Powershell Cheatsheet

PowerShell is a shell and scripting language built on .NET. Unlike POSIX shells it passes objects down the pipeline rather than text, so Get-Process | Sort-Object CPU sorts real numbers instead of parsing columns.

ℹ️ PowerShell 7+ (pwsh) is cross-platform and current; Windows PowerShell 5.1 (powershell.exe) ships with Windows and is in maintenance. Check with $PSVersionTable.

🔎 Finding Your Way

# what commands exist for a noun?
Get-Command *service*
Get-Command -Module Microsoft.PowerShell.Management

# help, with the part everyone actually wants
Get-Help Get-ChildItem -Examples
Get-Help Get-ChildItem -Full
Update-Help

# what properties and methods does this object have?
Get-Process | Get-Member

# what did that command actually return?
Get-Process | Select-Object -First 1 | Format-List *

📦 Variables

📚 Arrays

🗂 Hash Tables

🔤 Strings

💬 Comments & Escaping

# a single-line comment

<#
  a block comment, also used for help text
#>

# the backtick is the escape character
Write-Output "He said `"hi`""
Write-Output "line one`nline two"

# and the line-continuation character
Get-ChildItem -Path C:\ `
              -Recurse `
              -Filter *.log

📁 Files & Paths

# read a large file line by line without loading it all
Get-Content big.log -ReadCount 1000 | ForEach-Object { $_ }

# tail -f
Get-Content app.log -Wait -Tail 20

# every .log modified in the last day
Get-ChildItem C:\logs -Recurse -Filter *.log |
  Where-Object LastWriteTime -gt (Get-Date).AddDays(-1)

🔀 Flow Control

if ($x -eq 5) { "five" } elseif ($x -gt 5) { "more" } else { "less" }

while ($x -lt 10) { $x; $x++ }

do { $x++ } while ($x -lt 10)

for ($i = 0; $i -lt 10; $i++) { $i }

foreach ($file in Get-ChildItem C:\) { $file.Name }

1..10 | ForEach-Object { $_ * 2 }

# parallel, PowerShell 7+
1..10 | ForEach-Object -Parallel { Start-Sleep 1; $_ } -ThrottleLimit 5

switch ($value) {
  'a'       { 'letter a'; break }
  { $_ -gt 10 } { 'big' }
  default   { 'something else' }
}

⚖️ Operators

⚠️ Comparisons are case-insensitive by default. Use -ceq, -clike, -cmatch when case matters.

🧱 Objects & the Pipeline

# properties and methods
(Get-Date).Date
(Get-Date).AddDays(-7)
"string".ToUpper()

# static members
[DateTime]::Now
[Math]::Round(3.14159, 2)
[System.Net.Dns]::GetHostByAddress("127.0.0.1")

# build your own objects
[pscustomobject]@{ Name = 'web01'; Status = 'up' }

# add a calculated property
Get-Process | Select-Object Name, @{ Name = 'MB'; Expression = { [math]::Round($_.WorkingSet / 1MB, 1) } }

🔍 Filter, Sort, Group, Format

💡 Format-* is always the last step — its output is display text, not objects, so nothing downstream can filter it.

🧰 Functions & Scripts

function Get-Square {
  param(
    [Parameter(Mandatory)][int]$Number,
    [switch]$Verbose
  )
  $Number * $Number
}

Get-Square -Number 7

# an advanced function: pipeline input, -WhatIf, -Verbose for free
function Remove-OldLog {
  [CmdletBinding(SupportsShouldProcess)]
  param(
    [Parameter(ValueFromPipeline)][string]$Path,
    [int]$Days = 30
  )
  process {
    if ($PSCmdlet.ShouldProcess($Path, "delete")) {
      Remove-Item $Path
    }
  }
}

🚨 Error Handling

try {
  Get-Content missing.txt -ErrorAction Stop
}
catch [System.IO.FileNotFoundException] {
  Write-Warning "no such file"
}
catch {
  Write-Error "unexpected: $($_.Exception.Message)"
}
finally {
  "always runs"
}

# make non-terminating errors terminate, so catch can see them
Get-Item missing -ErrorAction Stop

# per-session default
$ErrorActionPreference = 'Stop'

# the most recent error, and the exit code of the last native command
$Error[0]
$LASTEXITCODE
$?

🌐 Web & Data

# REST calls, parsed into objects
$data = Invoke-RestMethod https://api.github.com/repos/vuejs/core
$data.stargazers_count

# with headers and a JSON body
Invoke-RestMethod -Uri $url -Method Post `
  -Headers @{ Authorization = "Bearer $token" } `
  -ContentType 'application/json' `
  -Body (@{ name = 'demo' } | ConvertTo-Json)

# the raw response, for scraping or downloads
Invoke-WebRequest $url -OutFile page.html

# convert between formats
Get-Process | Select-Object Name, Id | ConvertTo-Json
Get-Content data.json | ConvertFrom-Json
Import-Csv users.csv | Where-Object Dept -eq 'IT' | Export-Csv it.csv -NoTypeInformation
Export-Clixml / Import-Clixml   # round-trips real objects

🖥 System Administration

# processes
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Stop-Process -Name notepad -Force

# services
Get-Service | Where-Object Status -eq 'Running'
Restart-Service -Name Spooler
Set-Service -Name Spooler -StartupType Manual

# background jobs
$job = Start-Job { Start-Sleep 10; "done" }
Receive-Job $job -Wait

# scheduled tasks, event logs, system info
Get-ScheduledTask
Get-WinEvent -LogName System -MaxEvents 20
Get-CimInstance Win32_LogicalDisk | Select-Object DeviceID, FreeSpace
Test-Connection example.com -Count 2

🔗 Remoting

# one command on many machines
Invoke-Command -ComputerName web01, web02 -ScriptBlock { Get-Service Spooler }

# an interactive session
Enter-PSSession -ComputerName web01
Exit-PSSession

# a reusable session
$s = New-PSSession -ComputerName web01 -Credential (Get-Credential)
Invoke-Command -Session $s { hostname }
Remove-PSSession $s

📦 Modules & Execution Policy

# find, install, load
Find-Module Pester
Install-Module Pester -Scope CurrentUser
Import-Module Pester
Get-Module -ListAvailable

# where does PowerShell look for modules?
$env:PSModulePath -split [IO.Path]::PathSeparator

# scripts refuse to run? check and relax the policy
Get-ExecutionPolicy -List
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

# your profile script
notepad $PROFILE

🧾 Automatic Variables

💾 PSDrives

Set-Location HKLM:\SOFTWARE
Get-ChildItem Env: | Sort-Object Name
Get-ChildItem Variable:

⌨️ Aliases Worth Knowing

⚠️ Aliases are for the console, not for scripts — write the full cmdlet name in anything you commit.

🔣 Regular Expressions

# -match fills $Matches
if ("build-1234" -match '(?<name>\w+)-(?<id>\d+)') { $Matches.id }

# extract every match from a file
Select-String -Path app.log -Pattern '\b\d{1,3}(\.\d{1,3}){3}\b' -AllMatches |
  ForEach-Object { $_.Matches.Value } | Sort-Object -Unique

PowerShell uses the .NET regex engine — see .NET regular expressions.

📚 Resources

• PowerShell documentation
• Cmdlet reference
• PowerShell Gallery
• Style guide (community)