CMD → PowerShell 7

Get-NetIPConfiguration Get-NetIPConfiguration -Detailed Remove-NetIPAddress -InterfaceAlias "Ethernet" Set-NetIPInterface -InterfaceAlias "Ethernet" -Dhcp Enabled Clear-DnsClientCache Get-DnsClientCache Register-DnsClient

Test-Connection google.com Test-Connection server01 -Count 10 -BufferSize 1500 Test-Connection server01 -Repeat Test-NetConnection server01 -TraceRoute Test-NetConnection server01 -TraceRoute -Hops 30 Test-NetConnection server01 -Port 443

Get-NetTCPConnection | Sort-Object State Get-NetTCPConnection | Select LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{N='Proc';E={(Get-Process -Id $_.OwningProcess).Name}} Get-NetTCPConnection -LocalPort 443 Get-NetRoute -AddressFamily IPv4

Get-NetNeighbor -AddressFamily IPv4 Remove-NetNeighbor -AddressFamily IPv4 -Confirm:$false Get-NetAdapter | Select Name, MacAddress, LinkSpeed, Status

Get-NetRoute -AddressFamily IPv4 New-NetRoute -DestinationPrefix "10.10.0.0/16" -NextHop "192.168.1.1" -InterfaceIndex 5 Remove-NetRoute -DestinationPrefix "10.10.0.0/16" Set-NetRoute -DestinationPrefix "10.10.0.0/16" -RouteMetric 25

Resolve-DnsName google.com Resolve-DnsName google.com -Type A Resolve-DnsName google.com -Type MX Resolve-DnsName _ldap._tcp.domain.com -Type SRV Resolve-DnsName 10.0.0.1 # reverse lookup Resolve-DnsName google.com -Server 8.8.8.8 Clear-DnsClientCache Get-DnsClientCache

Get-DnsServerZone Get-DnsServerResourceRecord -ZoneName zone.com Add-DnsServerResourceRecordA -ZoneName zone.com -Name host -IPv4Address 10.0.0.5 Remove-DnsServerResourceRecord -ZoneName zone.com -Name host -RRType A -Force Get-DnsServerStatistics

Get-Process Get-Process -Name notepad Get-Process | Where-Object {$_.WorkingSet -gt 100MB} | Sort-Object WorkingSet -Descending Get-Process | Select Name, Id, CPU, WorkingSet, Modules Get-Process | Select -First 20 | Format-Table -AutoSize Get-CimInstance Win32_Process | Select Name,ProcessId,CommandLine,ParentProcessId

Stop-Process -Id 1234 -Force Stop-Process -Name notepad -Force Get-Process notepad | Stop-Process -Force # includes children via pipeline Start-Process notepad.exe Start-Process setup.exe -Wait

# Top 10 by CPU Get-Process | Sort-Object CPU -Descending | Select -First 10 # Top 10 by memory (MB) Get-Process | Sort-Object WorkingSet -Descending | Select Name,Id,@{N='RAM_MB';E={[math]::Round($_.WorkingSet/1MB,1)}} | Select -First 10 # Continuous watch (refresh every 3s) while($true){ Get-Process | Sort-Object CPU -Desc | Select -First 5; Start-Sleep 3; Clear-Host }

Get-Service Get-Service | Select Name, DisplayName, Status, StartType Get-Service wuauserv Start-Service wuauserv Stop-Service wuauserv Stop-Service wuauserv Start-Service wuauserv Set-Service wuauserv -StartupType Automatic Set-Service wuauserv -StartupType Disabled Remove-Service badservice # PS7 only (not in PS5)

# All stopped services that should be running Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} # Restart all stopped auto-start services Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Start-Service -PassThru # Show service dependencies Get-Service wuauserv | Select -ExpandProperty DependentServices

Get-Disk Get-Volume Get-Partition Get-Volume | Select DriveLetter, FileSystem, Size, SizeRemaining, @{N='Free%';E={[math]::Round($_.SizeRemaining/$_.Size*100,1)}} Get-ChildItem C:\ -Recurse | Measure-Object -Property Length -Sum Get-PSDrive -PSProvider FileSystem

# Files over 1GB Get-ChildItem C:\ -Recurse -File -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 1GB} | Sort-Object Length -Descending | Select FullName, @{N='GB';E={[math]::Round($_.Length/1GB,2)}} | Select -First 20 # Folder sizes (top-level) Get-ChildItem C:\ -Directory | ForEach-Object { [PSCustomObject]@{Folder=$_.Name; SizeGB=[math]::Round((Get-ChildItem $_.FullName -Recurse -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum).Sum/1GB,2)} } | Sort-Object SizeGB -Descending

Repair-Volume -DriveLetter C -Scan Repair-Volume -DriveLetter C -OfflineScanAndFix Get-PhysicalDisk | Select FriendlyName, MediaType, OperationalStatus, HealthStatus, Size Get-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk)[0]

Get-WinEvent -LogName System -MaxEvents 10 Get-WinEvent -LogName Application -MaxEvents 50 Clear-EventLog -LogName System Get-WinEvent -ListLog * Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} # Level 2 = Error

# Errors in last 24 hours Get-WinEvent -FilterHashtable @{ LogName='System'; Level=2 StartTime=(Get-Date).AddHours(-24) } # Specific Event ID (e.g., 4625 — failed logon) Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 # Search event message text Get-WinEvent -LogName System | Where-Object {$_.Message -like "*driver*"} | Select TimeCreated, Id, Message | Export-Csv "driver-events.csv" -NoTypeInformation # Critical events across all logs Get-WinEvent -FilterHashtable @{LogName='*'; Level=1} -MaxEvents 100

Get-LocalUser Get-LocalUser -Name jdoe New-LocalUser -Name jdoe -Password (Read-Host -AsSecureString) -FullName "John Doe" Set-LocalUser -Name jdoe -Password (Read-Host -AsSecureString) Disable-LocalUser -Name jdoe Remove-LocalUser -Name jdoe Get-LocalGroup Get-LocalGroupMember -Group Administrators Add-LocalGroupMember -Group Administrators -Member jdoe

Get-ADUser -Identity jdoe -Properties * Get-ADUser -Filter {Name -like "John*"} Get-ADUser -Identity jdoe -Properties MemberOf | Select -ExpandProperty MemberOf Get-ADGroupMember "Domain Admins" -Recursive Search-ADAccount -AccountInactive -TimeSpan 28.00:00:00 -ComputersOnly

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" Set-ItemProperty -Path "HKCU:\Software\Test" -Name MyValue -Value "Hello" Remove-ItemProperty -Path "HKCU:\Software\Test" -Name MyValue reg export HKLM\SOFTWARE output.reg # still valid via reg.exe

Get-NetFirewallProfile Get-NetFirewallProfile -Name Domain Get-NetFirewallRule | Where-Object {$_.Enabled -eq $true} New-NetFirewallRule -DisplayName "Allow SSH" ` -Direction Inbound -Action Allow ` -Protocol TCP -LocalPort 22 Set-NetFirewallProfile -All -Enabled False Set-NetFirewallProfile -All -Enabled True

Invoke-Command -ComputerName server01 -ScriptBlock {Get-NetIPConfiguration} Invoke-Command -ComputerName server01 -Credential (Get-Credential) -ScriptBlock {hostname} Invoke-Command -ComputerName server01 -ScriptBlock {Get-Process} Invoke-Command -ComputerName server01 -ScriptBlock {Get-Service} Invoke-Command -ComputerName server01 -ScriptBlock {Get-CimInstance Win32_OperatingSystem | Select Caption} # WinRM is built-in, encrypted, uses AD auth

Enter-PSSession -ComputerName server01 # WinRM Enter-PSSession -HostName server01 -UserName admin # SSH (PS7) Exit-PSSession # Persistent session for multiple commands $s = New-PSSession -ComputerName server01 Invoke-Command -Session $s -ScriptBlock {Get-Process} Invoke-Command -Session $s -ScriptBlock {Get-Service} Remove-PSSession $s # Run against multiple servers in parallel (PS7) Invoke-Command -ComputerName server01,server02,server03 -ScriptBlock {Get-HotFix | Sort-Object InstalledOn -Desc | Select -First 3}

Get-Counter '\Processor(_Total)\% Processor Time' -SampleInterval 2 -MaxSamples 5 Get-Counter '\Memory\Available MBytes' Get-Counter '\LogicalDisk(C:)\% Free Space' Get-CimInstance Win32_Processor | Select Name, LoadPercentage Get-CimInstance Win32_OperatingSystem | Select FreePhysicalMemory, TotalVisibleMemorySize

# One-shot health snapshot $os = Get-CimInstance Win32_OperatingSystem $cpu = Get-CimInstance Win32_Processor $cs = Get-CimInstance Win32_ComputerSystem [PSCustomObject]@{ OS = $os.Caption Uptime = (Get-Date) - $os.LastBootUpTime RAM_GB = [math]::Round($cs.TotalPhysicalMemory/1GB, 1) RAM_Free_GB = [math]::Round($os.FreePhysicalMemory/1MB, 1) CPU_Load = "$($cpu.LoadPercentage)%" CPU_Name = $cpu.Name Disk_Free = (Get-Volume C).SizeRemaining }

Get-ComputerInfo Get-ComputerInfo | Select OsName, OsVersion, WindowsBuildLabEx Get-CimInstance Win32_OperatingSystem | Select Caption, Version, BuildNumber Get-CimInstance Win32_ComputerSystem | Select Name, Model, Manufacturer Get-CimInstance Win32_Bios | Select SMBIOSBIOSVersion, Manufacturer, ReleaseDate Get-CimInstance Win32_Processor | Select Name, NumberOfCores, NumberOfLogicalProcessors Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum Get-HotFix | Sort-Object InstalledOn -Descending hostname # still works in PS7 $PSVersionTable.PSVersion # PS version

Get-HotFix Get-HotFix | Sort-Object InstalledOn -Desc | Select -First 10 Get-HotFix -Id KB5001567 # Check specific KB across multiple servers Invoke-Command -ComputerName server01,server02 -ScriptBlock { Get-HotFix -Id KB5001567 -ErrorAction SilentlyContinue }