Back to All Cheatsheet Libraries
cheatsheets
A searchable reference of 100 essential cmdlets for Windows sysadmins, core pipeline/object concepts, and habits for working faster and safer.
Total Cmdlets: 0
| Category | Cmdlet | Description |
|---|---|---|
| System Info | Get-Command | Lists all available PowerShell commands. |
| System Info | Get-Help | Accesses the help documentation for a cmdlet. |
| System Info | Get-Hotfix | Retrieves information about installed hotfixes/patches. |
| System Info | Get-Service | Lists all installed services and their status. |
| System Info | Get-Process | Displays running processes on the system. |
| System Info | Get-EventLog | Accesses classic event log data. |
| System Info | Get-WmiObject | Queries WMI (Windows Management Instrumentation) objects. |
| System Info | Get-WinEvent | Retrieves event log data with advanced filtering options. |
| System Info | Get-Counter | Accesses performance counter data. |
| System Info | Get-WindowsFeature | Displays installed Windows Server roles/features. |
| Active Directory | Get-ADUser | Retrieves Active Directory user information. |
| Active Directory | Get-ADGroup | Lists Active Directory groups. |
| Active Directory | Get-ADComputer | Fetches Active Directory computer object information. |
| Active Directory | Set-ADUser | Modifies Active Directory user properties. |
| Active Directory | Set-ADGroup | Modifies Active Directory group properties. |
| Active Directory | Set-ADComputer | Modifies Active Directory computer object properties. |
| Active Directory | Get-ADDomain | Retrieves Active Directory domain information. |
| Active Directory | Get-ADOrganizationalUnit | Lists Active Directory organizational units (OUs). |
| Active Directory | Get-ADDomainController | Fetches Active Directory domain controller information. |
| Active Directory | Get-ADSite | Displays Active Directory site information. |
| Active Directory | Get-ADFineGrainedPasswordPolicy | Views fine-grained password policies in Active Directory. |
| Networking | Get-NetAdapter | Displays network adapter information. |
| Networking | Get-NetConnectionProfile | Views network connection profiles (Public/Private/Domain). |
| Networking | Test-NetConnection | Checks network connectivity to a specific host or port. |
| Networking | Enable-NetAdapter | Enables a network adapter. |
| Networking | Disable-NetAdapter | Disables a network adapter. |
| Networking | Get-NetIPAddress | Lists IP addresses assigned to network adapters. |
| Networking | Get-NetRoute | Displays IP routing table information. |
| Networking | Get-NetTCPConnection | Shows current TCP connections. |
| Networking | Get-NetUDPEndpoint | Lists active UDP connections. |
| Networking | Get-NetNat | Views Network Address Translation (NAT) settings. |
| Networking | Get-NetNatTransitionConfiguration | Fetches NAT64/DNS64 configuration. |
| Networking | New-NetIPAddress | Creates a new static IP address on an interface. |
| Networking | New-NetRoute | Creates a new IP route. |
| Networking | New-NetTCPAcl | Creates a new TCP access control list entry. |
| Networking | Set-NetTCPSetting | Configures TCP stack settings. |
| Networking | Get-DnsClient | Displays DNS client settings per interface. |
| Networking | Set-DnsClientServerAddress | Sets DNS server addresses for an interface. |
| Networking | Get-NetAdapterAdvancedProperty | Lists advanced driver properties of a network adapter. |
| Networking | Get-NetAdapterBinding | Displays network adapter protocol bindings. |
| Networking | Test-Connection | Pings a remote host (PowerShell's ping equivalent). |
| Firewall | Get-NetFirewallProfile | Shows firewall profiles (Domain/Private/Public). |
| Firewall | Get-NetFirewallRule | Retrieves firewall rules. |
| Firewall | Set-NetFirewallRule | Modifies an existing firewall rule. |
| Firewall | New-NetFirewallRule | Creates a new firewall rule. |
| Firewall | Get-NetFirewallAddressFilter | Shows address filters attached to a firewall rule. |
| Firewall | Get-NetFirewallPortFilter | Shows port filters attached to a firewall rule. |
| Firewall | Get-NetFirewallApplicationFilter | Shows application filters attached to a firewall rule. |
| Filesystem | Get-ChildItem | Lists files and directories (aliased as ls, dir). |
| Filesystem | Set-Item | Modifies the value/properties of an item. |
| Filesystem | New-Item | Creates a new file, directory, or registry key. |
| Filesystem | Remove-Item | Deletes a file, directory, or other item. |
| Filesystem | Copy-Item | Copies a file or directory. |
| Filesystem | Move-Item | Moves a file or directory. |
| Filesystem | Get-Content | Displays the content of a file (aliased as cat, type). |
| Filesystem | Set-Content | Writes/overwrites the content of a file. |
| Filesystem | Test-Path | Checks if a file, directory, or registry key exists. |
| Filesystem | New-PSDrive | Maps a drive to a location in the PowerShell namespace. |
| Disks & Storage | Get-Volume | Lists information about volumes. |
| Disks & Storage | Get-Disk | Retrieves information about physical disks. |
| Disks & Storage | Initialize-Disk | Initializes a new, uninitialized disk. |
| Disks & Storage | New-Partition | Creates a new partition on a disk. |
| Disks & Storage | Format-Volume | Formats a volume with a file system. |
| Disks & Storage | Get-DedupStatus | Checks the status of data deduplication on a volume. |
| Disks & Storage | Start-DedupJob | Starts a data deduplication job. |
| Disks & Storage | Get-DedupJob | Views data deduplication job status. |
| Data & Pipeline | Select-Object | Chooses specific properties to display from an object. |
| Data & Pipeline | Sort-Object | Sorts objects based on specified properties. |
| Data & Pipeline | Where-Object | Filters objects based on specified criteria. |
| Data & Pipeline | Measure-Object | Calculates properties of objects, like count or size. |
| Data & Pipeline | Group-Object | Groups objects by a shared property value. |
| Data & Pipeline | Out-File | Redirects pipeline output to a file. |
| Data & Pipeline | Export-Csv | Exports objects to a CSV file. |
| Data & Pipeline | Import-Csv | Imports rows from a CSV file as objects. |
| Data & Pipeline | ConvertTo-Json | Converts objects to JSON format. |
| Data & Pipeline | ConvertFrom-Json | Converts JSON text into PowerShell objects. |
| Data & Pipeline | Get-Date | Displays the current date and time. |
| Data & Pipeline | Get-Random | Generates a random number or picks a random element. |
| Scheduled Tasks | Get-ScheduledTask | Lists scheduled tasks. |
| Scheduled Tasks | New-ScheduledTask | Defines a new (unregistered) scheduled task object. |
| Scheduled Tasks | Register-ScheduledTask | Registers a scheduled task with Task Scheduler. |
| Scheduled Tasks | Unregister-ScheduledTask | Removes a scheduled task. |
| Printers | Get-Printer | Retrieves information about installed printers. |
| Printers | Add-Printer | Installs a new printer. |
| Printers | Remove-Printer | Uninstalls a printer. |
| Windows Update | Get-WindowsUpdate | Checks for available Windows updates (PSWindowsUpdate module). |
| Windows Update | Install-WindowsUpdate | Installs available Windows updates. |
| Windows Update | Uninstall-WindowsUpdate | Uninstalls a specific Windows update. |
| Hyper-V | Get-HyperVVM | Views Hyper-V virtual machines (alias context for Get-VM). |
| Hyper-V | Get-VM | Displays information about VMs on Hyper-V hosts. |
| Hyper-V | New-VM | Creates a new virtual machine on a Hyper-V host. |
| Hyper-V | Start-VM | Starts a virtual machine. |
| Hyper-V | Stop-VM | Stops a virtual machine. |
| Hyper-V | Remove-VM | Removes a virtual machine. |
| Remoting | Enter-PSSession | Starts an interactive session on a remote computer. |
| Remoting | Invoke-Command | Runs a command or script block on one or more remote computers. |
| Power & Policy | Restart-Computer | Restarts the local or a remote computer. |
| Power & Policy | Stop-Computer | Shuts down the local or a remote computer. |
| Power & Policy | Set-ExecutionPolicy | Changes the PowerShell script execution policy. |
| Power & Policy | Set-Service | Modifies the startup type or status of a service. |
Core Language Concepts
Verb-Noun Naming
Every cmdlet follows a strict Verb-Noun pattern (Get-Process, Set-Service) — run Get-Verb to see the full list of approved verbs, so a cmdlet's behavior is guessable from its name alone.
Objects, Not Text
PowerShell's pipeline passes real .NET objects between cmdlets, not plain text — Get-Process | Sort-Object CPU sorts by an actual numeric property, no text-parsing required like in a traditional shell.
The Pipeline (|)
Chains cmdlets so each one's output objects become the next one's input — Get-Service | Where-Object Status -eq 'Running' | Select-Object Name reads left to right as one continuous filter.
Providers & PSDrives
PowerShell exposes the filesystem, registry, certificate store, and more through the same drive-letter-like interface — cd HKLM:\ navigates the registry exactly like navigating C:\.
Modules
Cmdlets are packaged in modules (ActiveDirectory, Hyper-V, NetSecurity) — Import-Module loads one explicitly, though most modern modules auto-load on first use of one of their cmdlets.
Profile Scripts
$PROFILE points to a script that runs on every new session — the standard place to define personal aliases, functions, and module imports.
Common Parameters
-WhatIf
-Confirm
-Verbose
-ErrorAction
Syntax Quick Reference
| Syntax | Purpose |
|---|---|
$var = "value" | Declares a variable — no type declaration required. |
if ($x -eq 1) { } | Conditional — comparison operators are word-based (-eq, -ne, -gt, -lt), not symbols. |
foreach ($i in $items) { } | Loops over a collection. |
function Get-Thing { param($Name) ... } | Defines a custom function, itself following Verb-Noun convention. |
try { } catch { } | Error handling — catches terminating errors thrown in the try block. |
$obj.Property | Dot notation to access an object's property, same as most OOP languages. |
"text $var here" | Double-quoted strings interpolate variables; single-quoted strings don't. |
1
Use Tab completion aggressively
Type a partial cmdlet or parameter name and press Tab (or Ctrl+Space for a menu) — PowerShell completes cmdlet names, parameters, file paths, and even enum values like service status.
2
Get-Help -Examples before guessing syntax
Get-Help Get-ADUser -Examples shows real, runnable usage patterns — far faster than reconstructing correct parameter syntax from the full help page.
3
Get-Member reveals what an object actually has
Get-Process | Get-Member lists every property and method on the objects flowing through the pipeline — the fastest way to discover what you can filter, sort, or select on.
4
Test with -WhatIf before running a bulk change
Any cmdlet that supports it (most Set-/Remove-/New- cmdlets) can preview exactly what it would do — run once with -WhatIf, review the output, then run for real.
Quick Tips
Understand execution policy before fighting it
"Running scripts is disabled" is Set-ExecutionPolicy's default, a safety speed bump — not real security. RemoteSigned is the common sensible default for an admin workstation, not Unrestricted.
Invoke-Command scales better than Enter-PSSession
Enter-PSSession is for interactive one-at-a-time work; Invoke-Command -ComputerName (server1,server2,server3) runs the same script block against many machines in parallel — the real automation workhorse.
ISE is deprecated — use VS Code with the PowerShell extension
PowerShell ISE only supports Windows PowerShell 5.1, not PowerShell 7+ — Microsoft's own guidance is VS Code with the PowerShell extension for anything current.
Aliases are for the console, not for scripts
ls, cat, % (ForEach-Object), and ? (Where-Object) are convenient interactively, but full cmdlet names in saved scripts stay readable to someone without the same alias muscle memory. Never hardcode credentials in a script
Use
Get-Credential for an interactive prompt, or a proper secrets store (SecretManagement module, Azure Key Vault) for automation — a plaintext password in a .ps1 file is a real, common audit finding. RSAT provides the AD/DNS/DHCP cmdlets on a workstation
The ActiveDirectory module isn't built into Windows client OSes by default — install Remote Server Administration Tools (RSAT) to manage AD from a regular admin workstation instead of RDPing into a DC.
Total Cmdlets: 0
| Category | Cmdlet | Description |
|---|---|---|
| Connect | Connect-ExchangeOnline | Connects the session to Exchange Online — the first command run in any script or interactive session. |
| Mailboxes | Get-Mailbox | Retrieves one or more mailbox objects and their properties. |
| Mailboxes | Set-Mailbox | Modifies mailbox properties — quotas, forwarding, permissions defaults, and more. |
| Mailboxes | New-Mailbox | Creates a new user, shared, or resource mailbox. |
| Mailboxes | Remove-Mailbox | Deletes a mailbox — soft-deleted and recoverable for the retention window by default. |
| Mailboxes | Get-MailboxStatistics | Shows mailbox size, item count, and last logon time — the standard "how big is this mailbox" check. |
| Permissions | Get-MailboxPermission | Lists who has delegate access (Full Access, Send As, etc.) to a mailbox. |
| Permissions | Add-MailboxPermission | Grants a user delegate access to another mailbox. |
| Distribution Groups | Get-DistributionGroup | Lists distribution groups and their settings. |
| Distribution Groups | New-DistributionGroup | Creates a new distribution or mail-enabled security group. |
| Distribution Groups | Add-DistributionGroupMember | Adds a member to a distribution group. |
| Distribution Groups | Get-DistributionGroupMember | Lists the current members of a distribution group. |
| Mail Flow | Get-TransportRule | Lists mail flow rules (transport rules) applied to messages in transit. |
| Mail Flow | New-TransportRule | Creates a new mail flow rule — e.g. adding a disclaimer or blocking an attachment type. |
| Mail Flow | Get-MessageTrace | Traces a message's delivery path — the standard first step for "did this email arrive" tickets. |
| Mailboxes | Get-MailboxAutoReplyConfiguration | Reads a mailbox's automatic-reply (out-of-office) settings. |
| Mailboxes | Set-MailboxAutoReplyConfiguration | Sets a mailbox's automatic-reply message and schedule — useful for setting OOO on behalf of a user. |
| Mailboxes | Get-CalendarProcessing | Reads a resource mailbox's calendar booking settings (auto-accept, conflict handling). |
| Mailboxes | Get-InboxRule | Lists a mailbox's inbox rules — useful for auditing suspicious auto-forwarding after a compromise. |
| Devices | Get-MobileDevice | Lists mobile devices connected to a mailbox via ActiveSync. |
| Devices | Get-ActiveSyncDeviceStatistics | Shows sync status and last-connected time for a mobile device. |
| Org Settings | Get-OrganizationConfig | Shows tenant-wide Exchange Online configuration settings. |
| Org Settings | Get-AcceptedDomain | Lists domains the tenant accepts mail for. |
| Org Settings | Get-RemoteDomain | Shows settings for mail sent to a specific external domain. |
| Connect | Disconnect-ExchangeOnline | Closes the Exchange Online session and removes the imported temporary module. |
Total Cmdlets: 0
| Category | Cmdlet | Description |
|---|---|---|
| Connect | Connect-AzAccount | Signs in to Azure — the first command in any Az module session. |
| Subscriptions | Get-AzSubscription | Lists Azure subscriptions the signed-in account can access. |
| Subscriptions | Set-AzContext | Switches the active subscription/tenant for subsequent commands. |
| Resource Groups | Get-AzResourceGroup | Lists resource groups in the current subscription. |
| Resource Groups | New-AzResourceGroup | Creates a new resource group in a chosen region. |
| Resource Groups | Remove-AzResourceGroup | Deletes a resource group and everything inside it — irreversible. |
| Virtual Machines | Get-AzVM | Lists virtual machines and their properties. |
| Virtual Machines | New-AzVM | Provisions a new virtual machine. |
| Virtual Machines | Start-AzVM | Starts a stopped/deallocated VM. |
| Virtual Machines | Stop-AzVM | Stops a VM — add -StayProvisioned to stop without deallocating (still billed for compute). |
| Virtual Machines | Restart-AzVM | Restarts a running VM. |
| Storage | Get-AzStorageAccount | Lists storage accounts in the subscription. |
| Storage | New-AzStorageAccount | Creates a new storage account. |
| Key Vault | Get-AzKeyVault | Lists Key Vaults accessible to the current account. |
| Key Vault | Get-AzKeyVaultSecret | Retrieves a secret stored in a Key Vault. |
| Key Vault | Set-AzKeyVaultSecret | Creates or updates a secret in a Key Vault. |
| Entra ID | Connect-MgGraph | Connects to Microsoft Graph — the modern replacement for the retired AzureAD module. |
| Entra ID | Get-MgUser | Retrieves Entra ID (Azure AD) user information via Graph. |
| Entra ID | New-MgUser | Creates a new Entra ID user account. |
| Entra ID | Get-MgGroup | Retrieves Entra ID group information. |
| Entra ID | Get-MgGroupMember | Lists members of an Entra ID group. |
| Entra ID | New-MgGroupMember | Adds a member to an Entra ID group. |
| Access Control | Get-AzRoleAssignment | Lists Azure RBAC role assignments for a user, group, or scope. |
| Access Control | New-AzRoleAssignment | Grants an RBAC role to a principal at a chosen scope. |
| Connect | Disconnect-AzAccount | Signs out of the current Azure session. |
Covers both Microsoft's official SqlServer module and dbatools, the community module most working SQL Server DBAs actually reach for day to day.
Total Cmdlets: 0
| Category | Cmdlet | Description |
|---|---|---|
| SqlServer | Invoke-Sqlcmd | Runs a T-SQL script or query and returns the results as objects. |
| SqlServer | Get-SqlInstance | Retrieves a SQL Server instance object for further inspection via the SQLSERVER: provider. |
| SqlServer | Get-SqlDatabase | Lists databases on an instance and their properties. |
| SqlServer | Backup-SqlDatabase | Performs a full, differential, or log backup of a database. |
| SqlServer | Restore-SqlDatabase | Restores a database from a backup file. |
| SqlServer | Get-SqlAgentJob | Lists SQL Server Agent jobs and their schedules. |
| SqlServer | Start-SqlAgentJob | Manually triggers a SQL Server Agent job to run immediately. |
| SqlServer | Get-SqlLogin | Lists SQL Server logins on an instance. |
| SqlServer | New-SqlLogin | Creates a new SQL Server login (SQL or Windows-authenticated). |
| SqlServer | Get-SqlCredential | Lists SQL Server credential objects used for external access (e.g. to Azure Storage). |
| SqlServer | New-SqlCredential | Creates a new SQL Server credential object. |
| dbatools | Connect-DbaInstance | dbatools' connection cmdlet — returns a rich SMO object most other dbatools cmdlets accept as input. |
| dbatools | Get-DbaDatabase | Lists databases with far more detail (size, recovery model, last backup) than the native module in one call. |
| dbatools | Backup-DbaDatabase | A more flexible backup cmdlet than the native one — supports compression, striping, and cloud targets. |
| dbatools | Restore-DbaDatabase | Restores a database, and can auto-detect the correct backup chain from a folder of files. |
| dbatools | Test-DbaConnection | Diagnoses connectivity to a SQL Server instance — network, auth, and service-level checks in one command. |
| dbatools | Get-DbaDbUser | Lists database-level users (as opposed to server-level logins) in a database. |
| dbatools | Invoke-DbaQuery | dbatools' version of Invoke-Sqlcmd — often preferred for its more consistent object output. |
| dbatools | Get-DbaAgentJob | Lists SQL Server Agent jobs with richer status/history detail than the native cmdlet. |