PowerShell is one of the most valuable administration and automation tools available to Windows system administrators. Unlike the traditional Command Prompt, PowerShell works with structured objects and provides extensive capabilities for managing Windows clients, Windows Server, Active Directory, networking, storage, services, processes, event logs, security, Remote Desktop environments, and many other components.

For a system administrator, PowerShell is not merely a command-line alternative. It can serve as a diagnostic console, configuration tool, automation engine, reporting platform, and remote administration framework.

This guide provides a practical collection of PowerShell commands useful in everyday Windows administration, along with precautions administrators should follow before running commands that modify production systems.

1. Opening PowerShell with Administrator Rights

Many administrative commands require elevation.

Open Start, search for PowerShell or Terminal, right-click it, and choose:

Run as administrator

You can check whether the current PowerShell session is elevated:

([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
    [Security.Principal.WindowsBuiltInRole]::Administrator
)

A result of:

True

means the session has administrator privileges.

PowerShell Safety Rules for System Administrators

PowerShell is extremely powerful. The same capability that makes administration easier can also make a mistake affect thousands of files, hundreds of users, or multiple computers.

Before using an unfamiliar command in production:

1. Understand the command first

Use:

Get-Help CommandName

Example:

Get-Help Remove-Item

For detailed help:

Get-Help Remove-Item -Full

To see examples:

Get-Help Remove-Item -Examples

2. Use -WhatIf whenever supported

Many commands that change the system support -WhatIf.

Example:

Remove-Item "D:\OldData" -Recurse -WhatIf

This shows what PowerShell intends to do without actually deleting the files.

Similarly:

Stop-Service Spooler -WhatIf

3. Avoid blindly copying Internet scripts

Never execute an unknown script merely because it claims to optimize, repair, activate, clean, or debloat Windows.

Review the script first.

Be particularly careful with commands involving:

Remove-Item
Remove-ADUser
Disable-ADAccount
Stop-Service
Restart-Computer
Stop-Computer
Format-Volume
Clear-Disk
Remove-Partition
Set-ExecutionPolicy
Invoke-Expression

4. Test destructive commands on a lab system

For servers and business-critical PCs, test scripts on a non-production system before deployment.

5. Maintain backups

Before bulk configuration changes, ensure that important files, applications, databases, virtual machines, and configuration information are backed up.

2. Discovering PowerShell Commands

PowerShell can help administrators discover its own capabilities.

List commands:

Get-Command

Search for commands containing a word:

Get-Command *Service*

For network-related commands:

Get-Command *Net*

Find examples:

Get-Help Get-Service -Examples

This is particularly useful when you remember what you want to manage but not the exact command.

3. Basic System Information

One of the first tasks during troubleshooting is identifying the system.

Get-ComputerInfo

This can return information about Windows, BIOS, computer model, processor, memory, operating system, and other system properties.

For a smaller operating-system report:

Get-CimInstance Win32_OperatingSystem

Computer manufacturer and model:

Get-CimInstance Win32_ComputerSystem |
Select-Object Manufacturer, Model

BIOS information:

Get-CimInstance Win32_BIOS

CPU information:

Get-CimInstance Win32_Processor |
Select-Object Name, NumberOfCores, NumberOfLogicalProcessors

Physical memory modules:

Get-CimInstance Win32_PhysicalMemory |
Select-Object Manufacturer, Capacity, Speed

4. Check Windows Version and Build

Get-ComputerInfo |
Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Another useful method:

Get-CimInstance Win32_OperatingSystem |
Select-Object Caption, Version, BuildNumber

This is useful before troubleshooting update, driver, compatibility, and application problems.

5. Check Computer Name

$env:COMPUTERNAME

Or:

hostname

Detailed computer information:

Get-CimInstance Win32_ComputerSystem |
Select-Object Name, Domain, Manufacturer, Model

6. Check Current User

whoami

PowerShell alternative:

$env:USERNAME

Domain information:

$env:USERDOMAIN

Current identity:

[System.Security.Principal.WindowsIdentity]::GetCurrent().Name

7. Check System Uptime

Get-Uptime

You can also obtain the last boot time:

(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

This is extremely useful when investigating servers that were unexpectedly restarted.

8. List Running Processes

Get-Process

Sort processes by CPU consumption:

Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 15

Sort by memory:

Get-Process |
Sort-Object WorkingSet64 -Descending |
Select-Object -First 15 Name, Id, CPU,
@{Name="MemoryMB";Expression={[math]::Round($_.WorkingSet64/1MB,2)}}

This can quickly identify processes consuming excessive memory.

9. Find a Specific Process

Example for Chrome:

Get-Process chrome -ErrorAction SilentlyContinue

Explorer:

Get-Process explorer -ErrorAction SilentlyContinue

PowerShell:

Get-Process powershell -ErrorAction SilentlyContinue

10. Stop a Process

By name:

Stop-Process -Name notepad

By process ID:

Stop-Process -Id 1234

Force termination:

Stop-Process -Name notepad -Force

Precaution: Verify the process before terminating it. Stopping critical Windows processes can terminate user sessions, cause application data loss, or destabilize the operating system.

11. Restart Windows Explorer

A useful command when the taskbar, desktop, Start menu, or File Explorer becomes unresponsive:

Stop-Process -Name explorer -Force
Start-Process explorer.exe

12. List Windows Services

Get-Service

Show running services:

Get-Service |
Where-Object Status -eq "Running"

Show stopped services:

Get-Service |
Where-Object Status -eq "Stopped"

Find a service:

Get-Service *print*

13. Start, Stop, and Restart Services

Start:

Start-Service Spooler

Stop:

Stop-Service Spooler

Restart:

Restart-Service Spooler

Check status:

Get-Service Spooler

For print-related problems, restarting the Print Spooler is a common troubleshooting step.

14. Check Service Startup Configuration

Get-CimInstance Win32_Service |
Select-Object Name, State, StartMode

Find automatic services that are currently stopped:

Get-CimInstance Win32_Service |
Where-Object {
    $_.StartMode -eq "Auto" -and
    $_.State -ne "Running"
}

This is useful for finding services that should normally have started during boot but failed.

15. IP Address Information

Get-NetIPAddress

For IPv4 addresses:

Get-NetIPAddress -AddressFamily IPv4

Full network configuration:

Get-NetIPConfiguration

Traditional command:

ipconfig /all

PowerShell can execute many traditional Windows utilities directly.

16. Check Network Adapters

Get-NetAdapter

Only active adapters:

Get-NetAdapter |
Where-Object Status -eq "Up"

Detailed adapter information:

Get-NetAdapter |
Format-Table Name, InterfaceDescription, Status, LinkSpeed

This helps identify disconnected adapters, incorrect NIC selection, and negotiated link speeds.

17. Ping Connectivity Test

Test-Connection 8.8.8.8

Test a hostname:

Test-Connection google.com

Test four packets:

Test-Connection 8.8.8.8 -Count 4

A successful IP ping combined with failed hostname resolution can indicate a DNS-related problem.

18. Test a TCP Port

One of the most useful PowerShell networking commands is:

Test-NetConnection

Test HTTPS:

Test-NetConnection example.com -Port 443

Test Remote Desktop:

Test-NetConnection server.example.com -Port 3389

Test SMTP submission:

Test-NetConnection smtp.example.com -Port 587

The result can show whether the destination is reachable and whether the TCP connection succeeded.

19. DNS Troubleshooting

Resolve a domain:

Resolve-DnsName example.com

Query MX records:

Resolve-DnsName example.com -Type MX

Query TXT records:

Resolve-DnsName example.com -Type TXT

Query a specific DNS server:

Resolve-DnsName example.com -Server 8.8.8.8

This is extremely useful for DNS, email, SPF, and domain troubleshooting.

20. Clear DNS Cache

Clear-DnsClientCache

Traditional equivalent:

ipconfig /flushdns

Useful after DNS changes or when stale DNS cache is suspected.

21. Check DNS Cache

Get-DnsClientCache

This allows an administrator to inspect locally cached DNS entries.

22. Check Routing Table

Get-NetRoute

IPv4 routes:

Get-NetRoute -AddressFamily IPv4

Default route:

Get-NetRoute -DestinationPrefix "0.0.0.0/0"

This is valuable when a machine has multiple network adapters, VPNs, gateways, or WAN connections.

23. Check Active TCP Connections

Get-NetTCPConnection

Established connections:

Get-NetTCPConnection -State Established

Listening ports:

Get-NetTCPConnection -State Listen

Find the owning process:

Get-NetTCPConnection -State Established |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

24. Find Which Process Is Using a Port

Suppose port 3389 is being investigated:

Get-NetTCPConnection -LocalPort 3389

Find the process:

Get-Process -Id (Get-NetTCPConnection -LocalPort 3389).OwningProcess

This is useful for troubleshooting port conflicts and unexpected listening services.

25. Check Windows Firewall Profiles

Get-NetFirewallProfile

This displays the Domain, Private, and Public firewall profiles.

Check whether each profile is enabled:

Get-NetFirewallProfile |
Select-Object Name, Enabled

26. Inspect Firewall Rules

Get-NetFirewallRule

Only enabled rules:

Get-NetFirewallRule |
Where-Object Enabled -eq "True"

Search by display name:

Get-NetFirewallRule |
Where-Object DisplayName -like "*Remote*"

Precaution: Avoid disabling Windows Firewall globally as a troubleshooting shortcut. Identify the specific rule, profile, application, or port involved.

27. Check Disk Space

Get-Volume

A cleaner report:

Get-Volume |
Where-Object DriveLetter |
Select-Object DriveLetter, FileSystemLabel,
@{Name="SizeGB";Expression={[math]::Round($_.Size/1GB,2)}},
@{Name="FreeGB";Expression={[math]::Round($_.SizeRemaining/1GB,2)}}

Disk-space monitoring is particularly important on servers, RDS systems, database servers, and virtual machines.

28. Check Physical Disks

Get-PhysicalDisk

Useful columns:

Get-PhysicalDisk |
Select-Object FriendlyName, MediaType, HealthStatus, OperationalStatus, Size

A drive reporting abnormal health should be investigated immediately.

29. View Disks and Partitions

Get-Disk

Partitions:

Get-Partition

Volumes:

Get-Volume

Together, these commands provide a useful overview of the Windows storage layout.

Warning: Commands such as Clear-Disk, Format-Volume, and Remove-Partition can destroy data. Verify the disk number, volume, backups, and intended action before executing storage modification commands.

30. Find Large Files

Example: find files larger than 1 GB:

Get-ChildItem "D:\" -File -Recurse -ErrorAction SilentlyContinue |
Where-Object Length -gt 1GB |
Sort-Object Length -Descending |
Select-Object FullName,
@{Name="SizeGB";Expression={[math]::Round($_.Length/1GB,2)}}

On large drives this command may take time because it recursively scans directories.

31. Find Recently Modified Files

Files changed during the last 24 hours:

Get-ChildItem "D:\Data" -File -Recurse -ErrorAction SilentlyContinue |
Where-Object LastWriteTime -gt (Get-Date).AddDays(-1)

Last seven days:

Get-ChildItem "D:\Data" -File -Recurse -ErrorAction SilentlyContinue |
Where-Object LastWriteTime -gt (Get-Date).AddDays(-7)

Useful for investigating recent changes, backups, application output, and user activity.

32. Check Folder Size

$size = (Get-ChildItem "D:\Data" -File -Recurse -ErrorAction SilentlyContinue |
Measure-Object Length -Sum).Sum

"{0:N2} GB" -f ($size / 1GB)

This is useful when determining which application or data directory is consuming storage.

33. File Copying

Basic PowerShell copy:

Copy-Item "C:\Source\File.txt" "D:\Backup\"

Copy directory:

Copy-Item "C:\Data" "D:\Backup" -Recurse

For large administrative migrations, Robocopy is often more suitable because of its retry, logging, verification, and mirroring capabilities.

34. Check File Hash

Get-FileHash "D:\Backup\File.zip"

SHA256 is the default.

Explicitly:

Get-FileHash "D:\Backup\File.zip" -Algorithm SHA256

Hashes are useful for verifying that files have not changed during transfer or distribution.

35. List Installed Software

A practical registry-based approach:

$paths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

Get-ItemProperty $paths -ErrorAction SilentlyContinue |
Where-Object DisplayName |
Select-Object DisplayName, DisplayVersion, Publisher |
Sort-Object DisplayName

This is generally preferable to using Win32_Product for routine software inventory because querying Win32_Product can trigger Windows Installer consistency checks.

36. Check Installed Windows Updates

Get-HotFix

Newest first:

Get-HotFix |
Sort-Object InstalledOn -Descending

Useful during troubleshooting when a problem started after an update.

37. Check Windows Event Logs

List available logs:

Get-WinEvent -ListLog *

Recent System events:

Get-WinEvent -LogName System -MaxEvents 50

Recent Application events:

Get-WinEvent -LogName Application -MaxEvents 50

38. Find Recent System Errors

Get-WinEvent -FilterHashtable @{
    LogName = "System"
    Level   = 2
} -MaxEvents 50

For application errors:

Get-WinEvent -FilterHashtable @{
    LogName = "Application"
    Level   = 2
} -MaxEvents 50

Event logs should be among the first places checked when troubleshooting unexplained Windows problems.

39. Find Events from the Last 24 Hours

Get-WinEvent -FilterHashtable @{
    LogName   = "System"
    StartTime = (Get-Date).AddHours(-24)
}

Only errors:

Get-WinEvent -FilterHashtable @{
    LogName   = "System"
    Level     = 2
    StartTime = (Get-Date).AddHours(-24)
}

40. Export Event Information

Get-WinEvent -LogName System -MaxEvents 500 |
Export-Csv "C:\Temp\SystemEvents.csv" -NoTypeInformation

This creates a report that can be analyzed later or shared with another administrator.

41. Check Scheduled Tasks

Get-ScheduledTask

Running tasks:

Get-ScheduledTask |
Where-Object State -eq "Running"

Disabled tasks:

Get-ScheduledTask |
Where-Object State -eq "Disabled"

Scheduled tasks are worth checking when investigating unexpected programs, recurring scripts, backups, maintenance tasks, or unexplained CPU usage.

42. Check Local Users

Get-LocalUser

Enabled accounts:

Get-LocalUser |
Where-Object Enabled

Disabled accounts:

Get-LocalUser |
Where-Object { -not $_.Enabled }

43. Check Local Groups

Get-LocalGroup

Members of local Administrators:

Get-LocalGroupMember Administrators

This should be reviewed periodically because unnecessary administrator privileges increase security risk.

44. Create a Local User

$password = Read-Host "Enter password" -AsSecureString

New-LocalUser -Name "SupportUser" `
    -Password $password `
    -Description "IT Support Account"

Add to a group:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "SupportUser"

Avoid embedding plain-text passwords directly into scripts.

45. Disable a Local User

Disable-LocalUser -Name "OldUser"

Re-enable:

Enable-LocalUser -Name "OldUser"

Disabling an account is often preferable to immediately deleting it because the account can be restored if required.

46. Active Directory User Commands

On systems with the Active Directory PowerShell module:

Get-ADUser -Filter *

Find one user:

Get-ADUser -Identity username -Properties *

Enabled users:

Get-ADUser -Filter 'Enabled -eq $true'

Disabled users:

Get-ADUser -Filter 'Enabled -eq $false'

These commands require the appropriate Active Directory tools/module and permissions.

47. Find Locked Active Directory Accounts

Search-ADAccount -LockedOut

Unlock a user:

Unlock-ADAccount -Identity username

This can be extremely useful for helpdesk and domain administration.

48. Find Disabled Active Directory Accounts

Search-ADAccount -AccountDisabled -UsersOnly

Find expired accounts:

Search-ADAccount -AccountExpired -UsersOnly

49. Active Directory Group Membership

Get-ADGroupMember "Domain Admins"

Check a user's group memberships:

Get-ADPrincipalGroupMembership username |
Select-Object Name

Regularly auditing privileged groups is an important security practice.

50. Check Group Policy

Generate an HTML Group Policy report:

gpresult /h C:\Temp\GPReport.html

Force policy refresh:

gpupdate /force

PowerShell can run these traditional Windows administration tools directly.

51. Check Remote Desktop Sessions

On Remote Desktop Session Host systems:

quser

Another traditional command:

qwinsta

These show logged-on RDP users and session IDs.

52. Log Off a Stuck RDP Session

First:

quser

Identify the correct session ID.

Then:

logoff 5

Replace 5 with the correct session ID.

Precaution: Logging off a session closes the user's applications and may cause loss of unsaved work.

53. Restart a Remote Computer

Restart-Computer -ComputerName SERVER01

Local restart:

Restart-Computer

Force:

Restart-Computer -Force

Use -Force carefully, particularly on application, database, file, and RDS servers.

54. Shut Down a Computer

Stop-Computer

Remote computer:

Stop-Computer -ComputerName SERVER01

Verify that users, services, databases, backups, and business applications are in a safe state before shutting down a server.

55. PowerShell Remoting

Check WinRM:

Get-Service WinRM

Start an interactive remote session:

Enter-PSSession -ComputerName SERVER01

Run a remote command:

Invoke-Command -ComputerName SERVER01 -ScriptBlock {
    Get-Service
}

Exit:

Exit-PSSession

PowerShell remoting can significantly reduce the need to manually log into every Windows server.

56. Check SMB Shares

Get-SmbShare

Check open SMB files:

Get-SmbOpenFile

Check SMB sessions:

Get-SmbSession

These commands are valuable on Windows file servers.

57. Check File and Folder Permissions

Get-Acl "D:\Data"

Display access rules:

(Get-Acl "D:\Data").Access

For traditional NTFS permission administration, icacls also remains extremely useful:

icacls "D:\Data"

58. Check Windows Defender Status

Where Microsoft Defender cmdlets are available:

Get-MpComputerStatus

Useful properties include:

Get-MpComputerStatus |
Select-Object AntivirusEnabled,
RealTimeProtectionEnabled,
AntivirusSignatureLastUpdated,
QuickScanAge,
FullScanAge

59. Check Defender Threat Detection

Get-MpThreatDetection

This can provide information about detected threats and related activity.

Security controls should not be disabled merely to improve system performance. Investigate exclusions, application compatibility, resource usage, and security policy instead.

60. Check Windows Optional Features

Get-WindowsOptionalFeature -Online

Enabled features:

Get-WindowsOptionalFeature -Online |
Where-Object State -eq "Enabled"

On Windows Server, administrators may also use server-specific feature-management cmdlets such as Get-WindowsFeature where available.

61. Check Drivers

Get-CimInstance Win32_PnPSignedDriver |
Select-Object DeviceName, Manufacturer, DriverVersion, DriverDate

Useful when diagnosing hardware instability, network problems, display problems, or driver compatibility.

62. Check Devices with Problems

Get-PnpDevice |
Where-Object Status -ne "OK"

List devices:

Get-PnpDevice

This can help identify failed, disconnected, or incorrectly configured hardware.

63. Check Printers

Get-Printer

Printer ports:

Get-PrinterPort

Printer drivers:

Get-PrinterDriver

These commands are useful on print servers, RDS environments, and office PCs.

64. Restart Print Spooler

Restart-Service Spooler

Check status:

Get-Service Spooler

For many temporary Windows printing problems, restarting the spooler is a useful first diagnostic action.

65. Check Environment Variables

Get-ChildItem Env:

Specific variable:

$env:PATH

Current profile:

$env:USERPROFILE

Temporary folder:

$env:TEMP

66. Check PowerShell Version

$PSVersionTable

Only version:

$PSVersionTable.PSVersion

This matters because Windows PowerShell 5.1 and modern PowerShell versions do not have identical command availability and behavior.

67. PowerShell Command History

Get-History

Repeat a command by history ID:

Invoke-History 10

Be cautious when repeating historical commands that modify or delete data.

68. Export Administrative Reports to CSV

One of PowerShell's biggest advantages is easy reporting.

Processes:

Get-Process |
Select-Object Name, Id, CPU, WorkingSet64 |
Export-Csv "C:\Temp\Processes.csv" -NoTypeInformation

Services:

Get-Service |
Export-Csv "C:\Temp\Services.csv" -NoTypeInformation

Local users:

Get-LocalUser |
Export-Csv "C:\Temp\LocalUsers.csv" -NoTypeInformation

69. Generate an HTML Report

Get-Service |
ConvertTo-Html -Title "Windows Service Report" |
Out-File "C:\Temp\Services.html"

PowerShell can therefore be used to build lightweight administrative reporting systems without requiring a separate reporting application.

70. Monitor a Process Continuously

Example:

while ($true) {
    Get-Process |
    Sort-Object CPU -Descending |
    Select-Object -First 10 Name, Id, CPU

    Start-Sleep -Seconds 5
    Clear-Host
}

Press:

Ctrl + C

to stop the monitoring loop.

71. Check Memory Usage

Get-CimInstance Win32_OperatingSystem |
Select-Object @{
    Name="TotalRAMGB"
    Expression={[math]::Round($_.TotalVisibleMemorySize/1MB,2)}
}, @{
    Name="FreeRAMGB"
    Expression={[math]::Round($_.FreePhysicalMemory/1MB,2)}
}

This is useful on RDS servers where memory pressure can be caused by many concurrent applications and users.

72. Check CPU Load

Get-CimInstance Win32_Processor |
Select-Object Name, LoadPercentage

For troubleshooting, combine CPU information with process analysis rather than assuming that high overall CPU alone identifies the cause.

73. Check Automatic Services That Failed to Start

A particularly valuable server-health command:

Get-CimInstance Win32_Service |
Where-Object {
    $_.StartMode -eq "Auto" -and
    $_.State -ne "Running"
} |
Select-Object Name, DisplayName, State, StartMode

Not every automatic service must necessarily be running at every moment, but unexpected entries deserve investigation.

74. Check Pending Restart Indicators

A basic Windows Update reboot indicator can be checked with:

Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"

Component servicing:

Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"

A pending reboot can explain incomplete updates, application installation problems, and unusual service behavior.

75. Test Internet and DNS Separately

A useful diagnostic sequence:

Test-Connection 8.8.8.8 -Count 4
Resolve-DnsName google.com
Test-NetConnection google.com -Port 443

These tests examine different layers.

If IP connectivity succeeds but name resolution fails, investigate DNS.

If DNS works but TCP port 443 fails, investigate routing, firewall, proxy, endpoint security, or upstream connectivity.

76. Create a Quick Server Health Snapshot

A simple daily check can include:

Get-Uptime
Get-Volume
Get-Service |
Where-Object Status -eq "Stopped"
Get-CimInstance Win32_Processor |
Select-Object Name, LoadPercentage
Get-CimInstance Win32_OperatingSystem |
Select-Object FreePhysicalMemory
Get-WinEvent -FilterHashtable @{
    LogName = "System"
    Level   = 2
} -MaxEvents 10

A production version can export this information into CSV, HTML, JSON, or a centralized monitoring platform.

Useful Daily PowerShell Command Cheat Sheet

Administrative Task	Command
System information	Get-ComputerInfo
Windows information	Get-CimInstance Win32_OperatingSystem
Uptime	Get-Uptime
Processes	Get-Process
Services	Get-Service
Restart service	Restart-Service
Network configuration	Get-NetIPConfiguration
Network adapters	Get-NetAdapter
Ping	Test-Connection
Port test	Test-NetConnection
DNS lookup	Resolve-DnsName
Clear DNS cache	Clear-DnsClientCache
Routing	Get-NetRoute
TCP connections	Get-NetTCPConnection
Firewall	Get-NetFirewallProfile
Disk volumes	Get-Volume
Physical disks	Get-PhysicalDisk
Disks	Get-Disk
Partitions	Get-Partition
Event logs	Get-WinEvent
Scheduled tasks	Get-ScheduledTask
Local users	Get-LocalUser
Local groups	Get-LocalGroup
Administrators	Get-LocalGroupMember Administrators
AD users	Get-ADUser
Locked AD users	Search-ADAccount -LockedOut
RDP users	quser
SMB shares	Get-SmbShare
Permissions	Get-Acl
Defender status	Get-MpComputerStatus
Printers	Get-Printer
Devices	Get-PnpDevice
File hash	Get-FileHash
Updates	Get-HotFix
Command history	Get-History
PowerShell version	$PSVersionTable

Commands That Require Extra Caution

Some PowerShell commands should never be executed casually on a production system.

File deletion

Remove-Item

Stop process

Stop-Process

Stop service

Stop-Service

Disable user

Disable-LocalUser
Disable-ADAccount

Delete Active Directory objects

Remove-ADUser
Remove-ADGroup
Remove-ADComputer

Restart computer

Restart-Computer

Shutdown

Stop-Computer

Disk operations

Commands involving:

Clear-Disk
Format-Volume
Remove-Partition

can cause catastrophic data loss if used incorrectly.

The safest administrator is not necessarily the one who knows the most commands. It is the one who understands what will change, what could fail, how to verify the target, and how to recover if something goes wrong.

Recommended Daily PowerShell Administration Routine

A practical administrator can use PowerShell at the beginning of the day to check:

System uptime → CPU → memory → disk space → services → network → active sessions → security status → event logs → backups → application-specific services.

For example:

Get-Uptime
Get-Volume
Get-Service
Get-NetIPConfiguration
Get-NetAdapter
Get-NetTCPConnection -State Listen
Get-ScheduledTask
Get-MpComputerStatus
Get-WinEvent -FilterHashtable @{
    LogName = "System"
    Level   = 2
} -MaxEvents 20

The exact checklist should be adapted to the server's role.

A domain controller, RDS server, SQL server, web server, file server, Hyper-V host, and ordinary Windows workstation require different monitoring priorities.

PowerShell Best Practices for System Administrators

Use object-based filtering

Instead of parsing text whenever possible, use PowerShell objects:

Get-Service |
Where-Object Status -eq "Running"

Select only required information

Get-Process |
Select-Object Name, Id, CPU

Sort results

Get-Process |
Sort-Object CPU -Descending

Export reports

Get-Service |
Export-Csv "C:\Reports\Services.csv" -NoTypeInformation

Handle expected errors

Get-Process "ApplicationName" -ErrorAction SilentlyContinue

For scripts, use structured error handling where appropriate:

try {
    Get-Item "C:\Important\File.txt" -ErrorAction Stop
}
catch {
    Write-Error "Operation failed: $($_.Exception.Message)"
}

Avoid unnecessary -Force

-Force can be useful, but it should not become a default parameter for every administrative operation.

Verify before modifying

Retrieve the target first:

Get-Service Spooler

Then modify:

Restart-Service Spooler

The principle is simple:

Inspect → Verify → Change → Validate → Document

PowerShell vs Command Prompt

Command Prompt remains useful for many classic Windows utilities, but PowerShell provides significant advantages for administration.

PowerShell operates primarily with objects rather than plain text. This allows administrators to filter, sort, transform, export, automate, and remotely execute administrative operations much more effectively.

For example:

Get-Service |
Where-Object Status -eq "Running" |
Sort-Object DisplayName |
Export-Csv "C:\Temp\RunningServices.csv" -NoTypeInformation

A single pipeline retrieves information, filters it, sorts it, and generates a report.

Frequently Asked Questions

1. What is PowerShell?

PowerShell is Microsoft's command-line shell and scripting environment designed for administration, configuration, automation, and management.

2. Is PowerShell the same as Command Prompt?

No. Command Prompt primarily works with text-based command output, whereas PowerShell provides a richer object-based pipeline and scripting environment.

3. Should system administrators learn PowerShell?

Yes. PowerShell is highly valuable for Windows administration, especially when managing multiple systems, repetitive operations, reporting, Active Directory, Microsoft services, and Windows Server environments.

4. Can PowerShell damage Windows?

Yes, if destructive commands are executed incorrectly or with excessive privileges. Administrative PowerShell can modify services, registry settings, users, files, storage, networking, security controls, and other critical components.

5. How can I determine what a PowerShell command does?

Use:

Get-Help CommandName

Example:

Get-Help Restart-Service -Full

6. What does -WhatIf do?

For commands that support it, -WhatIf shows what the command would attempt to change without performing the operation.

Example:

Remove-Item "D:\OldFiles" -Recurse -WhatIf

7. How do I find a PowerShell command when I don't remember its exact name?

Use wildcards:

Get-Command *Printer*

or:

Get-Command *Firewall*

8. How do I find high-memory processes?

Get-Process |
Sort-Object WorkingSet64 -Descending |
Select-Object -First 10

9. How do I find high-CPU processes?

Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 10

Remember that the CPU property represents accumulated processor time rather than an instantaneous CPU percentage.

10. How can I check whether a server port is accessible?

Test-NetConnection SERVER01 -Port 3389

Replace the hostname and port as required.

11. How do I troubleshoot DNS?

Start with:

Resolve-DnsName example.com

Then compare against a known DNS resolver if appropriate:

Resolve-DnsName example.com -Server 8.8.8.8

12. How can I check RDP users?

quser

This is particularly useful on Remote Desktop Session Host servers.

13. How do I check disk free space?

Get-Volume

14. How do I check recent Windows errors?

Get-WinEvent -FilterHashtable @{
    LogName = "System"
    Level   = 2
} -MaxEvents 20

15. Can PowerShell manage Active Directory?

Yes. With the Active Directory module installed and appropriate permissions, PowerShell can manage users, groups, computers, organizational units, passwords, account status, and many other AD objects.

16. Can PowerShell manage remote computers?

Yes. PowerShell remoting supports remote administration using commands such as:

Enter-PSSession
Invoke-Command

Remote management must be properly configured and secured.

17. Can PowerShell generate reports?

Yes. PowerShell can export information to formats such as CSV, JSON, XML, text, and HTML.

Example:

Get-Service |
Export-Csv "C:\Temp\Services.csv" -NoTypeInformation

18. Is PowerShell useful for RDS administrators?

Very much so. It can assist with process monitoring, services, event logs, storage, networking, sessions, scheduled tasks, security checks, and automated health reports.

19. Should administrators disable security services to improve performance?

Generally, no. Disabling security controls creates unnecessary risk. Administrators should identify the actual resource bottleneck and configure supported exclusions or policies where justified.

20. What is the most important PowerShell precaution?

Know exactly what objects the command will affect before allowing it to modify them.

For production administration, a good rule is:

Inspect first. Test second. Execute third. Verify afterward.

Conclusion

PowerShell becomes especially valuable when an administrator moves beyond individual commands and starts combining them into repeatable administrative workflows.

Commands such as:

Get-Process
Get-Service
Get-WinEvent
Get-NetIPConfiguration
Test-NetConnection
Resolve-DnsName
Get-Volume
Get-ScheduledTask
Get-LocalUser
Get-ADUser
Get-SmbShare
Get-MpComputerStatus

can provide an administrator with a substantial amount of operational visibility from a single console.

The next level is automation: instead of manually checking CPU, RAM, disk space, services, RDP sessions, event logs, DNS, network connectivity, security status, and system health separately, administrators can combine those checks into a standardized PowerShell health-check script that produces a report for every workstation or server.

The objective should not be to memorize hundreds of PowerShell commands. A professional administrator should understand how to discover commands, inspect objects, filter information, make controlled changes, validate results, automate repetitive work, and protect production systems from mistakes.

 

#PowerShell #WindowsPowerShell #SystemAdministrator #SysAdmin #WindowsAdmin #WindowsServer #Windows11 #Windows10 #ITAdmin #ITSupport #PowerShellCommands #PowerShellScripting #PowerShellAutomation #WindowsAutomation #ServerAdministration #SystemAdministration #WindowsTroubleshooting #ServerTroubleshooting #NetworkTroubleshooting #NetworkAdmin #ActiveDirectory #ADAdmin #WindowsSecurity #MicrosoftDefender #WindowsFirewall #RDS #RemoteDesktop #RemoteAdministration #PowerShellRemoting #ServerManagement #ServerMonitoring #WindowsMonitoring #ITInfrastructure #ITOperations #TechSupport #DNS #Networking #EventViewer #WindowsServices #ProcessManagement #DiskManagement #StorageManagement #UserManagement #FileServer #SMB #NTFS #ITSecurity #PowerShellTips #WindowsTips #TechKnowledge