Command Reference¶
A-Z reference of the most commonly used PowerShell cmdlets. Each entry shows the syntax, key parameters, and a quick example.
Use the search bar (S) to jump straight to any cmdlet.
A¶
Add-Content¶
Appends content to a file without overwriting it.
Add-Content [-Path] <string[]> [-Value] <Object[]>
# Example:
Add-Content .\log.txt "$(Get-Date) - Application started"
Add-Member¶
Adds a property or method to an object.
Add-Member -InputObject <psobject> -MemberType <PSMemberTypes> -Name <string> -Value <Object>
# Example:
$proc = Get-Process pwsh
$proc | Add-Member -MemberType NoteProperty -Name "MB" -Value ([math]::Round($proc.WorkingSet64/1MB,1))
$proc.MB
C¶
Clear-Content¶
Deletes the content of a file without deleting the file itself.
Clear-Host¶
Clears the terminal screen. Aliases: cls, clear.
Compare-Object¶
Compares two sets of objects and shows differences.
Compare-Object [-ReferenceObject] <PSObject[]> [-DifferenceObject] <PSObject[]>
# Example:
$a = Get-Content .\old.txt
$b = Get-Content .\new.txt
Compare-Object $a $b
Compress-Archive¶
Creates a .zip archive.
Compress-Archive [-Path] <string[]> -DestinationPath <string> [-Update]
# Example:
Compress-Archive -Path .\Reports\* -DestinationPath .\Reports.zip
ConvertFrom-Csv¶
Converts CSV strings to PowerShell objects.
ConvertFrom-Json¶
Converts a JSON string to a PowerShell object.
'{"name":"Alice","age":30}' | ConvertFrom-Json
Invoke-RestMethod https://api.github.com/users/octocat # already returns a parsed object
ConvertTo-Csv¶
Converts objects to CSV text.
ConvertTo-Html¶
Converts objects to an HTML table string.
Get-Process | Select-Object Name, CPU, Id |
ConvertTo-Html -Title "Running Processes" | Out-File .\report.html
ConvertTo-Json¶
Converts an object to a JSON string.
ConvertTo-SecureString¶
Creates a SecureString from plain text or an encrypted string.
Copy-Item¶
Copies an item to another location.
Copy-Item [-Path] <string[]> [[-Destination] <string>] [-Recurse] [-Force]
# Examples:
Copy-Item .\file.txt .\backup.txt
Copy-Item .\src -Destination .\dst -Recurse
Copy-Item C:\Logs\*.log D:\Archive\
D¶
Disable-LocalUser¶
Disables a local user account.
Disable-ScheduledTask¶
Disables a scheduled task so it will not run automatically.
E¶
Enable-LocalUser¶
Enables a disabled local user account.
Enable-PSRemoting¶
Configures WinRM to accept remote PowerShell connections.
Enable-ScheduledTask¶
Enables a scheduled task so it will run on its trigger.
Enter-PSSession¶
Starts an interactive remote PowerShell session.
Enter-PSSession -ComputerName server01
Enter-PSSession -HostName linuxbox -UserName alice -SSHTransport
Expand-Archive¶
Extracts files from a .zip archive.
Expand-Archive -Path .\archive.zip -DestinationPath .\output
Expand-Archive .\archive.zip .\output -Force
Export-Csv¶
Exports objects to a CSV file.
Export-Csv [-Path] <string> [-NoTypeInformation] [-Append]
# Example:
Get-Service | Export-Csv .\services.csv -NoTypeInformation
Export-Clixml¶
Serializes objects to an XML file for later reconstruction.
F¶
Find-Module¶
Searches the PowerShell Gallery for modules.
ForEach-Object¶
Runs a script block for each piped object. Alias: %.
1..5 | ForEach-Object { $_ * 2 }
Get-ChildItem | ForEach-Object { $_.Name }
# Parallel execution (PS 7+):
1..10 | ForEach-Object -Parallel { Start-Sleep 1; $_ } -ThrottleLimit 5
Format-List¶
Formats output as a property list. Alias: fl.
Format-Table¶
Formats output as a table. Alias: ft.
Format-Wide¶
Formats output in a multi-column wide list.
G¶
Get-Acl¶
Gets the security descriptor (ACL) for a file, folder, or registry key.
Get-Acl .\sensitive.txt
(Get-Acl .\folder).Access | Format-Table IdentityReference, FileSystemRights
Get-Alias¶
Lists defined command aliases.
Get-AuthenticodeSignature¶
Gets the digital signature on a script or executable.
Get-AuthenticodeSignature .\myscript.ps1
Get-ChildItem .\scripts -Filter *.ps1 | Get-AuthenticodeSignature
Get-ChildItem¶
Lists items in a location. Aliases: ls, dir, gci.
Get-ChildItem [[-Path] <string[]>] [-Filter <string>] [-Recurse] [-Force] [-File] [-Directory]
# Examples:
Get-ChildItem C:\Windows -Filter *.exe -Recurse
Get-ChildItem -Force # include hidden and system items
Get-ChildItem HKLM:\Software # registry
Get-CimInstance¶
Gets hardware and OS information via CIM/WMI.
Get-CimInstance Win32_OperatingSystem
Get-CimInstance Win32_Processor
Get-CimInstance Win32_LogicalDisk | Where-Object DriveType -eq 3
Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum
Get-Command¶
Finds available cmdlets, functions, scripts, and aliases.
Get-Command -Verb Get
Get-Command -Noun Service
Get-Command *dns*
Get-Command -Module ActiveDirectory
Get-Content¶
Reads a file. Aliases: cat, gc, type.
Get-Content [-Path] <string[]> [-TotalCount <int>] [-Tail <int>] [-Wait] [-Raw] [-Encoding <Encoding>]
# Examples:
Get-Content .\file.txt
Get-Content .\big.log -Tail 20 -Wait # like tail -f
Get-Content .\data.json -Raw | ConvertFrom-Json
Get-Credential¶
Prompts for a username and password and returns a PSCredential.
$cred = Get-Credential
$cred = Get-Credential -Message "Enter admin credentials" -UserName "DOMAIN\admin"
Get-Date¶
Gets the current date and time.
Get-Date
Get-Date -Format "yyyy-MM-dd HH:mm:ss"
(Get-Date).AddDays(-7)
Get-Date -UFormat "%s" # Unix timestamp
Get-ExecutionPolicy¶
Gets the current PowerShell script execution policy.
Get-Help¶
Displays documentation for commands. Alias: man.
Get-Help Get-Process
Get-Help Get-Process -Examples
Get-Help Get-Process -Full
Get-Help *dns*
Update-Help # download latest help content
Get-History¶
Gets the command history for the current session.
Get-Item¶
Gets an item at a specified path.
Get-ItemProperty¶
Gets the properties (values) of an item.
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ProductName
(Get-ItemProperty "HKCU:\Software\MyApp").Theme
Get-Job¶
Gets PowerShell background jobs.
Get-LocalGroup¶
Gets local security groups.
Get-LocalUser¶
Gets local user accounts.
Get-Location¶
Gets the current working directory. Aliases: pwd, gl.
Get-Member¶
Gets the properties and methods of an object. Alias: gm.
Get-Module¶
Gets loaded or available modules.
Get-Module # currently loaded
Get-Module -ListAvailable # all installed
Get-Module -ListAvailable -Name Az # specific module
Get-NetIPAddress¶
Gets IP address configuration for all network adapters.
Get-NetIPConfiguration¶
Gets full IP configuration per adapter.
Get-NetTCPConnection¶
Gets TCP connection and listening port information (like netstat).
Get-NetTCPConnection -State Listen
Get-NetTCPConnection -LocalPort 443
Get-NetTCPConnection | Where-Object OwningProcess -eq (Get-Process pwsh).Id
Get-Process¶
Gets running processes. Aliases: ps, gps.
Get-Process
Get-Process -Name chrome
Get-Process -Id 1234
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-PSDrive¶
Gets drives (file system, registry, certificates, etc.).
Get-PSSession¶
Gets active remote PowerShell sessions.
Get-ScheduledTask¶
Gets scheduled tasks.
Get-ScheduledTask
Get-ScheduledTask -TaskName "DailyBackup"
Get-ScheduledTask | Where-Object State -eq Ready
Get-ScheduledTaskInfo¶
Gets runtime information (last run, next run, result) for a scheduled task.
Get-Service¶
Gets Windows services. Alias: gsv.
Get-Variable¶
Gets PowerShell session variables.
Get-Verb¶
Lists all approved PowerShell verbs.
Get-Volume¶
Gets disk volume information.
Get-WinEvent¶
Gets events from Windows event logs.
Get-WinEvent -LogName System -MaxEvents 50
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4624 } -MaxEvents 20
Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0
Group-Object¶
Groups objects by property value. Alias: group.
Get-Service | Group-Object Status
Get-ChildItem | Group-Object Extension | Sort-Object Count -Descending
Get-Service | Group-Object Status -AsHashTable
I¶
Import-Csv¶
Reads a CSV file and returns custom objects.
Import-Csv -Path .\data.csv
Import-Csv .\data.csv -Delimiter ";"
Import-Csv .\servers.csv | ForEach-Object { Test-Connection $_.Hostname -Count 1 -Quiet }
Import-Clixml¶
Deserializes objects from a CLIXML file.
Import-Module¶
Loads a module into the current session.
Import-Module ActiveDirectory
Import-Module .\MyModule -Force
Import-Module Pester -MinimumVersion 5.0
Install-Module¶
Installs a module from the PowerShell Gallery.
Install-Module Pester
Install-Module Az -Scope CurrentUser
Install-Module PSReadLine -AllowPrerelease
Invoke-Command¶
Runs commands on local or remote computers.
Invoke-Command -ComputerName server01 -ScriptBlock { Get-Service }
Invoke-Command -ComputerName server01,server02 -ScriptBlock { $env:COMPUTERNAME }
Invoke-Command -ComputerName server01 -ScriptBlock { Get-Service $using:svcName }
Invoke-Expression¶
Evaluates a string as a PowerShell command.
Security risk
Never use Invoke-Expression with untrusted input — it is a common injection vector.
Invoke-RestMethod¶
Sends an HTTP/HTTPS request and parses the JSON or XML response.
Invoke-RestMethod -Uri https://api.github.com/users/octocat
Invoke-RestMethod -Uri https://api.example.com/items `
-Method Post -Body ($body|ConvertTo-Json) -ContentType "application/json"
Invoke-WebRequest¶
Sends an HTTP request and returns the full response object.
Invoke-WebRequest -Uri https://example.com
(Invoke-WebRequest -Uri https://example.com).StatusCode
Invoke-WebRequest -Uri https://example.com/file.zip -OutFile .\file.zip
J¶
Join-Path¶
Joins a path and a child path into a single path.
M¶
Measure-Object¶
Calculates numeric properties (count, sum, average, min, max). Alias: measure.
Get-Process | Measure-Object
Get-ChildItem -Recurse | Measure-Object Length -Sum -Average -Maximum
Get-Content .\README.md | Measure-Object -Word -Line -Character
Move-Item¶
Moves and optionally renames an item. Alias: mv, move.
Move-Item .\old.txt .\new.txt
Move-Item .\file.txt C:\Archive\
Move-Item .\folder D:\NewLocation -Force
N¶
New-Guid¶
Generates a new GUID (globally unique identifier).
New-Item¶
Creates a new item (file, directory, registry key, alias, etc.).
New-Item -Path .\hello.txt -ItemType File -Value "Hello, World!"
New-Item -Path .\MyFolder -ItemType Directory
New-Item -Path HKCU:\Software\MyApp -Force
New-LocalUser¶
Creates a new local user account.
$pwd = Read-Host "Password" -AsSecureString
New-LocalUser -Name "alice" -Password $pwd -FullName "Alice Smith" -Description "Developer"
New-ModuleManifest¶
Creates a module manifest (.psd1) file.
New-ModuleManifest `
-Path .\MyModule\MyModule.psd1 `
-RootModule MyModule.psm1 `
-ModuleVersion "1.0.0" `
-Author "Your Name" `
-Description "What this module does"
New-Object¶
Creates an instance of a .NET or COM object.
$wc = New-Object System.Net.WebClient
$list = New-Object System.Collections.Generic.List[string]
# Preferred modern syntax:
$list = [System.Collections.Generic.List[string]]::new()
New-PSDrive¶
Creates a new drive mapping.
New-PSDrive -Name Z -PSProvider FileSystem -Root \\server\share
New-PSDrive -Name App -PSProvider Registry -Root HKCU:\Software\MyApp
New-PSSession¶
Creates a persistent remote PowerShell session.
$s = New-PSSession -ComputerName server01
Invoke-Command -Session $s -ScriptBlock { Get-Process }
Enter-PSSession -Session $s
New-TimeSpan¶
Creates a TimeSpan object.
New-TimeSpan -Days 7
New-TimeSpan -Hours 2 -Minutes 30
(Get-Date) - (Get-Date).AddDays(-7) # also returns a TimeSpan
O¶
Out-File¶
Sends formatted output to a file.
Get-Process | Out-File .\procs.txt
Get-Process | Out-File .\procs.txt -Append
Get-Process | Out-File .\procs.txt -Encoding UTF8
Out-GridView¶
Displays pipeline output in an interactive filterable grid. Alias: ogv.
Out-Null¶
Discards all pipeline output.
R¶
Read-Host¶
Reads a line of input from the console.
Receive-Job¶
Gets the output of a background job.
Register-ScheduledTask¶
Creates and registers a new scheduled task.
$action = New-ScheduledTaskAction -Execute "pwsh.exe" -Argument "-File C:\Scripts\job.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At "2:00AM"
Register-ScheduledTask -TaskName "NightlyJob" -Action $action -Trigger $trigger
Remove-Item¶
Deletes items (files, folders, registry keys, etc.). Aliases: rm, del, ri.
Remove-Item .\temp.txt
Remove-Item .\TempFolder -Recurse
Remove-Item .\*.tmp -Force
Remove-Item HKCU:\Software\MyApp -Recurse
Remove-Job¶
Deletes one or more background jobs.
Remove-Module¶
Removes a module from the current session.
Remove-PSSession¶
Closes and removes a remote session.
Rename-Item¶
Renames an item without moving it. Alias: ren.
Rename-Item .\draft.docx .\final.docx
Get-ChildItem *.txt | Rename-Item -NewName { $_.Name -replace '\.txt$', '.md' }
Resolve-DnsName¶
Performs a DNS lookup.
Resolve-DnsName google.com
Resolve-DnsName github.com -Type A
Resolve-DnsName gmail.com -Type MX
Resolve-DnsName example.com -Type TXT -Server 8.8.8.8
Resolve-Path¶
Resolves a relative or wildcard path to an absolute path.
Restart-Computer¶
Restarts a local or remote computer.
Restart-Service¶
Stops and then starts a Windows service.
S¶
Select-Object¶
Selects specific properties or a subset of objects. Alias: select.
Get-Process | Select-Object Name, Id, CPU
Get-Process | Select-Object -First 5
Get-Process | Select-Object -Last 5
Get-Process | Select-Object -Skip 10 -First 5
Get-Process | Select-Object -ExpandProperty Name # returns strings, not objects
Get-Process | Select-Object Name, @{Name='MB'; Expression={ [math]::Round($_.WorkingSet64/1MB,1) }}
Select-String¶
Searches for text patterns in files or strings. Alias: sls.
Select-String -Path .\*.log -Pattern "ERROR"
Get-Content .\file.txt | Select-String "warning" -CaseSensitive
Get-ChildItem .\src -Recurse -Filter *.ps1 | Select-String "TODO"
Select-String -Path .\*.log -Pattern "\d{4}-\d{2}-\d{2}" -AllMatches
Set-Acl¶
Applies a security descriptor to an item.
Set-Content¶
Writes content to a file, replacing existing content.
Set-ExecutionPolicy¶
Sets the PowerShell script execution policy.
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Set-ExecutionPolicy AllSigned -Scope LocalMachine
Set-Item¶
Sets the value of an item (commonly used with the registry provider).
Set-ItemProperty¶
Sets a property on an item.
Set-ItemProperty HKCU:\Software\MyApp -Name Theme -Value "Dark"
Set-ItemProperty HKCU:\Software\MyApp -Name MaxItems -Value 100 -Type DWord
Set-Location¶
Changes the current working directory. Aliases: cd, sl, chdir.
Set-Service¶
Modifies the configuration of a Windows service.
Set-Service -Name wuauserv -StartupType Disabled
Set-Service -Name wuauserv -Status Running -PassThru
Set-StrictMode¶
Enables strict mode to catch common scripting errors.
Set-Variable¶
Sets the value of a variable.
Sort-Object¶
Sorts pipeline objects by one or more properties. Alias: sort.
Get-Process | Sort-Object CPU -Descending
Get-ChildItem | Sort-Object LastWriteTime
Get-Service | Sort-Object Status, DisplayName
Get-Process | Sort-Object CPU -Top 10 # efficient top-N (PS 6+)
Split-Path¶
Returns a component of a file system path.
Split-Path "C:\Users\Alice\file.txt" -Parent # C:\Users\Alice
Split-Path "C:\Users\Alice\file.txt" -Leaf # file.txt
Split-Path "C:\Users\Alice\file.txt" -Extension # .txt (PS 6+)
Split-Path "C:\Users\Alice\file.txt" -IsAbsolute # $true
Start-Job¶
Starts a PowerShell command as a background job.
$job = Start-Job -ScriptBlock { Get-Process | Sort-Object CPU -Descending }
Wait-Job $job
Receive-Job $job
Remove-Job $job
Start-Process¶
Starts an application or process. Alias: saps.
Start-Process notepad
Start-Process pwsh -Verb RunAs # run as administrator
Start-Process msiexec -ArgumentList "/i .\app.msi /quiet" -Wait
Start-Process "https://docs.microsoft.com" # open URL in browser
Start-ScheduledTask¶
Runs a scheduled task immediately, on demand.
Start-Service¶
Starts a stopped Windows service.
Start-Sleep¶
Suspends execution for the specified duration.
Start-Transcript¶
Records all session input and output to a file.
Stop-Computer¶
Shuts down the local or a remote computer.
Stop-Process¶
Terminates a running process. Aliases: kill, spps.
Stop-Service¶
Stops a running Windows service.
T¶
Tee-Object¶
Sends pipeline output to a file or variable AND passes it through.
Get-Service | Tee-Object -FilePath .\services.txt | Measure-Object
Get-Process | Tee-Object -Variable procs | Where-Object CPU -gt 5
$procs.Count # full set is in $procs
Test-Connection¶
Sends ICMP echo requests (ping). Use Test-NetConnection for TCP port testing.
Test-Connection google.com
Test-Connection 8.8.8.8 -Count 1 -Quiet # $true / $false
Test-Connection server01,server02 -Count 1 # ping multiple
Test-ModuleManifest¶
Validates a module manifest .psd1 file.
Test-NetConnection¶
Tests network connectivity and optionally a TCP port.
Test-NetConnection github.com -Port 443
(Test-NetConnection server01 -Port 3389).TcpTestSucceeded
Test-NetConnection google.com -TraceRoute
Test-Path¶
Tests whether a path exists.
Test-Path .\config.json # file or directory
Test-Path .\folder -PathType Container # directory only
Test-Path .\file.txt -PathType Leaf # file only
Test-Path HKCU:\Software\MyApp # registry key
Test-WSMan¶
Tests WinRM connectivity to a remote computer.
U¶
Uninstall-Module¶
Uninstalls a module from the current system.
Unregister-ScheduledTask¶
Removes a scheduled task from Task Scheduler.
Update-Help¶
Downloads and installs the latest help content for all installed modules.
Update-Module¶
Updates an installed module to the latest version from the Gallery.
W¶
Wait-Job¶
Waits for one or more background jobs to finish.
Where-Object¶
Filters objects by a condition. Aliases: where, ?.
Get-Service | Where-Object Status -eq Running
Get-Process | Where-Object { $_.CPU -gt 10 -and $_.Name -ne 'Idle' }
Get-ChildItem | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
Write-Debug¶
Writes a debug message to the debug stream.
Write-Error¶
Writes an error record to the error stream.
Write-Host¶
Writes text directly to the console (not the pipeline).
Write-Host "Hello!" -ForegroundColor Green
Write-Host "Warning" -ForegroundColor Yellow -BackgroundColor Black
Note
Write-Host output cannot be captured to a variable. Use Write-Output for pipeline data.
Write-Information¶
Writes a message to the information stream (stream 6).
Write-Output¶
Writes objects to the success output stream (the pipeline). Alias: echo.
Write-Progress¶
Displays a progress bar in the console.
for ($i = 1; $i -le 100; $i++) {
Write-Progress -Activity "Processing files" -Status "$i% complete" -PercentComplete $i
Start-Sleep -Milliseconds 50
}
Write-Progress -Activity "Processing files" -Completed
Write-Verbose¶
Writes a verbose message (visible when -Verbose is used).
Write-Warning¶
Writes a warning message to the warning stream.