Top PowerShell commands you must know, with cheat sheet
Explore this list of the most useful PowerShell cmdlets with a guide on how to use each command. Then, download the handy cheat sheet to keep the information at your fingertips.
PowerShell contains thousands of cmdlets with varying degrees of usefulness depending on your use case. While many PowerShell cmdlets could be considered obscure, you'll likely find yourself using some of them repeatedly. This is particularly true for those who create PowerShell scripts or who use PowerShell for various automation tasks.
12 essential PowerShell cmdlets
It's helpful to start with a basic list of cmdlets you anticipate using day to day. Here are 12 of the more widely used PowerShell cmdlets for administrators. They are available in both Windows PowerShell 5.1 and PowerShell 7. Any differences between versions are highlighted.
1. Get-Command
The Get-Command cmdlet performs command discovery. Using various parameters, Get-Command can list all commands currently available, commands for a specific module or even commands matching a filter. Since PowerShell contains thousands of cmdlets, the Get-Command cmdlet is particularly useful.
Running Get-Command with no parameters generates a long list of all available commands in your session. Get a count of available cmdlets by piping Get-Command to the Measure-Object cmdlet.
Get-Command | Measure-Object
In a PowerShell 7 session, with several large modules loaded, including the Az (Azure) and Microsoft.Graph modules, PowerShell shows 21,057 available commands.
You can use Get-Command to find specific commands. For example, to see all commands that end with -Process, use a wildcard.
Get-Command *-Process | ft -a
The output in this example also demonstrates how the naming of cmdlets makes Get-Command so useful. Based on the cmdlet names, you can clearly understand what capabilities you have with processes in PowerShell.
Another example is to find commands in specific modules. Let's say that you saw a PowerShell script example that creates a user in Microsoft Entra ID that uses the Microsoft.Graph module, specifically the New-MgUser cmdlet. The following command shows the module where the cmdlet resides, assuming the Microsoft.Graph module is installed.
Get-Command New-MgUser | ft -a
And then find all other commands in that module with the following.
Get-Command -Module Microsoft.Graph.Users
The list is much longer than the screenshot. To find all the cmdlets related to updating users or resources, use a wildcard to find all the Set-* commands.
Get-Command Set-* -Module Microsoft.Graph.Users
2. Get-Help
Arguably the most important command in PowerShell, Get-Help displays help syntax for commands in PowerShell. The easiest way to use Get-Help is to pass it a command name.
Get-Help Get-Command
It returns the name, synopsis, syntax, description and a few other fields outside of the screenshot.
To see the help information about a specific parameter, you can use the -Parameter option.
Get-Help Get-Command -Parameter Module
The output explains the -Module parameter accepts an array of module names rather than just a single module name.
You can also see the demonstrations of how to use the cmdlet.
Get-Help Get-Command -Examples
If you want to see everything in the help about a specific command, use the -Full parameter.
Get-Help Get-Command -Full3. Get-Process
When used by itself, the Get-Process cmdlet shows the list of all processes running on the system. To count them, use the Measure-Object cmdlet.
Get-Process | Measure-Object
Examine specific processes by passing the process name. To see the process metrics of the PowerShell 7 process, such as memory usage and CPU time consumption, use the following command.
Get-Process pwsh
Windows PowerShell users run the following command.
Get-Process powershellPowerShell captures a lot of information about these processes. Pipe the command to Format-List to see the properties and values for each process.
Get-Process pwsh | Format-List *
The Get-Process cmdlet also has parameters that add useful information to the default output. For example, the -IncludeUserName parameter shows the process owner. This may need elevated access.
Get-Process pwsh -IncludeUserName
The -FileVersionInfo parameter gets the version of the executable file of the process, which can be helpful to verify the proper version is running on the system and to troubleshoot issues.
Get-Process pwsh -FileVersionInfo
4. Get-Service
The Get-Service cmdlet is like the Get-Process cmdlet, but it shows services -- a type of background process in Windows. See all running services with the following command.
Get-ServiceThere are quite a few, which Measure-Object can count.
Get-Service | Measure-Object
You can get information about a specific service by passing its name to Get-Service.
Get-Service spooler
To see the services that depend on a particular service to run properly, use the -DependentServices parameter.
Get-Service Dnscache -DependentServices
5. ConvertTo-Html
The ConvertTo-Html cmdlet builds an HTML file from PowerShell output. Imagine the standard table output in PowerShell but in HTML format. To use this command, pipe any PowerShell output to the command, and then pipe that output to a file using the Out-File cmdlet.
Get-Process pwsh -FileVersionInfo | ConvertTo-Html | Out-File C:\tmp\process.htmlOpen the resulting file from PowerShell.
Invoke-Item C:\tmp\process.html
Use the -Property parameter to specify the properties to use for a more targeted HTML report.
Get-Process pwsh -FileVersionInfo | ConvertTo-Html -Property ProductVersion,FileVersion,FileName | Out-File C:\tmp\process.html
6. Get-ChildItem
The Get-ChildItem cmdlet retrieves the contents of a location, which is typically the contents of a file folder. However, using the navigation capabilities in PowerShell drives, this could display other data stores, including Windows Registry, certificate store or even AD.
Using the command returns the contents of the current location.
Get-ChildItem
The output shows the working directory, which is the PowerShell installation folder.
You can specify a specific path instead of depending on the current working directory by passing a value to the -Path parameter. The following example lists a registry path by specifying HKLM: instead of a drive letter.
Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\PowerShellCore'
Get-ChildItem has a lot of powerful filtering options. The most useful are the -File and -Directory properties to show only files and only directories, respectively.
Get-ChildItem -File
Get-ChildItem -Directory
If you use these commands in Windows PowerShell, there is no colorization, as there is in the screenshots. The PowerShell developers added support for American National Standards Institute decorated text in PowerShell 7.2, which can be controlled with the $PSStyle variable.
7. Copy-Item
The Copy-Item cmdlet copies one or more files to a specific location. The simplest usage of this command is to provide the source path, file name and destination path. For example, to copy the file Data.txt from C:\Folder1 to C:\Folder2, you use the following command.
Copy-Item C:\Folder1\Data.txt -Destination C:\Folder2Successful completion results in no output to the console.
You can also use wildcards to copy the contents of an entire folder.
Copy-Item C:\Folder1\*.* -Destination C:\Folder2Or you can recursively copy an entire folder.
Copy-Item C:\Folder1 -Destination C:\Folder2 -Recurse8. Set-ExecutionPolicy
PowerShell uses an execution policy to control what scripts execute on a given system. To see the current execution policy, use the Get-ExecutionPolicy command.
Get-ExecutionPolicy
Click on the above image to
download our free PowerShell
cmdlets cheat sheet.
The example shows the execution policy on the system is set to RemoteSigned, which prevents any remote scripts from running unless they are signed by a trusted certificate.
You use the Set-ExecutionPolicy cmdlet to change the execution policy by passing the desired execution policy. The names of the execution policies are AllSigned, Bypass, Default, RemoteSigned, Restricted, Undefined and Unrestricted. If you wanted to set the execution policy to Unrestricted, use the following.
Set-ExecutionPolicy UnrestrictedThis requires the script to be executed in an elevated context -- run as the administrator on Windows -- and returns no output if successful.
9. Get-History
The Get-History cmdlet retrieves a list of the commands that have been entered in the current session. This is much easier than repeatedly pressing the up arrow key to find previously executed instructions. Run by itself, Get-History returns a list of all operations performed in the current session.
Get-History
The whole history is longer than what is present in the screenshot. To control the number of lines, use the -Count parameter. Use the following command to see the five most recent lines.
Get-History -Count 5
10. Get-Content
There are times it's useful to read a file in the console rather than deferring to an application like Notepad. The Get-Content cmdlet retrieves the data of a file. For example, if you want to read the hosts file on Windows, you can do so with the following.
Get-Content -Path C:\Windows\System32\drivers\etc\hosts
Get-Content can monitor changes to a file, such as a log file, and output those lines as they are written. The -Wait parameter keeps the command running until terminated by the user.
Get-Content C:\tmp\log.txt -WaitIn the following example, the -Tail parameter shows the last 10 lines of a file.
Get-Content C:\tmp\log.txt -Tail 1011. Out-File
The Out-File cmdlet writes PowerShell output to a file. Pipe the data that you want to output to Out-File, and give it a file path. If you want to create a file called C:\Temp\services.txt that contains a list of system services, then you type the following.
Get-Service | Out-File -FilePath C:\Temp\services.txtSince Out-File implicitly uses PowerShell's formatting system, the file looks the same as if you ran Get-Service and then copied the terminal output to a file.
If you want to append data to the end of an existing file, you can use the -Append parameter.
Get-Service | Out-File -FilePath C:\Temp\Services.txt -Append12. Invoke-Item
The Invoke-Item cmdlet opens or executes a file using the application associated with the file's extension. For example, using the Invoke-Item cmdlet with an HTM file usually causes the file to open in a web browser.
Invoke-Item C:\tmp\process.htmSimilarly, using Invoke-Item with a .docx file opens it in Microsoft Word.
Invoke-Item C:\tmp\Document1.docxAdd more PowerShell commands to your management arsenal
All the commands demonstrated in this article are part of the default installation in both Windows PowerShell 5.1 and PowerShell 7. For more functionality or to integrate with a service, you need to install additional modules. For example, to manage users in Entra ID, install the Microsoft.Graph.Users module with the following command.
Install-Module Microsoft.Graph.UsersNext, use Import-Module to load the module into your current PowerShell session.
Import-Module Microsoft.Graph.UsersUse Get-Module to look at information about the module.
Get-Module Microsoft.Graph.UsersThen, using Get-Command, see what commands come with the module.
Get-Command -Module Microsoft.Graph.UsersAnthony Howell is an IT strategist with extensive experience in infrastructure and automation technologies. His expertise includes PowerShell, DevOps, cloud computing, and working in both Windows and Linux environments.
Brien Posey is a former 22-time Microsoft MVP and a commercial astronaut candidate. In his more than 30 years in IT, he has served as a lead network engineer for the U.S. Department of Defense and a network administrator for some of the largest insurance companies in America.
