← PowerShell Troubleshooting Guides
PowerShell Command Reference

100+ PowerShell Commands A-Z for Windows Administration & Troubleshooting

A practical PowerShell reference covering command discovery, files, folders, processes, Windows services, system information, networking, DNS, TCP connections, storage, event logs, users, scheduled tasks, registry, security and Microsoft Defender.

Before Running PowerShell Commands

Some commands only display information, while others can modify, stop, remove or delete Windows resources.

Read the purpose of a command before running it. Commands that change services, network settings, registry values, permissions, users, drivers or files may require Administrator privileges.

Some commands are available only when the required Windows or PowerShell module is installed.

WMIC to PowerShell Replacements

If WMIC is missing or no longer recognized in Windows 11, use modern PowerShell CIM commands instead.

View WMIC to PowerShell Commands

PowerShell Command Categories

1. PowerShell Help & Command Discovery

Get-Help

Use: Read help for a PowerShell command.

Get-Help Get-Process

Get-Help -Examples

Use: Show examples for a command.

Get-Help Get-Service -Examples

Get-Help -Full

Use: Display full help information.

Get-Help Get-ChildItem -Full

Update-Help

Use: Download updated PowerShell help files where supported.

Update-Help

Get-Command

Use: List available PowerShell commands.

Get-Command

Get-Command *network*

Use: Find commands containing a word.

Get-Command *network*

Get-Module

Use: Display currently loaded PowerShell modules.

Get-Module

Get-Module -ListAvailable

Use: Show installed modules available to PowerShell.

Get-Module -ListAvailable

Import-Module

Use: Load a PowerShell module.

Import-Module NetTCPIP

Get-Alias

Use: Show PowerShell aliases.

Get-Alias

2. Pipeline, Filtering & Output Commands

Where-Object

Use: Filter PowerShell objects.

Get-Service | Where-Object Status -eq "Running"

Select-Object

Use: Select specific properties from objects.

Get-Process | Select-Object Name, Id, CPU

Sort-Object

Use: Sort output.

Get-Process | Sort-Object CPU -Descending

Measure-Object

Use: Count or calculate values from objects.

Get-Process | Measure-Object

ForEach-Object

Use: Perform an action for each pipeline object.

Get-Service | ForEach-Object { $_.Name }

Format-Table

Use: Display output as a table.

Get-Service | Format-Table -AutoSize

Format-List

Use: Display object properties vertically.

Get-Service Spooler | Format-List *

Out-File

Use: Save command output to a text file.

Get-Process | Out-File C:\Temp\processes.txt

Export-Csv

Use: Export objects to CSV.

Get-Process | Export-Csv C:\Temp\processes.csv -NoTypeInformation

ConvertTo-Json

Use: Convert PowerShell objects into JSON.

Get-Service | Select-Object -First 5 | ConvertTo-Json

3. PowerShell Files & Folders Commands

Get-ChildItem

Use: List files and folders.

Get-ChildItem C:\Users

Get-ChildItem -Recurse

Use: Search folders recursively.

Get-ChildItem C:\Temp -Recurse

Get-Item

Use: Display a specific file, folder or provider item.

Get-Item C:\Windows

New-Item

Use: Create a new file, folder or other provider item.

New-Item -Path C:\Temp\TestFolder -ItemType Directory

Copy-Item

Use: Copy files or folders.

Copy-Item C:\Temp\file.txt D:\Backup\file.txt

Move-Item

Use: Move a file or folder.

Move-Item C:\Temp\file.txt D:\Backup\

Rename-Item

Use: Rename a file or folder.

Rename-Item C:\Temp\old.txt new.txt

Remove-Item

Use: Delete a file, folder or supported provider item.

Remove-Item C:\Temp\old.txt

Caution: Verify the path before using Remove-Item.

Test-Path

Use: Check whether a path exists.

Test-Path C:\Windows

Get-Content

Use: Read the contents of a text file.

Get-Content C:\Temp\log.txt

Set-Content

Use: Write or replace file content.

Set-Content C:\Temp\test.txt "Hello World"

Add-Content

Use: Append content to a file.

Add-Content C:\Temp\test.txt "New line"

Clear-Content

Use: Remove file content without deleting the file.

Clear-Content C:\Temp\test.txt

Get-FileHash

Use: Calculate a cryptographic hash for a file.

Get-FileHash C:\Downloads\file.exe -Algorithm SHA256

Get-Location

Use: Show the current PowerShell location.

Get-Location

Set-Location

Use: Change the current directory.

Set-Location C:\Windows

4. PowerShell Process Commands

Get-Process

Use: Show running processes.

Get-Process

Get-Process -Id

Use: Find a process by PID.

Get-Process -Id 1234

Get-Process by Name

Use: Find a process by executable name.

Get-Process chrome

Stop-Process

Use: Stop a running process.

Stop-Process -Id 1234

Stop-Process -Force

Use: Force a process to stop.

Stop-Process -Id 1234 -Force

Start-Process

Use: Start an application or executable.

Start-Process notepad.exe

Start-Process as Administrator

Use: Start a process elevated.

Start-Process powershell.exe -Verb RunAs

5. Windows Service Commands

Get-Service

Use: List Windows services.

Get-Service

Get-Service Spooler

Use: Check the Print Spooler service.

Get-Service Spooler

Start-Service

Use: Start a Windows service.

Start-Service Spooler

Stop-Service

Use: Stop a Windows service.

Stop-Service Spooler

Restart-Service

Use: Restart a service.

Restart-Service Spooler

Set-Service

Use: Change supported service settings.

Set-Service Spooler -StartupType Automatic

6. Computer & Windows System Information

Get-ComputerInfo

Use: Display detailed computer and Windows information.

Get-ComputerInfo

Get-CimInstance Win32_OperatingSystem

Use: Display operating-system details.

Get-CimInstance Win32_OperatingSystem

Get-CimInstance Win32_ComputerSystem

Use: Display computer manufacturer, model and memory information.

Get-CimInstance Win32_ComputerSystem

Get-CimInstance Win32_BIOS

Use: Display BIOS information.

Get-CimInstance Win32_BIOS

Get Computer Serial Number

Use: Retrieve the serial number stored in BIOS/firmware.

(Get-CimInstance Win32_BIOS).SerialNumber

Get-CimInstance Win32_Processor

Use: Display CPU information.

Get-CimInstance Win32_Processor

Get-CimInstance Win32_PhysicalMemory

Use: Show physical RAM module information.

Get-CimInstance Win32_PhysicalMemory

Get-Date

Use: Display current system date and time.

Get-Date

Get-TimeZone

Use: Show the configured Windows time zone.

Get-TimeZone

7. PowerShell Network Troubleshooting Commands

Test-Connection

Use: Test basic network connectivity using ICMP.

Test-Connection 8.8.8.8 -Count 4

Test-NetConnection

Use: Test connectivity and collect network diagnostic information.

Test-NetConnection google.com

Test a TCP Port

Use: Check whether a remote TCP port can be reached.

Test-NetConnection google.com -Port 443

Get-NetAdapter

Use: List Windows network adapters.

Get-NetAdapter

Get-NetAdapterStatistics

Use: Show network adapter packet and byte statistics.

Get-NetAdapterStatistics

Get-NetIPAddress

Use: Show IPv4 and IPv6 address configuration.

Get-NetIPAddress

Get-NetIPConfiguration

Use: Show interface, IP address, gateway and DNS information.

Get-NetIPConfiguration

Get-NetRoute

Use: Display the Windows IP routing table.

Get-NetRoute

Get-NetTCPConnection

Use: Show current TCP connections.

Get-NetTCPConnection

Show Established TCP Connections

Use: Filter for active established TCP sessions.

Get-NetTCPConnection -State Established

Get-NetUDPEndpoint

Use: Show local UDP endpoints.

Get-NetUDPEndpoint

Get-NetConnectionProfile

Use: Display Windows network profile information.

Get-NetConnectionProfile

8. PowerShell DNS Troubleshooting Commands

Resolve-DnsName

Use: Perform a DNS lookup.

Resolve-DnsName unitechlk.com

Resolve-DnsName A Record

Use: Query IPv4 DNS records.

Resolve-DnsName unitechlk.com -Type A

Resolve-DnsName MX

Use: Check mail-exchanger records for a domain.

Resolve-DnsName example.com -Type MX

Get-DnsClientServerAddress

Use: Display DNS servers configured on network interfaces.

Get-DnsClientServerAddress

Clear-DnsClientCache

Use: Clear the Windows DNS client resolver cache.

Clear-DnsClientCache

9. PowerShell Disk & Storage Commands

Get-Volume

Use: Show Windows volumes and available storage.

Get-Volume

Get-Disk

Use: Display disks visible to Windows.

Get-Disk

Get-Partition

Use: Display disk partitions.

Get-Partition

Get-PhysicalDisk

Use: Display physical disk information where supported.

Get-PhysicalDisk

Get-PSDrive

Use: Show PowerShell drives and free/used space where supported.

Get-PSDrive -PSProvider FileSystem

Check C Drive Free Space

Use: Display free and used space for the C drive.

Get-PSDrive C

Find Large Files

Use: Find the largest files under a folder.

Get-ChildItem C:\Users -File -Recurse -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 20 FullName, Length

Measure Folder File Size

Use: Calculate the combined size of files under a folder.

(Get-ChildItem C:\Temp -File -Recurse -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum

Get Storage-Specific CIM Information

Use: Query logical disk information.

Get-CimInstance Win32_LogicalDisk

10. Windows Event Log Commands

Get-WinEvent

Use: Read Windows event logs.

Get-WinEvent -LogName System -MaxEvents 20

Application Events

Use: Read recent Application log events.

Get-WinEvent -LogName Application -MaxEvents 20

Security Events

Use: Read Security log events when permissions allow.

Get-WinEvent -LogName Security -MaxEvents 20

Filter Error Events

Use: Search recent System errors.

Get-WinEvent -FilterHashtable @{ LogName='System' Level=2 } -MaxEvents 50

Get-EventLog

Use: Older Windows PowerShell event-log command.

Get-EventLog -LogName System -Newest 20

11. Windows Local User & Group Commands

Get-LocalUser

Use: Show local user accounts.

Get-LocalUser

Get-LocalGroup

Use: Show local Windows groups.

Get-LocalGroup

Get-LocalGroupMember

Use: Display members of a local group.

Get-LocalGroupMember Administrators

New-LocalUser

Use: Create a local Windows user account.

$Password = Read-Host -AsSecureString New-LocalUser -Name "TestUser" -Password $Password

Add-LocalGroupMember

Use: Add an account to a local group.

Add-LocalGroupMember -Group "Users" -Member "TestUser"

Disable-LocalUser

Use: Disable a local Windows user.

Disable-LocalUser -Name "TestUser"

12. Windows Scheduled Task Commands

Get-ScheduledTask

Use: List Windows scheduled tasks.

Get-ScheduledTask

Get-ScheduledTaskInfo

Use: Show runtime information about a scheduled task.

Get-ScheduledTask -TaskName "TaskName" | Get-ScheduledTaskInfo

Start-ScheduledTask

Use: Manually start a scheduled task.

Start-ScheduledTask -TaskName "TaskName"

Stop-ScheduledTask

Use: Stop a running scheduled task.

Stop-ScheduledTask -TaskName "TaskName"

13. PowerShell Registry Commands

Get-ChildItem Registry

Use: Browse registry keys using the PowerShell registry provider.

Get-ChildItem HKLM:\SOFTWARE

Get-ItemProperty

Use: Read registry values or other item properties.

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

Set-ItemProperty

Use: Change a registry or supported provider property.

Set-ItemProperty -Path "HKCU:\Software\Test" -Name "Value" -Value "Example"

New-Item Registry Key

Use: Create a new registry key.

New-Item -Path "HKCU:\Software\Test"

New-ItemProperty

Use: Create a registry value.

New-ItemProperty -Path "HKCU:\Software\Test" -Name "Setting" -Value 1

Remove-ItemProperty

Use: Remove a registry value.

Remove-ItemProperty -Path "HKCU:\Software\Test" -Name "Setting"

14. PowerShell Security & Permission Commands

Get-Acl

Use: Read access-control information for a file, folder or other supported item.

Get-Acl C:\Temp

Set-Acl

Use: Apply an ACL to a supported item.

Set-Acl -Path C:\Temp -AclObject $Acl

Set-Acl can change permissions. Use only after reviewing the ACL.

Get-AuthenticodeSignature

Use: Check the Authenticode signature of a file.

Get-AuthenticodeSignature C:\Downloads\file.exe

Get-ExecutionPolicy

Use: Display the current PowerShell execution policy.

Get-ExecutionPolicy -List

15. Microsoft Defender PowerShell Commands

Update-MpSignature

Use: Update Microsoft Defender security intelligence.

Update-MpSignature

Quick Scan

Use: Start a Microsoft Defender Quick Scan.

Start-MpScan -ScanType QuickScan

Full Scan

Use: Start a Microsoft Defender Full Scan.

Start-MpScan -ScanType FullScan

Offline Scan

Use: Start Microsoft Defender Offline Scan.

Start-MpWDOScan

Get-MpComputerStatus

Use: Display Microsoft Defender protection status.

Get-MpComputerStatus

Get-MpThreat

Use: Review threat information known to Microsoft Defender.

Get-MpThreat

Get-MpThreatDetection

Use: Review Microsoft Defender threat-detection history.

Get-MpThreatDetection

Get-MpPreference

Use: Display Microsoft Defender preferences.

Get-MpPreference

For the complete UniTech LK Defender tutorial:

Microsoft Defender PowerShell Guide

16. PowerShell Remote Administration Commands

Test-WSMan

Use: Test whether the WS-Management service is responding.

Test-WSMan ComputerName

Enter-PSSession

Use: Start an interactive PowerShell remote session when remoting is configured.

Enter-PSSession -ComputerName Server01

Exit-PSSession

Use: Leave an interactive remote PowerShell session.

Exit-PSSession

Invoke-Command

Use: Run PowerShell commands on a remote computer when remoting is configured.

Invoke-Command -ComputerName Server01 -ScriptBlock { Get-Service }

New-PSSession

Use: Create a persistent remote PowerShell session.

$Session = New-PSSession -ComputerName Server01

Remove-PSSession

Use: Close a persistent PowerShell session.

Remove-PSSession $Session

17. Useful PowerShell Utility Commands

Clear-Host

Use: Clear the PowerShell console display.

Clear-Host

Read-Host

Use: Prompt the user for input.

$Name = Read-Host "Enter your name"

Write-Host

Use: Write information directly to the host display.

Write-Host "PowerShell Test"

Write-Output

Use: Send objects or values into the PowerShell output pipeline.

Write-Output "PowerShell Test"

Get-History

Use: Display commands from the current PowerShell session history.

Get-History

Clear-History

Use: Clear the in-session PowerShell command history list.

Clear-History

Start-Transcript

Use: Record a PowerShell session to a text transcript.

Start-Transcript -Path C:\Temp\powershell-session.txt

Stop-Transcript

Use: Stop recording the current PowerShell transcript.

Stop-Transcript

Get-Clipboard

Use: Read supported clipboard content.

Get-Clipboard

Set-Clipboard

Use: Put text or supported content on the clipboard.

"UniTech LK" | Set-Clipboard

Common PowerShell Commands People Search For

PowerShell Commands Frequently Asked Questions

How do I find a PowerShell command?

Use Get-Command to list available commands. You can also use wildcards to search for a command by keyword.

How do I learn what a PowerShell command does?

Use Get-Help followed by the command name. Add -Examples to see usage examples where help content is available.

Do PowerShell commands work on Windows 11?

Many PowerShell commands work on Windows 11, but availability depends on the PowerShell edition, Windows version and installed modules.

Can PowerShell troubleshoot network problems?

Yes. Commands such as Test-Connection, Test-NetConnection, Get-NetAdapter, Get-NetIPAddress, Get-NetIPConfiguration and Resolve-DnsName can help investigate Windows network problems.

Can PowerShell scan for malware?

On supported Windows systems, Microsoft Defender exposes PowerShell commands for updating security intelligence, starting scans and reviewing protection information.

Should I run every PowerShell command as Administrator?

No. Use elevation only when the operation requires administrative privileges. Information-gathering commands often do not require it.

Related UniTech LK PowerShell Guides

← Back to PowerShell Troubleshooting Guides