PowerShell provides Windows administrators with an object-oriented shell, a scripting language and a way to automate repeatable operational work. Start with commands that inspect state before making changes. The ten commands below cover help, discovery, service and process inspection, event logs, system inventory, network checks, reporting and authorized remote administration. Examples are intended for PowerShell 7 on supported Windows systems unless noted.<\/p>\n
PowerShell commands can have different parameters, access requirements and platform support. Test scripts in a nonproduction environment and use least-privilege credentials. For a potentially destructive operation, review the target set first, record the intended change and define a recovery procedure.<\/p>\n
Get-Help Get-Service -Examples\nGet-Help Get-CimInstance -Full<\/code><\/pre>\nGet-Help<\/code> explains syntax, accepted parameters and examples. Use Update-Help<\/code> only when your environment and permissions permit downloading the latest help content. Help pages do not automatically guarantee a command is available on every operating system or module version.<\/p>\n2. Get-Command: Discover available modules and cmdlets<\/h2>\nGet-Command -Verb Get\nGet-Command *-Service\nGet-Command -Module Microsoft.PowerShell.Management<\/code><\/pre>\nCommand discovery helps distinguish installed modules from instructions copied from an older guide. Check a command’s source, version and supported parameters before including it in an automation script. Avoid depending on a deprecated cmdlet when an actively supported equivalent exists.<\/p>\n
3. Get-Service: Inspect service state<\/h2>\nGet-Service\nGet-Service -Name Spooler\nGet-Service | Where-Object Status -eq Running<\/code><\/pre>\nService inspection is a safe first step in Windows troubleshooting. Not every service exists on every computer, and service-management privileges vary. Do not restart or stop a service before checking its dependencies and business impact.<\/p>\n
4. Get-Process: Find resource-intensive processes<\/h2>\nGet-Process | Sort-Object CPU -Descending |\n Select-Object -First 10 Name, Id, CPU<\/code><\/pre>\nGet-Process<\/code> returns objects with properties such as process name, identifier and processor time. The CPU property is cumulative processor time, not an instantaneous utilization percentage. For performance investigations, correlate process data with system counters and the time interval measured.<\/p>\n5. Get-WinEvent: Read Windows event logs<\/h2>\nGet-WinEvent -LogName System -MaxEvents 20\nGet-WinEvent -FilterHashtable @{\n LogName = 'System'\n Level = 2\n StartTime = (Get-Date).AddDays(-1)\n} -MaxEvents 30<\/code><\/pre>\nGet-WinEvent<\/code> is the appropriate modern choice for Windows Event Log queries. Older Windows PowerShell tutorials often recommend Get-EventLog<\/code>, which is not included in PowerShell 7. Queries against restricted logs may require additional permissions; filter efficiently to avoid retrieving large histories unnecessarily.<\/p>\n6. Get-CimInstance: Inspect operating-system information<\/h2>\nGet-CimInstance -ClassName Win32_OperatingSystem |\n Select-Object Caption, Version, LastBootUpTime<\/code><\/pre>\nGet-CimInstance<\/code> replaces many inventory uses of the legacy Get-WmiObject<\/code> cmdlet, which was removed from PowerShell 7. CIM queries depend on the target platform, namespace and access rights. Prefer structured objects over parsing the display text of a command.<\/p>\n7. Test-Connection: Investigate network reachability<\/h2>\nTest-Connection -TargetName server01 -Count 2<\/code><\/pre>\nAn ICMP response can help check reachability and latency, but a failed ping does not conclusively prove a server is down: firewalls may block ICMP while an application remains available. Pair the result with name resolution, routing, firewall and application-port tests. Never use ping alone as a complete availability measurement.<\/p>\n
8. Select-Object: Shape a readable report<\/h2>\nGet-Service |\n Select-Object Name, DisplayName, Status |\n Sort-Object Name<\/code><\/pre>\nPowerShell pipelines pass objects rather than unstructured screen text. Selecting fields allows administrators to create concise reports while preserving machine-readable values for further processing. Use calculated properties carefully and label units when presenting performance or storage statistics.<\/p>\n
9. Export-Csv: Save structured audit results<\/h2>\nGet-Service |\n Select-Object Name, Status |\n Export-Csv -Path .\\services.csv -NoTypeInformation<\/code><\/pre>\nExport-Csv<\/code> produces reusable tabular data. Consider file location, access permissions, data sensitivity and whether the exported dataset contains identifiers that should be protected. Import it later with Import-Csv<\/code> rather than assuming comma-separated text will always parse correctly with string splitting.<\/p>\n10. Invoke-Command: Run authorized remote checks<\/h2>\nInvoke-Command -ComputerName server01 -ScriptBlock {\n Get-Service -Name Spooler\n}<\/code><\/pre>\nPowerShell remoting requires compatible configuration, authentication, transport connectivity and authorization. Do not enable broad remoting or weaken trusted-host settings indiscriminately. Begin with read-only checks against explicitly approved systems, then expand to change operations only through documented controls.<\/p>\n
Useful advanced commands beyond the first ten<\/h2>\n
ForEach-Object<\/code> processes pipeline data item by item; Where-Object<\/code> filters it. ConvertTo-Html<\/code> renders selected object properties into an HTML table for reporting. Start-Job<\/code>, Receive-Job<\/code> and runspaces support some asynchronous tasks but differ in resource isolation and error handling. Use functions, parameters, explicit error handling and logging when scripts grow beyond a small one-off operation.<\/p>\nStop-Process<\/code> and Stop-Service<\/code> can disrupt production services. Inspect IDs and service dependencies before invoking them; choose a scoped change and a documented rollback plan. New-PSDrive<\/code> can map supported providers or filesystem locations, but resource access depends on the relevant credentials.<\/p>\nSecurity cautions: execution policies and dynamic code<\/h2>\n
Get-ExecutionPolicy<\/code> and Set-ExecutionPolicy<\/code> manage script-execution policy settings on relevant Windows systems. Microsoft’s guidance is explicit that execution policy is a safety feature, not a security boundary. Do not present a permissive policy as a way to make an untrusted script safe; use trusted script sources, signing where appropriate, constrained permissions and endpoint protection.<\/p>\nAvoid Invoke-Expression<\/code> for strings assembled from variables or untrusted data. It parses and executes text as PowerShell code, which can introduce command-injection vulnerabilities. Prefer direct cmdlet invocation, structured arguments and explicit functions. Older Get-WmiObject<\/code> and Get-EventLog<\/code> samples belong to Windows PowerShell 5.1 history and should be labeled accordingly.<\/p>\nA practical administration exercise<\/h2>\n
Choose one lab computer and collect a service list, recent system errors, OS version and process inventory. Export the permitted fields as CSV and record the commands, expected output and interpretation. Run the same task again to check consistency. Only after you can explain the read-only output should you consider approved service or configuration changes.<\/p>\n
Conclusion<\/h2>\n
The most durable PowerShell habit is to discover, inspect and verify before changing systems. These ten commands build a foundation for Windows administration without assuming old cmdlets remain available in PowerShell 7. Combine them with deliberate permissions, testing, reporting and safe error handling to make automation dependable rather than risky.<\/p>\n","protected":false},"excerpt":{"rendered":"
PowerShell provides Windows administrators with an object-oriented shell, a scripting language and a way to automate repeatable operational work. Start with commands that inspect state before making changes. The ten commands below cover help, discovery, service and process inspection, event logs, system inventory, network checks, reporting and authorized remote administration. Examples are intended for PowerShell 7 on supported Windows systems unless noted. PowerShell commands can have different parameters, access requirements and platform support. Test scripts in a nonproduction environment and use least-privilege credentials. For a potentially destructive operation, review the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[712],"tags":[],"class_list":["post-5002","post","type-post","status-publish","format-standard","hentry","category-software"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t