Shell guide · PowerShell 7
PowerShell commands cheat sheet
PowerShell 7 commands for Windows administration, files, objects, services, event logs, networking, security, JSON, and CSV — with 5.1 compatibility notes.59explained commands6practical sections100%concrete examples
10
System and inventory
Identify the Windows host, installed updates, startup entries, and filesystem drives.
Show Windows operating system and hardware informationGet-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsArchitecture,CsTotalPhysicalMemoryRead-only
List recently installed Windows updatesGet-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20Read-only
Inventory Windows startup commands across registry and profilesGet-CimInstance Win32_StartupCommand | Sort-Object Location,Name | Select-Object Name,Command,Location,User | Format-Table -WrapRead-only
Show filesystem drives and free spaceGet-PSDrive -PSProvider FileSystemRead-only
Find the twenty largest files below a folderGet-ChildItem <folder> -File -Recurse -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 20 FullName,LengthRead-only
Show Windows operating system health fieldsGet-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,LastBootUpTime,FreePhysicalMemoryRead-only
Show Windows BIOS and firmware identityGet-CimInstance Win32_BIOS | Select-Object Manufacturer,SMBIOSBIOSVersion,ReleaseDate,SerialNumberRead-only
List Windows physical memory modulesGet-CimInstance Win32_PhysicalMemory | Select-Object BankLabel,Capacity,Speed,Manufacturer,PartNumberRead-only
Show Windows volume health and free spaceGet-Volume | Sort-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,FileSystem,HealthStatus,SizeRemaining,SizeRead-only
Show Windows physical disk healthGet-PhysicalDisk | Select-Object FriendlyName,MediaType,HealthStatus,OperationalStatus,SizeRead-only
10
Files and archives
Search, compare, compress, extract, hash, and locate large or recent files.
Find files modified in the last 24 hoursGet-ChildItem <folder> -File -Recurse | Where-Object LastWriteTime -gt (Get-Date).AddDays(-1)Read-only
Search recursively for text in filesGet-ChildItem <folder> -File -Recurse | Select-String -Pattern <pattern>Read-only
Calculate a file SHA-256 hashGet-FileHash <file> -Algorithm SHA256Read-only
Create a ZIP archive from a folderCompress-Archive -Path <folder> -DestinationPath <archive-file>caution
Extract a ZIP archive to a folderExpand-Archive -Path <archive-file> -DestinationPath <destination>caution
Compare relative file inventories of two foldersCompare-Object (Get-ChildItem <source> -File -Recurse | ForEach-Object FullName) (Get-ChildItem <destination> -File -Recurse | ForEach-Object FullName)Read-only
Group duplicate files by SHA-256 hash in PowerShellGet-ChildItem <folder> -File -Recurse | Get-FileHash -Algorithm SHA256 | Group-Object Hash | Where-Object Count -gt 1 | ForEach-Object GroupRead-only
Pretty-print and colorize a JSON documentjq . <file>Read-only
Extract active users from a JSON array as TSVjq -r '.[] | select(.active == true) | [.name, .email] | @tsv' <file>Read-only
Search text with line numbers and surrounding contextrg -n -C <lines> --glob '<glob>' <pattern> <path>Read-only
10
Processes and services
Find resource-heavy processes and connect Windows services to their owners.
Show the ten processes using the most CPU timeGet-Process | Sort-Object CPU -Descending | Select-Object -First 10Read-only
Show the ten processes using the most memoryGet-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10Read-only
List running Windows servicesGet-Service | Where-Object Status -eq 'Running'Read-only
List stopped Windows servicesGet-Service | Where-Object Status -eq 'Stopped'Read-only
Map Windows services to processes, accounts, and start modesGet-CimInstance Win32_Service | Sort-Object State,Name | Select-Object Name,State,StartMode,StartName,ProcessId,@{N='Process';E={(Get-Process -Id $_.ProcessId -ErrorAction SilentlyContinue).ProcessName}} | Format-Table -AutoSizeRead-only
List scheduled tasks whose last run failedGet-ScheduledTask | Get-ScheduledTaskInfo | Where-Object LastTaskResult -ne 0 | Sort-Object LastRunTime -Descending | Select-Object TaskName,LastRunTime,LastTaskResult,NextRunTimeRead-only
Follow new lines appended to a log fileGet-Content <file> -Tail 100 -WaitRead-only
Show the latest Windows system errorsGet-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 20Read-only
Detect services and versions on selected TCP portsnmap -sV --version-light -p <ports> <host>caution
Correlate recent Windows system errors by provider and event IDGet-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-<hours>)} | Group-Object ProviderName,Id | Sort-Object Count -Descending | Select-Object Count,@{N='ProviderAndId';E={$_.Name}},@{N='Newest';E={($_.Group | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated}}Read-only
07
Logs and incident signals
Follow text logs and summarize recent Windows event failures.
Find machine certificates expiring within a number of daysGet-ChildItem Cert:\LocalMachine\My | Where-Object NotAfter -lt (Get-Date).AddDays(<days>) | Sort-Object NotAfter | Select-Object Subject,Thumbprint,NotAfter,HasPrivateKeycaution
Generate a cryptographically random Base64 passwordopenssl rand -base64 <count>Read-only
Generate a cryptographically random Base64 password in PowerShell[Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(<count>))Read-only
Inspect a remote TLS certificate with OpenSSL from PowerShell'' | openssl s_client -connect <host>:<port> -servername <host> 2>$null | openssl x509 -noout -subject -issuer -dates -fingerprintRead-only
List Windows event providers matching a nameGet-WinEvent -ListProvider '*Service*' | Select-Object -First 10 NameRead-only
Show Windows boot and shutdown eventsGet-WinEvent -FilterHashtable @{LogName='System'; Id=12,13,6005,6006} -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,MessageRead-only
Show Windows Service Control Manager errorsGet-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; Level=2} -MaxEvents 20 | Select-Object TimeCreated,Id,MessageRead-only
12
Network and DNS
Inspect addresses, listeners, routes, DNS, HTTP metadata, and common web ports.
List configured IP addressesGet-NetIPAddress | Sort-Object InterfaceAlias,AddressFamilyRead-only
List listening TCP connections and owning processesGet-NetTCPConnection -State Listen | Sort-Object LocalPortRead-only
Test a remote TCP port from PowerShellTest-NetConnection -ComputerName <host> -Port <port>Read-only
Resolve a DNS name in PowerShellResolve-DnsName <domain>Read-only
Fetch HTTP response metadata in PowerShellInvoke-WebRequest -Uri <url> -Method HeadRead-only
Query common DNS record types from PowerShell'A','AAAA','MX','NS','TXT','CAA' | ForEach-Object { Resolve-DnsName <domain> -Type $_ -ErrorAction SilentlyContinue | Select-Object @{N='Type';E={$_.Type}},Name,IPAddress,NameExchange,Strings }Read-only
Join listening TCP ports to their owning process detailsGet-NetTCPConnection -State Listen | Sort-Object LocalPort | ForEach-Object { $p=Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; [pscustomobject]@{Address=$_.LocalAddress;Port=$_.LocalPort;PID=$_.OwningProcess;Process=$p.ProcessName;Path=$p.Path} } | Format-Table -AutoSizeRead-only
Resolve the best Windows route and source address to a destinationFind-NetRoute -RemoteIPAddress <host> | Select-Object InterfaceAlias,NextHop,RouteMetric,SourceAddressRead-only
Test common web ports concurrently from PowerShell80,443,8080,8443 | ForEach-Object -Parallel { $port=$_; $ok=Test-NetConnection <host> -Port $port -InformationLevel Quiet; [pscustomobject]@{Port=$port;Reachable=$ok} } -ThrottleLimit 4Read-only
Break an HTTP request into DNS, TCP, TLS, TTFB, and total timecurl -sS -o /dev/null -w 'status=%{http_code} dns=%{time_namelookup}s tcp=%{time_connect}s tls=%{time_appconnect}s ttfb=%{time_starttransfer}s total=%{time_total}s remote=%{remote_ip}\n' <url>Read-only
Enumerate accepted TLS ciphers and their gradesnmap --script ssl-enum-ciphers -p <port> <host>caution
Discover live hosts on an authorized subnet without port scanningnmap -sn <subnet>caution
10
Objects and structured data
Turn JSON and CSV into useful PowerShell objects and generate secure values.