PowerShell quick help
Everyday commands for checking and repairing Windows. Type to filter, pick a topic, or click a column heading to sort. "Elevated" means a PowerShell window opened with Run as administrator.
| Topic | Command | What it does | Example | Elevated? |
|---|---|---|---|---|
| Getting around | Get-Help | Shows help for a command. Add -Examples for short worked examples, -Online to open the web page. | Get-Help Get-Service -Examples | No |
| Getting around | Get-Command | Finds commands by name or by the noun they work on. | Get-Command *Service* | No |
| Getting around | Get-Member | Lists the properties and methods of whatever you pipe in. Use it to learn what you can ask an object for. | Get-Service | Get-Member | No |
| Getting around | Start-Process -Verb RunAs | Opens a program in an elevated window. Use it to get an administrator PowerShell from a normal one. | Start-Process powershell -Verb RunAs | No |
| Getting around | Start-Transcript | Records everything you type and see to a text file. Stop with Stop-Transcript. | Start-Transcript -Path $env:TEMP\session.log | No |
| Shaping output | Where-Object | Keeps only the items that pass a test. | Get-Service | Where-Object Status -eq Running | No |
| Shaping output | Select-Object | Picks columns, or the first or last few items. | Get-Process | Select-Object -First 5 Name, Id | No |
| Shaping output | Sort-Object | Sorts by one or more properties. -Descending reverses the order. | Get-Process | Sort-Object CPU -Descending | No |
| Shaping output | Measure-Object | Counts items, or adds up a number property. | Get-ChildItem -Recurse -File | Measure-Object Length -Sum | No |
| Shaping output | Format-Table | Shows results as a table. -AutoSize fits the columns to the data. | Get-Service | Format-Table Name, Status -AutoSize | No |
| Shaping output | Export-Csv | Saves objects to a CSV file you can open in a spreadsheet. | Get-Service | Export-Csv services.csv -NoTypeInformation | No |
| Services | Get-Service | Lists services and whether they are running. Wildcards work in the name. | Get-Service wuauserv | No |
| Services | Start-Service | Starts a stopped service. | Start-Service wuauserv | Yes |
| Services | Stop-Service | Stops a running service. -Force also stops services that depend on it. | Stop-Service wuauserv | Yes |
| Services | Restart-Service | Stops a service and starts it again. | Restart-Service wuauserv | Yes |
| Services | Set-Service | Changes how a service starts: Automatic, Manual or Disabled. | Set-Service wuauserv -StartupType Manual | Yes |
| Processes | Get-Process | Lists running programs with their CPU time and memory. | Get-Process | Sort-Object WS -Descending | Select-Object -First 10 | No |
| Processes | Stop-Process | Ends a program. Use the Id from Get-Process when more than one has the same name. | Stop-Process -Id 1234 | Sometimes |
| Event logs | Get-WinEvent | Reads the Windows event logs. Without a filter it reads everything, so limit it. | Get-WinEvent -LogName System -MaxEvents 20 | Sometimes |
| Event logs | Get-WinEvent -FilterHashtable | The fast way to filter events: by log, level (2 is Error, 3 is Warning) and start time. | Get-WinEvent -FilterHashtable @{LogName='System'; Level=2; StartTime=(Get-Date).AddDays(-1)} | Sometimes |
| Event logs | Get-WinEvent -ListLog | Lists the logs on the computer with their size and record count. | Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0 | Sometimes |
| Network | Test-NetConnection | Checks whether a computer answers and whether a TCP port is open. | Test-NetConnection server01 -Port 443 | No |
| Network | Resolve-DnsName | Looks up a name in DNS. -Type picks the record type. | Resolve-DnsName example.com -Type A | No |
| Network | Get-NetIPConfiguration | Shows each network adapter with its address, gateway and DNS servers. | Get-NetIPConfiguration | No |
| Network | Get-NetAdapter | Lists network adapters and their link state and speed. | Get-NetAdapter | Where-Object Status -eq Up | No |
| Network | Get-NetTCPConnection | Lists TCP connections and listening ports, with the owning process id. | Get-NetTCPConnection -State Listen | Sort-Object LocalPort | No |
| Network | Clear-DnsClientCache | Empties the local DNS cache after a record has changed. | Clear-DnsClientCache | Yes |
| Disks and storage | Get-Volume | Lists volumes with free space, file system and health. | Get-Volume | Select-Object DriveLetter, FileSystem, SizeRemaining, Size | No |
| Disks and storage | Get-PhysicalDisk | Shows each physical disk's health and operational status. | Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus | No |
| Disks and storage | Repair-Volume -Scan | Scans a volume for file system errors while it is in use. Reports problems and changes nothing. | Repair-Volume -DriveLetter C -Scan | Yes |
| Updates and servicing | Get-HotFix | Lists installed updates. Give an id to check for one update. | Get-HotFix -Id KB5000000 | No |
| Updates and servicing | Get-WindowsUpdateLog | Turns the binary Windows Update logs into one readable text file (default: WindowsUpdate.log on the desktop). | Get-WindowsUpdateLog -LogPath $env:TEMP\WindowsUpdate.log | Yes |
| Updates and servicing | Repair-WindowsImage -ScanHealth | Looks for corruption in the component store (the DISM scan). Changes nothing. | Repair-WindowsImage -Online -ScanHealth | Yes |
| Updates and servicing | Repair-WindowsImage -RestoreHealth | Repairs the component store, using Windows Update as the source unless you give one. Can take a long time. | Repair-WindowsImage -Online -RestoreHealth | Yes |
| Updates and servicing | sfc /scannow | Checks system files against the component store and replaces damaged ones. A program, not a cmdlet. Run it after the repair above. | sfc /scannow | Yes |
| Updates and servicing | Get-WindowsOptionalFeature | Lists Windows features and whether they are enabled. | Get-WindowsOptionalFeature -Online | Where-Object State -eq Enabled | Yes |
| Files and permissions | Get-ChildItem | Lists files and folders. -Recurse goes into subfolders, -File skips folders. | Get-ChildItem C:\Windows\Logs -Recurse -File | Sort-Object Length -Descending | Select-Object -First 10 | No |
| Files and permissions | Get-Content | Reads a text file. -Tail shows the last lines and -Wait keeps following a log as it grows. | Get-Content C:\Windows\Logs\CBS\CBS.log -Tail 50 | Sometimes |
| Files and permissions | Select-String | Searches text files for a word or pattern and shows the matching lines. | Select-String -Path C:\Windows\Logs\CBS\CBS.log -Pattern 'Error' | Sometimes |
| Files and permissions | Get-Acl | Shows who owns a file or folder and who may use it. | Get-Acl C:\Windows\WinSxS | Format-List | No |
| Files and permissions | Get-FileHash | Computes a file's checksum, to check a download against the published value. | Get-FileHash .\file.iso -Algorithm SHA256 | No |
| Files and permissions | Test-Path | Says whether a file, folder or registry key exists. | Test-Path C:\Windows\SoftwareDistribution | No |
| This computer | Get-ComputerInfo | Reports Windows edition, version, build, uptime, memory and more in one object. | Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber | No |
| This computer | Get-CimInstance | Reads system information from WMI classes, such as the operating system or the BIOS. | Get-CimInstance Win32_OperatingSystem | Select-Object Caption, LastBootUpTime | No |
| This computer | Get-ItemProperty (registry) | Reads registry values. The HKLM: and HKCU: drives work like folders. | Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object ProductName, CurrentBuild, UBR | No |
| This computer | Restart-Computer | Restarts the computer. -Force closes programs without asking. | Restart-Computer | Yes |
| This computer | Get-LocalGroupMember | Lists who is in a local group, for example Administrators. | Get-LocalGroupMember -Group Administrators | Yes |
| Remote computers | Test-WSMan | Checks that a computer accepts PowerShell remoting (WinRM, port 5985). | Test-WSMan server01 | No |
| Remote computers | Enter-PSSession | Opens an interactive prompt on another computer. Leave with Exit-PSSession. | Enter-PSSession -ComputerName server01 | Sometimes |
| Remote computers | Invoke-Command | Runs a command on one or more computers and brings the results back. | Invoke-Command -ComputerName server01 -ScriptBlock { Get-Service wuauserv } | Sometimes |
| Scripts and safety | Get-ExecutionPolicy | Shows which scripts PowerShell will run. -List shows each scope. | Get-ExecutionPolicy -List | No |
| Scripts and safety | Set-ExecutionPolicy -Scope Process | Lets scripts run in this window only; it ends when you close it. A guard against mistakes, not a security boundary. | Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass | No |
| Scripts and safety | Unblock-File | Removes the downloaded-from-the-internet mark from a script you have checked. | Unblock-File .\script.ps1 | No |
| Scripts and safety | Get-AuthenticodeSignature | Shows whether a script is signed and whether the signature is valid. | Get-AuthenticodeSignature .\script.ps1 | No |