25 PowerShell Commands Every Windows Admin Should Know

Most Windows Server admin work comes back to the same small set of PowerShell cmdlets: check a service, read an event log, test a port, look at disk space, run something on ten servers at once. This list covers the 25 commands that do most of that work, with a ready-to-use example for each.

Quick answer: if you only learn five, learn Get-Help, Get-Service, Get-WinEvent, Test-NetConnection and Invoke-Command. Together they let you find any cmdlet, check what is running, see what went wrong, test the network and repeat the fix on many servers.

Before you start: check your PowerShell version

Windows Server 2016, 2019, 2022 and 2025 ship with Windows PowerShell 5.1. PowerShell 7 is a separate install that runs side by side (pwsh.exe). Most commands below work in both; where they differ, it is noted.

$PSVersionTable.PSVersion

Run the console as Administrator. Many of these cmdlets return partial results or access errors without elevation.

1. Get-Help: read the manual for any cmdlet

Shows syntax, parameters and examples. Run Update-Help once (elevated, with internet access) so the local help is complete.

Update-Help -ErrorAction SilentlyContinue
Get-Help Get-WinEvent -Examples
Get-Help Test-NetConnection -Online

2. Get-Command: find the cmdlet you need

Search by verb, noun or module when you know roughly what you want but not the exact name.

Get-Command -Noun *Firewall*
Get-Command -Verb Get -Module NetTCPIP

3. Get-Member: see what an object contains

PowerShell returns objects, not text. Pipe any output to Get-Member to see every property you can filter or sort on.

Get-Service Spooler | Get-Member -MemberType Property

4. Get-Service: check service status

Lists services with their status. This example finds automatic services that are not running, which is a fast health check after a reboot.

Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } |
    Select-Object Name, DisplayName, Status

A few automatic services (for example delayed or trigger-start ones) stop on their own by design, so check the list before you act on it.

5. Restart-Service and Set-Service: fix and configure services

Restart a stuck service, or change how it starts. Add -WhatIf first if you are not sure which services a wildcard will match. If a service must wait for another one, see how to add a dependency to a Windows service.

Restart-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Automatic

6. Get-Process: find what is using CPU or memory

Shows the top 10 processes by CPU time. Change CPU to WorkingSet64 to sort by memory.

Get-Process | Sort-Object CPU -Descending |
    Select-Object -First 10 Name, Id, CPU, @{n='MemMB';e={[math]::Round($_.WorkingSet64/1MB)}}

7. Stop-Process: kill a hung process

Warning: this ends the process immediately and any unsaved work is lost. Stopping system processes can crash the server. Always confirm the process ID first with Get-Process.

Stop-Process -Id 4812 -WhatIf
Stop-Process -Id 4812 -Force

8. Get-WinEvent: read event logs fast

Get-WinEvent with -FilterHashtable filters on the server side, so it is much faster than piping everything to Where-Object. This shows errors (Level 2) from the System log in the last 24 hours.

Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    Level     = 2
    StartTime = (Get-Date).AddDays(-1)
} -MaxEvents 50 | Format-Table TimeCreated, Id, ProviderName, Message -Wrap

You will still see Get-EventLog in old scripts. It works in Windows PowerShell 5.1 but was removed in PowerShell 7, so use Get-WinEvent in anything new. Levels: 1 Critical, 2 Error, 3 Warning, 4 Information.

9. Get-CimInstance: query WMI the modern way

Use Get-CimInstance instead of Get-WmiObject, which does not exist in PowerShell 7. This shows the OS version and last boot time.

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object CSName, Caption, Version, LastBootUpTime

In PowerShell 7 you can also run Get-Uptime (or Get-Uptime -Since for the boot time). It is not available in Windows PowerShell 5.1.

10. Get-ComputerInfo: system summary in one command

Returns OS, hardware, BIOS and domain details. It is slow when you ask for everything, so request only the properties you need (wildcards work).

Get-ComputerInfo -Property CsName, OsName, OsVersion, OsLastBootUpTime, CsDomain

11. Get-HotFix: list installed updates

Shows recently installed updates, newest first. It reads Win32_QuickFixEngineering, which does not include every type of update, so use it as a quick check, not as a full patch audit.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn

12. Get-Volume: check free disk space

Lists volumes with size and free space in GB.

Get-Volume | Where-Object DriveLetter |
    Select-Object DriveLetter, FileSystemLabel,
        @{n='SizeGB';e={[math]::Round($_.Size/1GB,1)}},
        @{n='FreeGB';e={[math]::Round($_.SizeRemaining/1GB,1)}}

13. Get-ChildItem: find the largest files

When a drive fills up, this finds the 20 biggest files under a path. On a large volume it can take several minutes.

Get-ChildItem -Path D:\ -Recurse -File -ErrorAction SilentlyContinue |
    Sort-Object Length -Descending |
    Select-Object -First 20 FullName, @{n='SizeMB';e={[math]::Round($_.Length/1MB)}}

14. Get-NetIPConfiguration: see IP, gateway and DNS

The PowerShell equivalent of ipconfig, but it returns objects you can filter. If you need a refresher on addressing, see the basics of IP addresses.

Get-NetIPConfiguration
Get-NetIPAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, IPAddress, PrefixLength

15. Test-NetConnection: test ping and TCP ports

Replaces ping, telnet and tracert for most checks. TcpTestSucceeded : True means the port is open and reachable from this machine.

Test-NetConnection -ComputerName sql01 -Port 1433
Test-NetConnection -ComputerName sql01 -Port 1433 -InformationLevel Quiet
Test-NetConnection -ComputerName www.microsoft.com -TraceRoute

-InformationLevel Quiet returns only True or False, which is handy in scripts.

16. Resolve-DnsName: query DNS directly

Like nslookup, but scriptable. Use -Server to ask a specific DNS server and -Type for a specific record.

Resolve-DnsName -Name contoso.com -Type MX
Resolve-DnsName -Name dc01.contoso.local -Server 10.0.0.10
Clear-DnsClientCache

17. Get-NetTCPConnection: see open ports and connections

Lists listening ports and the process that owns each one. Counting connections in TimeWait is also a quick way to spot port exhaustion.

Get-NetTCPConnection -State Listen |
    Select-Object LocalAddress, LocalPort, OwningProcess,
        @{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}} |
    Sort-Object LocalPort

(Get-NetTCPConnection -State TimeWait).Count

18. Get-NetFirewallRule: check Windows Firewall rules

Lists enabled inbound allow rules. Pipe a rule to Get-NetFirewallPortFilter to see its ports.

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
    Select-Object DisplayName, Profile

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Get-NetFirewallPortFilter

19. Get-LocalGroupMember: audit local admins

Shows who is in the local Administrators group, a common audit request. These cmdlets are part of the LocalAccounts module and do not apply to domain controllers, which have no local accounts.

Get-LocalGroupMember -Group Administrators
Get-LocalUser | Select-Object Name, Enabled, LastLogon

20. Get-Acl: check NTFS permissions

Shows who has access to a folder and whether the permission is inherited.

(Get-Acl -Path D:\Shares\Finance).Access |
    Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited

21. Get-ScheduledTask: check scheduled tasks

Lists non-Microsoft tasks, then shows the last run time and result for one. A LastTaskResult of 0 means success.

Get-ScheduledTask | Where-Object TaskPath -notlike '\Microsoft\*' |
    Select-Object TaskName, TaskPath, State

Get-ScheduledTaskInfo -TaskName 'Nightly Backup' |
    Select-Object LastRunTime, LastTaskResult, NextRunTime

22. Get-WindowsFeature and Install-WindowsFeature: manage roles

Server only (ServerManager module). This lists installed roles and features, then installs the Active Directory PowerShell module. Some features need a restart.

Get-WindowsFeature | Where-Object Installed
Install-WindowsFeature -Name RSAT-AD-PowerShell

On Windows 10/11 these cmdlets are not available; RSAT tools are installed with Get-WindowsCapability -Online -Name 'Rsat*' and Add-WindowsCapability instead.

23. Invoke-Command: run commands on many servers

Runs a script block on one or more remote computers in parallel over WinRM. PowerShell remoting is enabled by default on Windows Server 2012 and later; if it is off, run Enable-PSRemoting on the target.

Invoke-Command -ComputerName web01, web02, web03 -ScriptBlock {
    Get-Service -Name W3SVC | Select-Object Status
}

Results include a PSComputerName property so you can see which server returned what.

24. Enter-PSSession: open a remote shell

An interactive session on one server, like SSH. Type Exit-PSSession to leave.

Enter-PSSession -ComputerName web01
# ... run commands on web01 ...
Exit-PSSession

25. Restart-Computer: reboot and wait

Warning: -Force reboots even if users are logged on and can lose unsaved work. Check sessions first (quser /server:web01) and use a maintenance window. -Wait only works on remote computers.

Restart-Computer -ComputerName web01 -Force -Wait -For PowerShell -Timeout 600

The command returns when PowerShell remoting answers again on web01, or after 600 seconds.

Best practices for daily PowerShell use

• Add -WhatIf to any command that changes or deletes something before you run it for real.
• Use full cmdlet and parameter names in scripts. Aliases like gsv or % are fine at the prompt but hard to read later.
• Filter early: use -FilterHashtable, -Name or -State parameters instead of pulling everything and filtering with Where-Object.
• Prefer Get-CimInstance and Get-WinEvent over Get-WmiObject and Get-EventLog so your scripts also run in PowerShell 7.
• Export results with Export-Csv -Path .\report.csv -NoTypeInformation when you need to share them.
• Record long admin sessions with Start-Transcript so you have a log of what you changed.