IT Toolbox
Cheat sheet

PowerShell — Essential commands

Field reference for PowerShell system, service, event, network, storage and remote administration checks.

TopicWindows Server →
⌚ About 3 min read
View my favorites
PowerShellBeginner to advanced8 sections · 32 reference points

Field reference for PowerShell system, service, event, network, storage and remote administration checks.

Help, syntax & safety

Detailed help
Get-Help Get-Service -Full

Shows syntax, parameters, examples and remarks before using an unfamiliar cmdlet.

Find a command
Get-Command *dns*

Searches available commands by name or verb/noun.

Inspect object properties
Get-Service Spooler | Get-Member

Shows which properties and methods can be filtered or exported.

Record the session
Start-Transcript -Path C:Temppowershell-transcript.txt

Keeps a useful command/output trail during an intervention.

System & identity

Computer name
hostname

Confirms the machine actually being managed.

User context
whoami /all

Shows current user, groups, SID and token privileges.

Windows information
Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsArchitecture,CsName

Checks edition, version, architecture and computer name.

Last boot
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Helps spot long uptime or an unexpected recent reboot.

Processes & services

Top CPU processes
Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 Name,Id,CPU

Quickly identifies processes with the highest accumulated CPU time.

Stopped services
Get-Service | Where-Object Status -eq 'Stopped' | Sort-Object DisplayName

Interpret in context: many services are intentionally stopped.

Service status
Get-Service Spooler

Checks exact service name and state before any action.

Targeted restart
Restart-Service Spooler -PassThru

Use only after checking impact and dependencies.

Windows event logs

Available logs
Get-WinEvent -ListLog * | Sort-Object RecordCount -Descending | Select-Object -First 20 LogName,RecordCount

Identifies large or specialized event logs.

Recent System errors
Get-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-4)} -ErrorAction SilentlyContinue | Select-Object -First 30 TimeCreated,Id,ProviderName,Message

Filters recent errors to correlate them with the incident window.

Event by ID
Get-WinEvent -FilterHashtable @{LogName='System';Id=41} -MaxEvents 20

Useful to confirm frequency of a specific Event ID.

Export an EVTX
wevtutil epl System C:TempSystem.evtx

Keeps a copy before cleanup or external analysis.

Network & DNS

Full IP configuration
Get-NetIPConfiguration

Summarizes IP, gateway and DNS per interface.

Network adapters
Get-NetAdapter | Sort-Object Status,Name

Checks state, link speed and active interface.

DNS resolution
Resolve-DnsName exemple.fr

Separates DNS issues from connectivity issues.

Port test
Test-NetConnection serveur.exemple.local -Port 443

Validates DNS, route and TCP establishment in one command.

Storage & files

Volumes
Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,HealthStatus,Size,SizeRemaining

Checks logical health and free space.

Physical disks
Get-PhysicalDisk | Select-Object FriendlyName,MediaType,HealthStatus,OperationalStatus,Size

Follow with vendor diagnostics if a disk is Warning or Unhealthy.

Large files
Get-ChildItem C:Data -File -Recurse -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 20 FullName,Length

Target a specific path to avoid expensive full-volume scans.

SHA-256 hash
Get-FileHash C:Tempfichier.zip -Algorithm SHA256

Lets you compare integrity between file copies.

Remote administration

Test WinRM
Test-WSMan serveur01

Checks WinRM before opening a remote session.

Remote session
Enter-PSSession -ComputerName serveur01

Interactive session: use a dedicated admin account and exit cleanly.

Remote command
Invoke-Command -ComputerName serveur01 -ScriptBlock { Get-Service }

Better for one-shot, scriptable collection.

Credentials
$cred = Get-Credential

Stores a PSCredential object in memory rather than plain text.

Pipeline, filters & exports

Filter objects
Get-Service | Where-Object Status -eq 'Running'

Filters objects by properties rather than displayed text.

Select properties
Get-Process | Select-Object Name,Id,CPU,WorkingSet

Restricts output to useful properties.

Export CSV
Get-Service | Select-Object Name,Status,StartType | Export-Csv C:Tempservices.csv -NoTypeInformation -Encoding UTF8

Produces a file suitable for Excel or another tool.

Export JSON
Get-NetIPConfiguration | ConvertTo-Json -Depth 5 | Set-Content C:Tempnetwork.json -Encoding UTF8

Useful for attaching structured state to a ticket.

Key points

  • Some commands require elevation or optional RSAT modules.
  • Capture the initial state before running change commands.
  • An empty result is not always an error; verify permissions, filters and remote context.
  • On production servers, prefer targeted collection over heavy recursive commands.
← All cheat sheets
♡ 0