scripting language, which is mainly used for automation in system administration, needs operators at the bit level. In practice, however, there is always a need for such operations, for example, when the individual bits of a value act as flags for certain settings.
This applies to the Active Directory attributes for the Kerberos encryption type or UserAccountControl for important account settings. For example, the latter indicates whether an account is disabled if the second bit is set (corresponds to a value of binary 00000010).
Bitwise AND (-band)
If you combine the value of this attribute with 2 using a bitwise AND, then the result is only true if the second bit of the attribute value is set, i.e., the account has been deactivated. Assuming that the value of UserAccountControl for an account is 514, the following command will show it as disabled:
Get-ADUser -Filter * -Properties UserAccountControl |
Where { $_.UserAccountControl -band 0B00000010} | Select name
The leading "0B" marks the number as binary. The result of the operation is 2 and therefore "true" because the second digit from the right is 1 in both numbers. After a bitwise AND, the 1 remains in this position, whereas all other digits are set to 0.
Applying the band operator to the binary representation of 514 and 2 results in 2
However, if you enter the above expression in Windows PowerShell, you will get an error message. In contrast to PowerShell 7, binary numbers are not supported here. Instead, you must use decimal or hexadecimal numbers, but the operations are still performed at the bit level.
Bitwise OR (-bor and -bxor)
If you replace the AND in the above operation with an OR, you get 514 as a result. Because the second bit is 1 in both numbers, the result is 1. At the tenth bit, a 1 and a 0 are combined, which again results in 1:
0B001000000010 -bor 0B000000000010
results in
0B001000000010
Bitwise OR and XOR with optional conversion of the result to a binary number
XOR, on the other hand, is always true if the two operands are different; that is, if one bit is 1 and the other is 0. If both are the same, the result of XOR is false. The truth table of XOR looks like this:
| Input 1 | Input 2 | Result |
|---|---|---|
| False | False | False |
| False | True | True |
| True | False | True |
| True | True | False |
The following operation shows the binary representation of 514 and 2. Except for the leftmost one, all bits of the two numbers are the same, so they evaluate to 0. Only the foremost one remains at 1 because its counterpart is 0:
| 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
-bxor
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
results in:
| 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 |
Negation
For binary negation, the unary operator -bnot is used. It simply inverts all values of the respective bits, 1 becomes 0, and 0 becomes 1. The result of
-bnot 0B10000010
is therefore
0B01111101
Bitwise negation with BNOT
Shifting bits
PowerShell also has operators to shift the bits of a binary number any number of places left or right. The command
0B1000010 -shr 3
results in
0B0001000
The second bit from the right falls out of the number, and the leftmost bit moves to the fourth position from the right.
Shift the bits of a binary number left and right by two positions
The operator -shl has the opposite effect: shifting to the left increases the place value of the set bits.
Summary
PowerShell has a complete set of bit operators comprising -band, bor, bxor, and -bnot. In addition, there are two operators for shifting the bits by any number of places to the left and right.
Subscribe to 4sysops newsletter!
If you want to handle binary numbers directly, you need PowerShell 7. Windows PowerShell doesn't support this.
