Master Windows Administration with These 10 Essential PowerShell Commands

PowerShell provides Windows administrators with an object-oriented shell, a scripting language and a way to automate repeatable operational work. Start with commands that inspect state before making changes. The ten commands below cover help, discovery, service and process inspection, event logs, system inventory, network checks, reporting and authorized remote administration. Examples are intended for PowerShell 7 on supported Windows systems unless noted.

PowerShell commands can have different parameters, access requirements and platform support. Test scripts in a nonproduction environment and use least-privilege credentials. For a potentially destructive operation, review the target set first, record the intended change and define a recovery procedure.

1. Get-Help: Read syntax and examples before acting

Get-Help Get-Service -Examples
Get-Help Get-CimInstance -Full

Get-Help explains syntax, accepted parameters and examples. Use Update-Help only when your environment and permissions permit downloading the latest help content. Help pages do not automatically guarantee a command is available on every operating system or module version.

2. Get-Command: Discover available modules and cmdlets

Get-Command -Verb Get
Get-Command *-Service
Get-Command -Module Microsoft.PowerShell.Management

Command discovery helps distinguish installed modules from instructions copied from an older guide. Check a command’s source, version and supported parameters before including it in an automation script. Avoid depending on a deprecated cmdlet when an actively supported equivalent exists.

3. Get-Service: Inspect service state

Get-Service
Get-Service -Name Spooler
Get-Service | Where-Object Status -eq Running

Service inspection is a safe first step in Windows troubleshooting. Not every service exists on every computer, and service-management privileges vary. Do not restart or stop a service before checking its dependencies and business impact.

4. Get-Process: Find resource-intensive processes

Get-Process | Sort-Object CPU -Descending |
    Select-Object -First 10 Name, Id, CPU

Get-Process returns objects with properties such as process name, identifier and processor time. The CPU property is cumulative processor time, not an instantaneous utilization percentage. For performance investigations, correlate process data with system counters and the time interval measured.

5. Get-WinEvent: Read Windows event logs

Get-WinEvent -LogName System -MaxEvents 20
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Level = 2
    StartTime = (Get-Date).AddDays(-1)
} -MaxEvents 30

Get-WinEvent is the appropriate modern choice for Windows Event Log queries. Older Windows PowerShell tutorials often recommend Get-EventLog, which is not included in PowerShell 7. Queries against restricted logs may require additional permissions; filter efficiently to avoid retrieving large histories unnecessarily.

6. Get-CimInstance: Inspect operating-system information

Get-CimInstance -ClassName Win32_OperatingSystem |
    Select-Object Caption, Version, LastBootUpTime

Get-CimInstance replaces many inventory uses of the legacy Get-WmiObject cmdlet, which was removed from PowerShell 7. CIM queries depend on the target platform, namespace and access rights. Prefer structured objects over parsing the display text of a command.

7. Test-Connection: Investigate network reachability

Test-Connection -TargetName server01 -Count 2

An ICMP response can help check reachability and latency, but a failed ping does not conclusively prove a server is down: firewalls may block ICMP while an application remains available. Pair the result with name resolution, routing, firewall and application-port tests. Never use ping alone as a complete availability measurement.

8. Select-Object: Shape a readable report

Get-Service |
    Select-Object Name, DisplayName, Status |
    Sort-Object Name

PowerShell pipelines pass objects rather than unstructured screen text. Selecting fields allows administrators to create concise reports while preserving machine-readable values for further processing. Use calculated properties carefully and label units when presenting performance or storage statistics.

9. Export-Csv: Save structured audit results

Get-Service |
    Select-Object Name, Status |
    Export-Csv -Path .\services.csv -NoTypeInformation

Export-Csv produces reusable tabular data. Consider file location, access permissions, data sensitivity and whether the exported dataset contains identifiers that should be protected. Import it later with Import-Csv rather than assuming comma-separated text will always parse correctly with string splitting.

10. Invoke-Command: Run authorized remote checks

Invoke-Command -ComputerName server01 -ScriptBlock {
    Get-Service -Name Spooler
}

PowerShell remoting requires compatible configuration, authentication, transport connectivity and authorization. Do not enable broad remoting or weaken trusted-host settings indiscriminately. Begin with read-only checks against explicitly approved systems, then expand to change operations only through documented controls.

Useful advanced commands beyond the first ten

ForEach-Object processes pipeline data item by item; Where-Object filters it. ConvertTo-Html renders selected object properties into an HTML table for reporting. Start-Job, Receive-Job and runspaces support some asynchronous tasks but differ in resource isolation and error handling. Use functions, parameters, explicit error handling and logging when scripts grow beyond a small one-off operation.

Stop-Process and Stop-Service can disrupt production services. Inspect IDs and service dependencies before invoking them; choose a scoped change and a documented rollback plan. New-PSDrive can map supported providers or filesystem locations, but resource access depends on the relevant credentials.

Security cautions: execution policies and dynamic code

Get-ExecutionPolicy and Set-ExecutionPolicy manage script-execution policy settings on relevant Windows systems. Microsoft’s guidance is explicit that execution policy is a safety feature, not a security boundary. Do not present a permissive policy as a way to make an untrusted script safe; use trusted script sources, signing where appropriate, constrained permissions and endpoint protection.

Avoid Invoke-Expression for strings assembled from variables or untrusted data. It parses and executes text as PowerShell code, which can introduce command-injection vulnerabilities. Prefer direct cmdlet invocation, structured arguments and explicit functions. Older Get-WmiObject and Get-EventLog samples belong to Windows PowerShell 5.1 history and should be labeled accordingly.

A practical administration exercise

Choose one lab computer and collect a service list, recent system errors, OS version and process inventory. Export the permitted fields as CSV and record the commands, expected output and interpretation. Run the same task again to check consistency. Only after you can explain the read-only output should you consider approved service or configuration changes.

Conclusion

The most durable PowerShell habit is to discover, inspect and verify before changing systems. These ten commands build a foundation for Windows administration without assuming old cmdlets remain available in PowerShell 7. Combine them with deliberate permissions, testing, reporting and safe error handling to make automation dependable rather than risky.