🖥️ PowerShell cheat sheet

Without -Full you get a short summary. Add -Online to open the up-to-date web page instead, or -Examples for just the example section.

Example

Get-Help Get-ChildItem -Examples

Options

Wildcards work on both sides. Use -Noun or -Verb to search by one part of a Verb-Noun name.

Example

Get-Command -Verb Get -Noun Service

Options

Everything in PowerShell is an object, not text, so Get-Member is the main way to discover what you can do with a result before writing the rest of a script.

Example

Get-Process | Get-Member -MemberType Property

Options

Help files are not included by default on a fresh install. Run this once (as Administrator) so Get-Help and -Online have real content.

Controls whether .ps1 scripts are allowed to run at all. Change it with Set-ExecutionPolicy, most safely at the CurrentUser scope.

Example

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Options

A profile script runs automatically at the start of every session, a common place for aliases, functions and module imports. PowerShell 7 and Windows PowerShell 5.1 use separate profile files, so settings do not carry over automatically.

Example

notepad $PROFILE

Works on the file system, but also on other PowerShell drives such as the registry (HKLM:\) or environment variables (Env:\).

Example

Get-ChildItem -Recurse -Filter *.log | Select-Object -First 10

Options

Also works on non-filesystem drives, which is how you “cd” into the registry.

Example

Set-Location -Path HKLM:\SOFTWARE

Options

Moving to a new name in the same folder is how you rename something.

Options

Example

New-Item -Path .\notes.txt -ItemType File

Options

The usual guard before reading a file or creating one only if it is missing.

Example

if (-not (Test-Path .\out)) { New-Item -ItemType Directory .\out }

Example

Get-Content .\app.log -Tail 20 -Wait

Options

Add-Content appends instead of replacing. Out-File is similar but designed to receive pipeline output rather than a -Value string.

Options

Example

Get-Process | Select-Object Name, CPU -First 5

Options

$_ refers to the current object. A simplified syntax also works for simple comparisons: Where-Object CPU -gt 10.

Example

Get-Process | Where-Object { $_.CPU -gt 10 }

Example

Get-ChildItem | Sort-Object Length -Descending

Options

Different from the foreach statement (foreach ($x in $list) {}): ForEach-Object processes one item at a time as it arrives in the pipeline, which uses much less memory for large collections.

Example

Get-ChildItem *.txt | ForEach-Object { Rename-Item $_ ($_.Name + ".bak") }

Example

Get-Process | Group-Object Company | Sort-Object Count -Descending

Example

Get-ChildItem *.log | Measure-Object -Property Length -Sum

Options

Only for display: the output becomes text, so do not pipe it into another cmdlet that expects objects. Format-List shows one property per line instead, better for objects with many properties.

Options

Example

Get-Process | Select-Object Name, Id | ConvertTo-Json -Depth 3

Options

-NoTypeInformation drops the #TYPE header line. On PowerShell 7 it is the default and the switch is unnecessary, but harmless to include for scripts shared with Windows PowerShell 5.1.

Example

Get-Process | Export-Csv processes.csv -NoTypeInformation

Example

Get-Process -Name chrome | Sort-Object CPU -Descending

Options

Options

Example

Get-Service -Name wuauserv

Options

Start-Service and Stop-Service do the same for just starting or stopping. Requires an elevated session for most system services.

Get-WinEvent replaces the older Get-EventLog, which only reads classic logs and is not available in PowerShell 7 on non-Windows systems (and is deprecated even on Windows).

Example

Get-WinEvent -FilterHashtable @{ LogName = "Security"; Id = 4625 } -MaxEvents 20

Options

Options

Windows-only. For driver and feature update history, Windows Update's own history view is more complete than Get-HotFix.

Variable names are not case-sensitive. No declaration keyword is needed; the first assignment creates it.

Example

$count = 5
$name = "web-server-01"

For a property or expression, wrap it: "Count is $($list.Count)". Single-quoted strings are literal and never interpolate.

Example

"Server $name has $count cores"

Comparison uses operators like -eq, -ne, -gt, -lt, -like and -match, not ==, !=, >, <, which PowerShell parses differently (as redirection in some contexts).

Example

if ($count -gt 10) { "many" } elseif ($count -gt 0) { "some" } else { "none" }

For very large or streamed input, ForEach-Object in a pipeline is usually more memory-efficient.

Example

foreach ($file in Get-ChildItem *.log) { Write-Host $file.Name }

Community convention is an approved Verb-Noun name (see Get-Verb) so your function behaves like a built-in cmdlet and is easy to discover.

Example

function Get-FileAge {
  param([string]$Path)
  (Get-Date) - (Get-Item $Path).LastWriteTime
}

Only catches terminating errors. Many cmdlets write non-terminating errors instead; add -ErrorAction Stop to force a cmdlet call to throw one that try/catch can catch.

Example

try {
  Get-Item nonexistent.txt -ErrorAction Stop
} catch {
  Write-Warning $_.Exception.Message
}

Case-insensitive by default for strings. Prefix with c for case-sensitive (-ceq) or i to be explicit about case-insensitive (-ieq).

Options

Get-Module -ListAvailable shows every module PowerShell can find, including built-in ones; Get-InstalledModule is scoped to what you installed yourself.

Options

Most modules auto-load the first time one of their commands is used, so this is mainly needed for modules that do not support auto-loading, or to load a specific version.

Requires PowerShell Remoting to be enabled on the target (Enable-PSRemoting) and, usually, administrative rights there. On the target machine the script runs under Windows PowerShell 5.1 unless the target also has PowerShell 7 remoting configured.

Example

Invoke-Command -ComputerName srv01 -ScriptBlock { Get-Service -Name wuauserv }

Options

Exit-PSSession or exit returns to the local session. For running the same command on many computers at once, Invoke-Command is usually a better fit than looping Enter-PSSession.

Pass the result to a cmdlet's -Credential parameter. The password is stored as a SecureString in memory, not as plain text, but it is still decrypted when the target cmdlet uses it.

Example

$cred = Get-Credential
Invoke-Command -ComputerName srv01 -Credential $cred -ScriptBlock { whoami }