PowerShell is the standard way to manage Windows Server: everything the GUI does (and much more) can be done from the command line, scripted, and repeated across servers. Unlike traditional shells that pass text, PowerShell passes objects, which makes filtering and formatting powerful. This guide covers the essentials for server admins.

Cmdlets: Verb-Noun

PowerShell commands (cmdlets) follow a Verb-Noun pattern:

Get-Service
Start-Service -Name W3SVC
Stop-Process -Name notepad
New-Item -Path C:\Logs -ItemType Directory

Common verbs: Get, Set, New, Remove, Start, Stop, Restart, Enable, Disable, Test.

Finding help and commands

Get-Command *firewall*                  # find commands
Get-Help Get-Service -Examples          # examples
Update-Help                             # download full help (run as admin)
Get-Service | Get-Member                # properties and methods of the output

The pipeline passes objects

Get-Service | Where-Object Status -eq 'Running' | Sort-Object DisplayName | Select-Object Name, DisplayName
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WS
  • Where-Object filters.
  • Sort-Object sorts.
  • Select-Object picks properties, or the first N items.
  • Format-Table / Format-List control display (use them only at the end of the pipeline).

Everyday server tasks

Services:

Get-Service -Name W3SVC, MSSQLSERVER
Restart-Service -Name W3SVC
Set-Service -Name Spooler -StartupType Disabled

Processes:

Get-Process | Sort-Object WS -Descending | Select-Object -First 5
Stop-Process -Id 1234 -Force

Files and folders:

Get-ChildItem C:\inetpub\logs -Recurse -Filter *.log | Where-Object LastWriteTime -lt (Get-Date).AddDays(-30) | Remove-Item
Copy-Item C:\Sites\app -Destination D:\Backup\app -Recurse
Get-Content C:\Logs\app.log -Tail 50 -Wait          # like tail -f

Disk and system info:

Get-Volume
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, LastBootUpTime
Get-ComputerInfo -Property CsName, OsName, OsTotalVisibleMemorySize

Network:

Get-NetIPAddress -AddressFamily IPv4
Test-NetConnection example.com -Port 443
Resolve-DnsName example.com

Event logs:

Get-WinEvent -LogName System -MaxEvents 20
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20   # failed logons

See Windows Event Viewer errors and Windows Server logon auditing.

Variables, loops and conditions

$sites = 'example.com', 'example.org'
foreach ($s in $sites) {
    $r = Test-NetConnection $s -Port 443
    if (-not $r.TcpTestSucceeded) { Write-Warning "$s is unreachable" }
}

Scripts and execution policy

Save commands in a .ps1 file, and run it with .\script.ps1. Windows Server’s default execution policy (RemoteSigned) lets local scripts run, but requires downloaded scripts to be signed:

Get-ExecutionPolicy
Unblock-File .\downloaded-script.ps1     # after reviewing it

Schedule scripts with Task Scheduler (Register-ScheduledTask) for backups, cleanups and reports.

Modules

Get-Module -ListAvailable
Install-Module -Name PSWindowsUpdate        # from the PowerShell Gallery

See Windows Update with PowerShell.

Windows PowerShell 5.1 vs PowerShell 7

Windows Server includes Windows PowerShell 5.1. PowerShell 7 (cross-platform, faster, newer features) installs side by side as pwsh. Most admin modules work in both. Use 7 for new scripts where possible.

Aliases and habits from other shells

PowerShell includes aliases, so familiar commands work: ls and dir map to Get-ChildItem, cat to Get-Content, cd to Set-Location, ps to Get-Process, and cp, mv and rm to the matching *-Item cmdlets. They’re handy at the prompt. In scripts, write the full cmdlet names, so others (and future you) can read them easily. Get-Alias lists them all.

Parameters work differently from Unix tools: they’re named (-Path, -Recurse, -Force), can be shortened as long as they stay unique, and tab completion fills them in. Press Tab after a dash to cycle through a cmdlet’s parameters.

Common mistakes

  • Formatting too early: Format-Table turns objects into display text. Put it last, after filtering and sorting.
  • Comparing with =: use -eq, -ne, -gt, -lt, -like and -match in conditions. = assigns a value.
  • Not running as administrator: many system cmdlets fail with “Access denied” in a normal session. Open PowerShell with “Run as administrator”.
  • Quoting: single quotes are literal, double quotes expand variables ("Host: $env:COMPUTERNAME").
  • Destructive commands without a test run: add -WhatIf to see what Remove-Item, Stop-Service and similar cmdlets would do, before running them for real.

Quick reference

Task Cmdlet
Find commands Get-Command *name*
Help Get-Help <cmdlet> -Examples
Services Get-Service, Restart-Service
Processes Get-Process, Stop-Process
Files Get-ChildItem, Copy-Item, Remove-Item
Network test Test-NetConnection host -Port 443
Logs Get-WinEvent

Related: PowerShell remoting and Windows Server firewall with PowerShell.

  • PowerShell
  • Windows Server
  • Scripting