Field reference for PowerShell system, service, event, network, storage and remote administration checks.
Help, syntax & safety
- Detailed help — Get-Help Get-Service -FullShows syntax, parameters, examples and remarks before using an unfamiliar cmdlet.
- Find a command — Get-Command *dns*Searches available commands by name or verb/noun.
- Inspect object properties — Get-Service Spooler | Get-MemberShows which properties and methods can be filtered or exported.
- Record the session — Start-Transcript -Path C:\Temp\powershell-transcript.txtKeeps a useful command/output trail during an intervention.
System & identity
- Computer name — hostnameConfirms the machine actually being managed.
- User context — whoami /allShows current user, groups, SID and token privileges.
- Windows information — Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsArchitecture,CsNameChecks edition, version, architecture and computer name.
- Last boot — (Get-CimInstance Win32_OperatingSystem).LastBootUpTimeHelps spot long uptime or an unexpected recent reboot.
Processes & services
- Top CPU processes — Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 Name,Id,CPUQuickly identifies processes with the highest accumulated CPU time.
- Stopped services — Get-Service | Where-Object Status -eq 'Stopped' | Sort-Object DisplayNameInterpret in context: many services are intentionally stopped.
- Service status — Get-Service SpoolerChecks exact service name and state before any action.
- Targeted restart — Restart-Service Spooler -PassThruUse only after checking impact and dependencies.
Windows event logs
- Available logs — Get-WinEvent -ListLog * | Sort-Object RecordCount -Descending | Select-Object -First 20 LogName,RecordCountIdentifies large or specialized event logs.
- Recent System errors — Get-WinEvent -FilterHashtable @{LogName='System';Level=2;StartTime=(Get-Date).AddHours(-4)} -ErrorAction SilentlyContinue | Select-Object -First 30 TimeCreated,Id,ProviderName,MessageFilters recent errors to correlate them with the incident window.
- Event by ID — Get-WinEvent -FilterHashtable @{LogName='System';Id=41} -MaxEvents 20Useful to confirm frequency of a specific Event ID.
- Export an EVTX — wevtutil epl System C:\Temp\System.evtxKeeps a copy before cleanup or external analysis.
Network & DNS
- Full IP configuration — Get-NetIPConfigurationSummarizes IP, gateway and DNS per interface.
- Network adapters — Get-NetAdapter | Sort-Object Status,NameChecks state, link speed and active interface.
- DNS resolution — Resolve-DnsName exemple.frSeparates DNS issues from connectivity issues.
- Port test — Test-NetConnection serveur.exemple.local -Port 443Validates DNS, route and TCP establishment in one command.
Storage & files
- Volumes — Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter,FileSystemLabel,HealthStatus,Size,SizeRemainingChecks logical health and free space.
- Physical disks — Get-PhysicalDisk | Select-Object FriendlyName,MediaType,HealthStatus,OperationalStatus,SizeFollow with vendor diagnostics if a disk is Warning or Unhealthy.
- Large files — Get-ChildItem C:\Data -File -Recurse -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 20 FullName,LengthTarget a specific path to avoid expensive full-volume scans.
- SHA-256 hash — Get-FileHash C:\Temp\fichier.zip -Algorithm SHA256Lets you compare integrity between file copies.
Remote administration
- Test WinRM — Test-WSMan serveur01Checks WinRM before opening a remote session.
- Remote session — Enter-PSSession -ComputerName serveur01Interactive session: use a dedicated admin account and exit cleanly.
- Remote command — Invoke-Command -ComputerName serveur01 -ScriptBlock { Get-Service }Better for one-shot, scriptable collection.
- Credentials — $cred = Get-CredentialStores a PSCredential object in memory rather than plain text.
Pipeline, filters & exports
- Filter objects — Get-Service | Where-Object Status -eq 'Running'Filters objects by properties rather than displayed text.
- Select properties — Get-Process | Select-Object Name,Id,CPU,WorkingSetRestricts output to useful properties.
- Export CSV — Get-Service | Select-Object Name,Status,StartType | Export-Csv C:\Temp\services.csv -NoTypeInformation -Encoding UTF8Produces a file suitable for Excel or another tool.
- Export JSON — Get-NetIPConfiguration | ConvertTo-Json -Depth 5 | Set-Content C:\Temp\network.json -Encoding UTF8Useful for attaching structured state to a ticket.
Key points
- Some commands require elevation or optional RSAT modules.
- Capture the initial state before running change commands.
- An empty result is not always an error; verify permissions, filters and remote context.
- On production servers, prefer targeted collection over heavy recursive commands.