PowerShell Cheatsheet - PowerShell Command Reference

Most Windows scripting trouble comes from treating PowerShell as cmd: the pipeline carries objects, but you are concatenating text, so Where-Object and Sort-Object never get used. This table walks through basic commands, files and directories, content manipulation, pipelines and filtering, processes and services, networking and remoting, script authoring, and system administration, flagging where each command diverges from its Linux counterpart. The rule of thumb is whether output stays consumable: if Select-Object can pull a property, Where-Object can keep filtering; if you have to regex the text, you picked the wrong command. Reach for it when writing deployment or health-check scripts, bulk renaming or re-encoding files, diagnosing why a service will not start, or running one fix across dozens of machines. The boundary with bash is sharp: separators, line endings, and default encodings are all Windows-specific, and mixing shells produces results nobody can explain from the output alone.

SysOps·58 commands·Last updated 2026-07-21

Typical Use Case

For Windows administrators, developers and anyone automating daily tasks. The core idea is that the pipeline passes objects, not text, so each line of Get-Content output and every entry from Get-ChildItem can be filtered, projected, sorted, grouped, measured or looped over. Once that chain is natural, requests like listing the five highest memory processes into a CSV or finding the largest files under a directory collapse to a single line. Four side tracks are equally frequent: processes and services, web requests through Invoke-RestMethod, remote execution with Invoke-Command, and system information and event logs. Get-Command and Get-Help are the authoritative index.

Basic Commands 5

Get-Command

List all available PowerShell commands (cmdlets, functions, aliases)

Get-Help Get-Process

View command help, add -Detailed for more info

Get-Member

View properties and methods of pipeline objects

Get-Verb

List all PowerShell-approved verbs

Get-Alias

List all command aliases

File & Directory 8

Get-ChildItem

List directory contents, similar to ls/dir

Set-Location ..

Change directory, similar to cd

New-Item -ItemType Directory -Path C:\NewDir

Create new directory or file

Copy-Item src.txt dst.txt

Copy file or directory, similar to cp

Move-Item src.txt dst.txt

Move or rename file, similar to mv

Remove-Item file.txt

Delete file or directory, similar to rm

Rename-Item old.txt new.txt

Rename file or directory

Test-Path C:\path

Check if path exists, returns True/False

Content Operations 8

Get-Content file.txt

Read file content, similar to cat

Set-Content file.txt "text"

Write content to file (overwrite)

Add-Content file.txt "text"

Append content to file

Out-File output.txt

Write output to file

Export-Csv data.csv -NoTypeInformation

Export objects to CSV file

Import-Csv data.csv

Import objects from CSV file

ConvertTo-Json

Convert object to JSON format

ConvertFrom-Json

Create object from JSON string

Pipeline & Filtering 6

Where-Object { $_.Name -eq "svchost" }

Filter objects, similar to grep, can use where alias

Select-Object -First 10 Name,Id

Select object properties or first N items

Sort-Object Name -Descending

Sort objects by property

Group-Object Status

Group objects by property

Measure-Object -Sum -Average

Calculate numeric statistics (sum, average, etc.)

ForEach-Object { $_ * 2 }

Perform operation on each pipeline object

Process & Service 9

Get-Process

List all running processes, similar to ps

Get-Process -Name "chrome"

Find process by name

Stop-Process -Name "notepad"

Stop a process, similar to kill

Start-Process notepad.exe

Start a new process

Get-Service

List all Windows services

Start-Service Spooler

Start a service

Stop-Service Spooler

Stop a service

Restart-Service Spooler

Restart a service

Set-Service Spooler -StartupType Automatic

Set service startup type (Automatic/Manual/Disabled)

Network & Remote 6

Test-Connection 8.8.8.8

Test network connectivity, similar to ping

Test-NetConnection google.com -Port 443

Advanced network diagnostics, test port connectivity

Invoke-WebRequest -Uri https://api.example.com

Send HTTP/HTTPS request, similar to curl

Invoke-RestMethod -Uri https://api.example.com

Send REST API request, auto-parses JSON/XML

Enter-PSSession -ComputerName Server01

Enter remote PowerShell session, similar to SSH

Invoke-Command -ComputerName Server01 -ScriptBlock { Get-Process }

Execute command on remote machine

Scripting 8

$name = "World"

Define variable with $ prefix

$array = 1,2,3; $array[0]

Array definition and index access

$hash = @{ Name = "Tom"; Age = 30 }

Hashtable (dictionary) definition

if ($val -gt 10) { "big" } else { "small" }

Conditional, -gt/-lt/-eq for comparison

switch ($val) { 1 { "one" } default { "?" } }

Switch multi-branch condition

foreach ($item in $items) { $item }

Iterate over array or collection

function Say-Hello { param($name) "Hello $name" }

Define function with parameters

try { 1/0 } catch { "error: $_" } finally { "done" }

Exception handling try/catch/finally

System Management 8

Get-Date

Get current date and time

Set-Date "2026-01-01"

Set system date and time

Get-WmiObject Win32_Processor

Query system info via WMI (CPU)

Get-CimInstance Win32_LogicalDisk

Query disk info via CIM (recommended over WMI)

Format-Table Name,Id -AutoSize

Table format output with auto-sized columns

Format-List Name,Id

List format output, one property per line

Format-Wide Name -Column 4

Wide format output, multi-column display

Get-EventLog -LogName System -Newest 10

View system event log (latest 10 entries)

Parameter matrix

Parameter	Effect	Example
`Get-Command`	List all available commands (cmdlets/functions/aliases)	`Get-Command`
`Get-Help <Cmd> -Detailed`	View the help documentation for a command	`Get-Help Get-Process -Detailed`
`Get-Member`	View the properties and methods of pipeline objects	`Get-Process \| Get-Member`
`Get-Verb`	List the verbs approved by PowerShell	`Get-Verb`
`Get-Alias`	List all command aliases	`Get-Alias`
`Get-ChildItem`	List directory contents	`Get-ChildItem -Path D:/code`
`Set-Location ..`	Change directory	`Set-Location ..`
`New-Item -ItemType Directory`	Create a new directory	`New-Item -ItemType Directory -Path D:/NewDir`
`Copy-Item / Move-Item`	Copy / move (rename)	`Move-Item src.txt dst.txt`
`Remove-Item`	Delete a file or directory	`Remove-Item file.txt`
`Rename-Item`	Rename a file or directory	`Rename-Item old.txt new.txt`
`Test-Path`	Check whether a path exists	`Test-Path C:/path`
`Get-Content`	Read file contents	`Get-Content package.json`
`Set-Content`	Write to a file (overwrite)	`Set-Content file.txt "text"`
`Add-Content`	Append content to the end of a file	`Add-Content file.txt "text"`
`Out-File`	Write pipeline output to a file	`Get-Process \| Out-File output.txt`
`Export-Csv -NoTypeInformation`	Export objects as CSV (no type line)	`Get-Process \| Export-Csv data.csv -NoTypeInformation`
`Import-Csv`	Import objects from CSV	`Import-Csv data.csv`
`ConvertTo-Json`	Convert an object to a JSON string	`Get-Process \| Select-Object -First 3 \| ConvertTo-Json`
`ConvertFrom-Json`	Convert a JSON string to an object	`$o = $json \| ConvertFrom-Json`
`Where-Object { $_.Name -eq "svchost" }`	Filter objects by property	`Get-Process \| Where-Object { $_.Name -eq "svchost" }`
`Select-Object -First 10 Name,Id`	Select properties or take the first N items	`Get-Process \| Select-Object -First 10 Name,Id`
`Sort-Object Name -Descending`	Sort by property (optionally descending)	`Get-Process \| Sort-Object WS -Descending`
`Group-Object Status`	Group and count by property	`Get-Process \| Group-Object Status`
`Measure-Object -Sum -Average`	Compute statistics such as sum and average	`Get-Process \| Measure-Object WS -Sum -Average`
`ForEach-Object { $_ * 2 }`	Perform an action on each object	`1..3 \| ForEach-Object { $_ * 2 }`
`Get-Process -Name "chrome"`	Find a process by name	`Get-Process -Name "chrome"`
`Stop-Process -Name`	Terminate the specified process	`Stop-Process -Name "notepad"`
`Start-Process`	Start a new process	`Start-Process notepad.exe`
`Get-Service`	List all Windows services	`Get-Service`
`Start-Service / Stop-Service / Restart-Service`	Start / stop / restart a service	`Restart-Service Spooler`
`Set-Service -StartupType`	Set the startup type of a service	`Set-Service Spooler -StartupType Automatic`
`Test-Connection`	Test network connectivity	`Test-Connection 8.8.8.8`
`Test-NetConnection -Port`	Test port connectivity	`Test-NetConnection google.com -Port 443`
`Invoke-WebRequest`	Send HTTP/HTTPS requests	`Invoke-WebRequest -Uri https://api.example.com`
`Invoke-RestMethod`	Send REST requests and auto-parse the response	`Invoke-RestMethod -Uri https://api.example.com`
`Enter-PSSession -ComputerName`	Enter a remote PowerShell session	`Enter-PSSession -ComputerName Server01`
`Invoke-Command -ScriptBlock`	Run a command on a remote machine	`Invoke-Command -ComputerName Server01 -ScriptBlock { Get-Process }`
`$name = "World"`	Define a variable ($ prefix)	`$name = "World"`
`$array = 1,2,3; $array[0]`	Array definition and indexed access	`$array = 1,2,3; $array[0]`
`$hash = @{ Name = "Tom" }`	Hashtable definition	`$hash = @{ Name = "Tom"; Age = 30 }`
`if ($val -gt 10)`	Conditional test (-gt/-lt/-eq)	`if ($val -gt 10) { "big" } else { "small" }`
`switch ($val) { ... default { } }`	Multi-branch switch	`switch ($val) { 1 { "one" } default { "?" } }`
`foreach ($item in $items)`	Iterate over an array or collection	`foreach ($item in $items) { $item }`
`function Say-Hello { param($name) }`	Define a function with parameters	`function Say-Hello { param($name) "Hello $name" }`
`try / catch / finally`	Three-part exception handling	`try { 1/0 } catch { "error: $_" } finally { "done" }`
`Get-Date / Set-Date`	Get / set the system date and time	`Get-Date`
`Get-WmiObject Win32_Processor`	Query hardware info via WMI	`Get-WmiObject Win32_Processor`
`Get-CimInstance Win32_LogicalDisk`	Query disk info via CIM (recommended)	`Get-CimInstance Win32_LogicalDisk`
`Format-Table -AutoSize`	Table output with auto-aligned column widths	`Get-Process \| Format-Table Name,Id -AutoSize`
`Format-List`	List output, one property per line	`Get-Process \| Format-List Name,Id`
`Format-Wide -Column 4`	Wide-format multi-column output	`Get-ChildItem \| Format-Wide Name -Column 4`
`Get-EventLog -LogName System -Newest 10`	View the system event log	`Get-EventLog -LogName System -Newest 10`

Common pitfalls

SymptomYou cannot find the content with grep in the pipeline; the output is empty even though the file clearly contains that string.

CauseThe PowerShell pipeline passes object properties rather than raw text, so a Where-Object match on text content fails when the property name is wrong.

FixFirst use Get-Member to see which properties the object has; to filter by text, combine Select-String inside Where-Object instead of comparing a nonexistent property directly.

SymptomWriting bash-style ls, grep and curl in PowerShell all error out or behave unexpectedly.

CauseThese are aliases (Alias) pointing to Windows-compatible implementations; their argument semantics differ from the Unix-like versions and options may not be supported.

FixUse Get-Alias to find the real command an alias points to, and call canonical commands like Get-ChildItem / Where-Object / Invoke-RestMethod directly so argument behavior is predictable.

SymptomStop-Process or Remove-Service reports permission denied, yet it works fine in an elevated window.

CauseManaging processes and services is a system-level operation that requires an elevated session.

FixRun it from an elevated PowerShell; you can also confirm the target exists with Get-Process / Get-Service before acting.

SymptomGet-Process output has wide, cramped table columns and the key fields are truncated.

CauseOutput defaults to table format and wraps to the terminal width, so anything beyond the width is invisible when there are many columns.

FixUse Select-Object to keep only the columns you need together with Format-Table -AutoSize; or use Format-List on a single object to show each property on its own line.

SymptomThe CSV exported by Export-Csv shows a mess of type descriptions as the header in Excel.

CauseWithout -NoTypeInformation a type information line is written as the first line of the CSV.

FixAdd -NoTypeInformation when exporting, and if needed read it back with Import-Csv to verify the column names are clean.

SymptomYou defined a variable in an interactive session, but the next command sees it as empty.

CauseVariable scope is limited to the current scope by default; assignments inside functions or script blocks do not leak out, and variables are not shared between sessions either.

FixTo export it, prefix the variable with a script scope modifier or the $script: prefix; for long-term environment customization write it to your $profile file so it is not lost each time you reopen a session.

SymptomAfter Set-Content writes, all the original file content is gone.

CauseSet-Content has overwrite semantics, not append semantics, contrary to intuition.

FixUse Add-Content to append; before writing, confirm the path and content with Test-Path and Get-Content.

SymptomThe $ output of 1..3 | ForEach-Object { $_ } does not match the expected numbers, and string concatenation is a mess.

CauseEach element in the pipeline is not a fixed type; mixing strings and numbers causes implicit conversions that produce odd concatenation results.

FixFirst use Select-Object in the pipeline to narrow down to the single property you need before doing math; use explicit [int] or [string] casts when needed.

Troubleshooting

1Probe the object structure first when you are unsure which fields the pipeline has
Get-Process | Select-Object -First 1 | Get-Member
Get-Member lists the type name, property names and method names of the object. Only with accurate property names (such as Name, Id, WS) can you write Where-Object and Sort-Object that actually match something.
2Find the 5 most memory-hungry processes
Get-Process | Sort-Object WS -Descending | Select-Object -First 5 Name,Id,WS | Format-Table Name,Id -AutoSize
Sort by WS (working set memory) descending, take the first 5 and keep only the key columns so the table is not truncated. If an abnormally large process shows up, you can follow up with Stop-Process -Name to end it.
3Check whether a service is running and its startup type
Get-Service Spooler | Format-List Name,Status,StartType
Status shows Running or Stopped, and StartType shows Automatic / Manual / Disabled. If it is Stopped, start it with Start-Service Spooler; to enable it at boot, use Set-Service Spooler -StartupType Automatic.
4Troubleshoot an unreachable endpoint
Test-Connection 8.8.8.8; Test-NetConnection api.example.com -Port 443
The first step verifies ICMP reachability, the second verifies whether the target port is open. A successful ping with a closed port usually means the service is not listening or a firewall is blocking it; only when both fail is it a network-layer problem.
5Call a REST API and handle JSON
Invoke-RestMethod -Uri https://api.example.com/data | ConvertTo-Json
Invoke-RestMethod automatically parses JSON into an object you can use directly as a pipeline object; append ConvertTo-Json when you need to save it or inspect its structure. If the response is plain text rather than JSON, switch to Invoke-WebRequest and take its content.
6Export results to CSV and read them back to verify
Get-Process | Select-Object Name,Id | Export-Csv proc.csv -NoTypeInformation; Import-Csv proc.csv | Select-Object -First 3
Reading the file back with Import-Csv right after exporting and taking the first 3 rows verifies both that the header is clean (no type information line) and that the fields landed as expected, so you do not deliver data with a dirty header.
7Run diagnostic commands on a remote machine
Invoke-Command -ComputerName Server01 -ScriptBlock { Get-Service | Select-Object -First 5 Name,Status }
Results come back prefixed with the remote host, and nothing changes locally. For multi-step interactive troubleshooting, switch to Enter-PSSession -ComputerName Server01 to enter a session.
8Look for recent anomaly clues in the system
Get-EventLog -LogName System -Newest 10 | Format-List TimeGenerated,EntryType,Source,Message
Take the latest 10 entries and use Format-List to expand all fields; focus on entries whose Level/EntryType is Error and their Message, which usually points directly at the service or driver causing the problem.

Command Examples

Find the heaviest processes by CPU

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 Name, Id, @{N="MB";E={[math]::Round($_.WorkingSet64/1MB,1)}}

The pipeline is the heart of PowerShell: Get-Process produces objects, Sort-Object sorts them, and Select-Object projects the columns you need. MB is computed with a calculated property that converts bytes.

Output

Name           Id    MB
----           --  ----
chrome        1452  812.4
code          2031  496.0
Teams          1876  231.7

Kill all processes by name

Get-Process node -ErrorAction SilentlyContinue | Stop-Process -Force

-ErrorAction SilentlyContinue avoids an error when no process matches, which is handy for direct use in scripts. Confirm the list with Get-Process first before adding -Force.

Call a REST API with automatic JSON parsing

$r = Invoke-RestMethod -Uri https://api.github.com/users/octocat
$r.login
$r.public_repos

Invoke-RestMethod automatically turns JSON into an object whose properties you access with dots; Invoke-WebRequest returns raw text that you must ConvertFrom-Json yourself.

Output

octocat
8

Test port connectivity

Test-NetConnection github.com -Port 443

It pinpoints the problem better than manual ping: a successful ping only proves ICMP reachability, whereas this confirms whether the specific port is open.

Output

ComputerName     : github.com
RemoteAddress    : 140.82.121.4
RemotePort       : 443
TcpTestSucceeded : True

Common Pitfalls

Remove-Item -Recurse -Force deletes a whole tree with no prompt and bypasses the Recycle Bin — verify the path first.
Windows PowerShell 5.1 and PowerShell 7+ differ substantially; check $PSVersionTable in cross-version scripts.
Set-Content and Out-File default to UTF-16LE, which garbles output for other programs — specify -Encoding utf8.
Stop-Process -Force is an immediate kill that skips saving; try without -Force first.
Aliases are not resolved in non-interactive sessions — write full cmdlet names in scripts.

Tips

PowerShell uses Verb-Noun naming convention, e.g. Get-Process, Stop-Service
Use Get-Command to find available commands, Get-Help for documentation
Pipeline passes objects not text, use Get-Member to inspect object properties
Variables use $ prefix, e.g. $var = "hello"
Use $profile to customize your PowerShell environment, similar to .bashrc

FAQ

Does the PowerShell pipeline pass objects or text, and why does it matter?

Objects. Get-ChildItem emits FileInfo/DirectoryInfo instances, which is why Where-Object { $_.Name -eq "svchost" } can reach straight into .Name, .Length and .LastWriteTime instead of a chopped-up text line. It also explains the absence of grep — filter on properties, not on regex patterns. To discover what a command actually gives you, run Get-Member; call ToString() or Out-File explicitly when you do need text.

How do I find a process by name and kill it with Get-Process and Stop-Process?

List first with Get-Process -Name "chrome" — there may be several instances — and confirm which PIDs you actually want. Then stop them via Stop-Process -Name "notepad" or -Id <pid>. Note that Get-Process -Name "chrome" | Stop-Process kills every instance at once, which is risky; narrow the set with Where-Object { $_.Id -eq $pid } or review it with Select-Object Id,Path before pulling the trigger.

How do I quickly explore what a cmdlet can do while debugging a script?

Three tools cover it: Get-Command lists every cmdlet, function and alias so you can confirm the name exists and see what short names like ls, cd and where actually resolve to; Get-Help Get-Process opens the documentation, and -Detailed shows full parameters and examples; Get-Member inspects the properties and methods of what the pipeline emits, which is usually where a wrong argument shows up. Keep environment tweaks in $profile and guard failures with try/catch/finally.

Enter-PSSession or Invoke-Command when working on a remote machine?

It depends on interaction. Invoke-Command -ComputerName Server01 -ScriptBlock { Get-Process } is one-shot and non-interactive: the block runs remotely, the output prints locally, and the session drops when it finishes — ideal for sweeps. Enter-PSSession -ComputerName Server01 opens a persistent session where you sit inside the remote context, can re-run commands, read Get-Help and set variables, with your changes applied on the target until you exit. Check reachability with Test-NetConnection first.

How do I turn a query result into a readable table or a CSV file?

Append a formatting cmdlet to the pipeline: Format-Table Name,Id -AutoSize auto-sizes the columns, switch to Format-List Name,Id when there are too many properties to fit on one line, and Format-Wide Name -Column 4 for multi-column output. When you need the data on disk, Export-Csv data.csv -NoTypeInformation (the flag drops the type header so other tools can parse it) and read it back with Import-Csv. Filter and sort first — for example Get-Process | Sort-Object WS -Descending | Select-Object -First 10.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Linux man-pages

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.

Typical Use Case

Basic Commands 5

File & Directory 8

Content Operations 8

Pipeline & Filtering 6

Process & Service 9

Network & Remote 6

Scripting 8

System Management 8

Parameter matrix

Common pitfalls

Troubleshooting

Command Examples

Find the heaviest processes by CPU

Kill all processes by name

Call a REST API with automatic JSON parsing

Test port connectivity

Common Pitfalls

Tips

FAQ

Related Cheatsheets

Share

Official References

Maintained by LaoHand

Contact Us