PowerShell cheat sheet

Everyday PowerShell commands for Windows admins and learners, with full cmdlet names and the common aliases you will see in other people’s scripts.

Aliases marked (Windows) exist only in PowerShell on Windows. In scripts, always use the full cmdlet name.

Help and discovery

Task	Command	Alias
Help for a command, with examples	Get-Help Get-Process -Examples	help (a function that pages the output)
Full help, or open it in a browser	Get-Help Get-Process -Full or Get-Help Get-Process -Online
Download the latest help files (needs admin in Windows PowerShell 5.1)	Update-Help
Find commands by noun or name	Get-Command -Noun Service or Get-Command *firewall*	gcm
See an object’s properties and methods	Get-Process | Get-Member	gm
What does an alias point to?	Get-Alias gci	gal
Show your PowerShell version	$PSVersionTable.PSVersion
Show previous commands	Get-History	h, history

Navigation

Task	Command	Aliases
Where am I?	Get-Location	pwd, gl
Change folder	Set-Location C:\Logs	cd, sl, chdir
Up one level	Set-Location ..
List a folder	Get-ChildItem	dir, gci, ls (Windows)
Include hidden and system items	Get-ChildItem -Force
Search recursively	Get-ChildItem C:\Logs -Recurse -Filter *.log -File
Save and return to a location	Push-Location C:\Temp then Pop-Location	pushd, popd
Browse the registry like a drive	Set-Location HKLM:\SOFTWARE

Files and folders

Task	Command	Aliases
Create a folder	New-Item -ItemType Directory -Path C:\Reports	ni
Create an empty file	New-Item -ItemType File -Path .\notes.txt
Copy (add -Recurse for folders)	Copy-Item .\a.txt -Destination D:\Backup\	copy, cpi, cp (Windows)
Move	Move-Item .\a.txt -Destination .\Archive\	move, mi, mv (Windows)
Rename	Rename-Item .\old.txt -NewName new.txt	ren, rni
Delete (add -Recurse for folders)	Remove-Item .\temp.txt	del, ri, rd, rm (Windows)
Does it exist?	Test-Path C:\Reports
Read a file (last 20 lines)	Get-Content .\app.log -Tail 20	gc, type, cat (Windows)
Follow a log as it grows	Get-Content .\app.log -Wait -Tail 10
Write or overwrite a file	Set-Content .\out.txt -Value 'Hello'
Append to a file	Add-Content .\out.txt -Value 'More'	ac (Windows)
Search inside files (like grep)	Select-String -Path .\*.log -Pattern 'error'	sls
Open a file with its default app	Invoke-Item .\report.html	ii

Objects and the pipeline

PowerShell passes objects, not text, down the pipeline. Filter early, then pick and format the columns you want last.

Cmdlet	What it does	Example	Aliases
Where-Object	Keep objects that match	Get-Service | Where-Object Status -eq 'Running'	where, ?
Select-Object	Pick properties, or the first/last N	Get-Process | Select-Object -First 5 Name, Id, CPU	select
Sort-Object	Sort by one or more properties	Get-Process | Sort-Object CPU -Descending	sort (Windows)
Group-Object	Count objects by a property	Get-Service | Group-Object Status	group
Measure-Object	Count, sum, average, min, max	Get-ChildItem -File | Measure-Object Length -Sum	measure
ForEach-Object	Run code for each object	1..5 | ForEach-Object { $_ * 2 }	foreach, %
Format-Table	Show as a table (use last)	Get-Process | Format-Table Name, Id -AutoSize	ft
Format-List	Show every property as a list	Get-Service Spooler | Format-List *	fl
Export-Csv	Save objects to CSV	Get-Process | Export-Csv procs.csv -NoTypeInformation	epcsv
Import-Csv	Read CSV rows as objects	Import-Csv .\users.csv | Select-Object -First 3	ipcsv
ConvertTo-Json	Turn objects into JSON	Get-Service Spooler | ConvertTo-Json

Useful pipeline patterns

Goal	Command
Top 5 processes by memory	Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 5 Name, Id
Add a calculated column	Get-Process | Select-Object Name, @{Name='WorkingSetMB'; Expression={[math]::Round($_.WorkingSet64 / 1MB, 1)}}
Two conditions at once	Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' }
Biggest groups first	Get-Process | Group-Object ProcessName | Sort-Object Count -Descending | Select-Object -First 5 Count, Name
Total size of a folder in MB	(Get-ChildItem C:\Logs -Recurse -File | Measure-Object Length -Sum).Sum / 1MB
Just the values of one property	Get-Service | Select-Object -ExpandProperty Name

Comparison operators

Operator	Meaning	Operator	Meaning
-eq -ne	equal, not equal	-like -notlike	wildcard match: 'LIB*'
-gt -ge	greater than, or equal	-match -notmatch	regular expression match
-lt -le	less than, or equal	-contains -in	is a value in a list?
-and -or -not	combine conditions	-ceq -clike	case-sensitive versions

Comparisons are case-insensitive by default. Use -eq, never =, to compare: = assigns a value.

Variables and values

Task	Example
Store a value	$name = 'Server01'
Store command output	$svc = Get-Service Spooler
Read a property	$svc.Status
Count items	(Get-ChildItem).Count
Array	$servers = @('SRV1', 'SRV2', 'SRV3')
Hashtable (key and value pairs)	$user = @{ Name = 'Ana'; Dept = 'IT' }
Expand variables in text (double quotes)	"Checking $name"
Expand a property in text	"Status: $($svc.Status)"
Literal text, no expansion (single quotes)	'Costs $5'
Current object in a pipeline	$_ or $PSItem
Environment variable	$env:COMPUTERNAME, $env:PATH
True, false, nothing	$true, $false, $null

Loops and decisions

foreach ($s in $servers) {
    "Checking $s"
}

for ($i = 1; $i -le 3; $i++) { "Pass $i" }

while ($count -lt 5) { $count++ }

if ($disk.FreeGB -lt 10) {
    'Low space'
} elseif ($disk.FreeGB -lt 50) {
    'Watch it'
} else {
    'OK'
}

switch ($svc.Status) {
    'Running' { 'Up' }
    'Stopped' { 'Down' }
    default   { 'Other' }
}

try {
    Get-Item C:\Missing -ErrorAction Stop
} catch {
    "Failed: $($_.Exception.Message)"
}

function Get-Square {
    param([int]$Number)
    $Number * $Number
}

Services, processes and logs

Task	Command	Aliases
List services, or one service	Get-Service or Get-Service -Name Spooler	gsv (Windows)
Start, stop, restart	Start-Service Spooler, Stop-Service Spooler, Restart-Service Spooler	sasv, spsv (Windows)
Change startup type	Set-Service Spooler -StartupType Automatic
List processes	Get-Process	gps, ps (Windows)
Stop a process	Stop-Process -Name notepad or Stop-Process -Id 4242	spps, kill (Windows)
Start a program	Start-Process notepad	saps, start (Windows)
Last 20 System log errors	Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 20
OS details	Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, LastBootUpTime
Disk free space	Get-Volume or Get-PSDrive -PSProvider FileSystem
Test a network port	Test-NetConnection server01 -Port 443	tnc

Get-EventLog works only in Windows PowerShell 5.1. Get-WinEvent works in both 5.1 and PowerShell 7 on Windows. In -FilterHashtable, Level 1 is Critical, 2 is Error, 3 is Warning.

Remoting basics

Task	Command	Alias
Turn on remoting (on the target, as admin)	Enable-PSRemoting -Force
Check that WinRM answers	Test-WSMan server01
Interactive session on one machine	Enter-PSSession -ComputerName server01	etsn
Leave the session	Exit-PSSession	exsn
Run a command on several machines	Invoke-Command -ComputerName srv1, srv2 -ScriptBlock { Get-Service Spooler }	icm
Use other credentials	Invoke-Command -ComputerName srv1 -Credential (Get-Credential) -ScriptBlock { hostname }
Reusable session	$s = New-PSSession -ComputerName srv1, then Invoke-Command -Session $s -ScriptBlock { Get-Date }, then Remove-PSSession $s	nsn

Remoting uses WinRM: TCP 5985 (HTTP) and 5986 (HTTPS). Traffic over 5985 is still encrypted by Kerberos or NTLM in a domain. Windows Server has remoting on by default.

Execution policy

Task	Command
See the policy at every scope	Get-ExecutionPolicy -List
Allow local scripts, require signed downloads, for you only	Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Unblock a script you downloaded and trust	Unblock-File .\script.ps1
Run a script in the current folder	.\script.ps1
Bypass for one run only	powershell.exe -ExecutionPolicy Bypass -File .\script.ps1

Policy	Meaning
Restricted	No scripts. Default on Windows client editions.
RemoteSigned	Local scripts run. Downloaded scripts must be signed. Default on Windows Server.
AllSigned	Every script must be signed by a trusted publisher.
Unrestricted	Runs everything, warns on downloaded scripts. The only policy on Linux and macOS.
Bypass	Nothing blocked, no warnings.
Undefined	Nothing set at this scope.

Group Policy settings (MachinePolicy, UserPolicy) override the rest. Execution policy is a safety net against accidents, not a security boundary.