askhacker

Powershell

This is a quick reference cheat sheet to getting started with Powershell scripting.

#Basic Commands

#Helper Commands

Powershell follows Verb-Noun format for their commands.

Some common Verbs:

Verb Description
Get Used to retrieve information.
Set Used to configure or change settings.
New Used to create new instances of objects.
Remove Used to delete or remove items.
Invoke Used to execute a specific action or operation.
Start Used to initiate a process or operation.
Stop Used to halt or terminate a process or operation.
Enable Used to activate or enable a feature.
Disable Used to deactivate or disable a feature.
Test Used to perform tests or checks.
Update Used to update or refresh data or configurations.

Lists available modules

Get-Module --ListAvailable

Lists available cmdlets and functions.

Get-Command -Module ActiveDirectory

Retrieves help

Get-Help <cmd>
Get-Help <cmd> -Examples
Get-Help -Name Get-Process -Parameter Id

Lists aliases and their corresponding cmdlet names.

Get-Alias | Select-Object Name, Definition

Get-Member: Displays the properties and methods of objects.

Get-Process | Get-Member

#Object Manipulation

Select-Object: Selects specific properties from objects or customizes their display.

Get-Process | Select-Object Name, CPU

Where-Object: Filters objects based on specified conditions.

Get-Service | Where-Object { $PSItem.Status -eq 'Running' }
#OR
Get-Service | ? { $_.Status -eq 'Running' }

Measure-Object: Calculates statistics, like sum, average, and count, for object properties.

Get-Process | Measure-Object -Property WorkingSet -Sum

ForEach-Object: Performs an operation on each object in a collection. (BEAWARE: Below command will prefix of files/folder in the current dir)

Get-ChildItem | ForEach-Object { Rename-Item $_ -NewName "Prefix_$_" }

Sort-Object: Sorts objects by specified properties.

Get-ChildItem | Sort-Object Length -Descending

Format-Table: Formats output as a table with specified columns.

Get-Service | Format-Table -AutoSize  # ft alias

Format-List: Formats output as a list of properties and values.

Get-Process | Format-List -Property Name, CPU  # fl alias

#FileSystem

New-Item -path file.txt -type 'file' -value 'contents'
New-Item -path file.txt -type 'dir' 
Copy-Item <src> -destination <dest>
Move-Item -path  <src> -destination <dest>
Remove-Item <file>
Test-Path <path>
Rename-Item -path <path> -newname <newname>

# using .NET Base Class Library
[System.IO.File]::WriteAllText('test.txt', '')   
[System.IO.File]::Delete('test.txt')            

Get-Content -Path "test.txt"
Get-Process | Out-File -FilePath "processes.txt"# Output to file
Get-Process | Export-Csv -Path "processes.csv"  # Output to csv
$data = Import-Csv -Path "data.csv"             # Import from csv

#System Management

#Windows Management Instrumentation

# Retrieve BIOS information
Get-CimInstance -ClassName Win32_BIOS                       
# Retrieve information about locally connected physical disk devices
Get-CimInstance -ClassName Win32_DiskDrive                  
# Retrieve information about install physical memory (RAM)
Get-CimInstance -ClassName Win32_PhysicalMemory             
# Retrieve information about installed network adapters (physical + virtual)
Get-CimInstance -ClassName Win32_NetworkAdapter             
# Retrieve information about installed graphics / video card (GPU)
Get-CimInstance -ClassName Win32_VideoController       

# List all the classNames
Get-CimClass | Select-Object -ExpandProperty CimClassName
# Explore the various WMI classes available in the root\cimv2 namespace
Get-CimClass -Namespace root\cimv2                          
# Explore the child WMI namespaces underneath the root\cimv2 namespace
Get-CimInstance -Namespace root -ClassName __NAMESPACE

#Network Management

# Test network connectivity to a remote host
Test-Connection -ComputerName google.com

# Retrieve network adapter information
Get-NetAdapter

# Retrieve IP address information
Get-NetIPAddress

# Retrieve routing table information
Get-NetRoute

# Test if a port is open on a remote host
Test-NetConnection google.com -Port 80

#User & Group Management

# Retrieve local user account information
Get-LocalUser

# Create a new local user account
New-LocalUser -Name NewUser -Password (ConvertTo-SecureString "Password123" -AsPlainText -Force)

# Remove a local user account
Remove-LocalUser -Name UserToRemove

# Retrieve local group information
Get-LocalGroup

# Add a member to a local group
Add-LocalGroupMember -Group Administrators -Member UserToAdd

#Security & Permissions

# Retrieve access control lists for file/dir
Get-Acl C:\Path\To\File.txt

# Set access control lists for a file/dir
Set-Acl -Path C:\Path\To\File.txt -AclObject $aclObject

#Registry Management

# Retrieve registry key values
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select DisplayName, DisplayVersion

# Set registry key values
Set-ItemProperty -Path "HKLM:\Software\MyApp" -Name "SettingName" -Value "NewValue"

# Create a new registry key value
New-ItemProperty -Path "HKCU:\Software\MyApp" -Name "NewSetting" -Value "NewValue" -PropertyType String

# Remove a registry key value
Remove-ItemProperty -Path "HKCU:\Software\MyApp" -Name "SettingToRemove"

# Check if a registry key exists
Test-Path "HKLM:\Software\MyApp"

#Scripting

#Variables

Initializing a variable with/without a specified type:

$var = 0                                                    
[int] $var = 'Trevor'         # (throws an exception)
[string] $var = 'Trevor'      # (doesn't throw an exception)
$var.GetType()

# Multiple Assigning
$a,$b,$c = 'a','b','c'

# Create an array
$arrayvar = @('va1','va2')

# Create dict
$dict = @{k1 = 'test'; k2 = 'best'}

Variable Commands

New-Variable -Name FirstName -Value Trevor
New-Variable FirstName -Value Trevor -Option <ReadOnly/Constant>     

Get-Variable                                              
Get-Variable | ? { $PSItem.Options -contains 'constant' } 
Get-Variable | ? { $PSItem.Options -contains 'readonly' }

Remove-Variable -Name firstname                          
# Removes ReadOnly var 
Remove-Variable -Name firstname -Force

Variable types int32, int64, string, bool

#Operators

# operators 
# (a <op> b)

= , += / -= , ++ / --
-eq / -ne , -lt / -gt , -le / -ge

$FirstName = 'Trevor'
$FirstName -like 'T*'
$true; $false #bool true/false

# ternary operator
$FoodToEat = $BaconIsYummy ? 'bacon' : 'beets'

# -notin or -in
'Celery' -in @('Bacon', 'Sausage', 'Steak') 

# output: True
5 -is [int32]

# regex match, array can be use
'Trevor' -match '^T\w*'

# Find multiple matches.
$regex = [regex]'(\w*)'
$regex.Matches('this is test').Value

#Structure

#I/O operation

"This displays a string"

Write-Host "color" -ForegroundColor Red 

$age = Read-host "Enter age"

$pwd = Read-host "password" -asSecureString

Clear-Host

#Flow Controls

IF(<#Condition#>){
<#Commands#>}ELSEIF(){}ELSE{}

Switch($var){
	"val1"{<#Commands#>; break}
    "val2"{<#Commands#>; break}
}

For($ct=0;$ct -le 3;$ct++){}

ForEach($var in $arr){}

while($var -ne 0){}

Do{}While()

#Function / Modules

#Example 1

function funcname{
    
    [CmdletBinding()]   
	param(
		[Parameter(Mandatory)]
		[String]$user
	)
	Write-Host "welcome " $user
    return "value"
}
$var = funcname -user pcb

#Example 2

function Get-EvenNumbers {
    [CmdletBinding()]
    param (
        [Parameter(ValueFromPipeline = $true)]
        [int] $Number
    )
    begin {<#command#>} 
    process {
        if ($Number % 2 -eq 0) {
            Write-Output $Number
        }
    }
    end {<#command#>}   
}
1..10 | Get-EvenNumbers

#Modules

# powershell looks module in the path
$env:PSModulePath

# lists all modules installed on system
Get-Module -ListAvailable
# modules imported into current session
Get-Module      

Import-Module <moduleName>
Remove-Module <moduleName>

Find-Module -Tag cloud
Find-Module -Name ps*

# Create an in-memory PowerShell module
New-Module -Name trevor -ScriptBlock {
  function Add($a,$b) { $a + $b } }

#Tips

  • In most of the languages, escape character is backslash \ whereas in powershell it is backtick `

#Also see