PowerShell for Beginners

PowerShell = Command-line shell + Scripting language
- Built on .NET Framework
- Object-oriented (not just text!)
- Designed for automation
- Cross-platform (PowerShell 7+)
- Essential for Windows administration

✗ Text-based output only
✗ Limited scripting
✗ Older commands (dir, cd, copy)
✗ Less powerful

✓ Object-based output
✓ Full scripting language
✓ Modern cmdlets (Get-ChildItem, Set-Location, Copy-Item)
✓ Access to .NET Framework
✓ Aliases for cmd commands

Cmdlet = Command + Let (small command)
Format: Verb-Noun

Examples:
Get-Process      # Get list of processes
Stop-Service     # Stop a service
New-Item         # Create new item (file/folder)
Set-Location     # Change directory

Get-    = Retrieve information
Set-    = Change/configure
New-    = Create new item
Remove- = Delete item
Start-  = Start process/service
Stop-   = Stop process/service
Test-   = Test/verify
Invoke- = Execute/run

# Get all cmdlets
Get-Command

# Get all "Get" cmdlets
Get-Command -Verb Get

# Get all Process cmdlets
Get-Command -Noun Process

# Count cmdlets
(Get-Command).Count

Start Menu → Windows PowerShell
Or: Win + X → Windows PowerShell

Right-click → Run as Administrator

$PSVersionTable

# PowerShell cmdlet
Get-Location

# Alias (like Linux pwd)
pwd

# Short form
gl

# PowerShell cmdlet
Set-Location C:\Users

# Alias (like cd)
cd C:\Users

# Go to home directory
cd ~

# Go up one level
cd ..

# Go to previous location
cd -

# PowerShell cmdlet
Get-ChildItem

# Alias
ls
dir
gci

# Show hidden files
Get-ChildItem -Force

# Recurse into subdirectories
Get-ChildItem -Recurse

# Filter by extension
Get-ChildItem *.txt

# In cmd: Text output
dir | findstr "file"

# In PowerShell: Objects!
Get-ChildItem | Where-Object {$_.Length -gt 1MB}

# Get large files
Get-ChildItem | Where-Object {$_.Length -gt 1MB}

# Get running processes using over 100MB
Get-Process | Where-Object {$_.WorkingSet -gt 100MB}

# Stop a process
Get-Process notepad | Stop-Process

# Get services and filter
Get-Service | Where-Object {$_.Status -eq "Running"}

# Get a process
$proc = Get-Process | Select-Object -First 1

# View object properties
$proc | Get-Member

# Access properties
$proc.Name
$proc.Id
$proc.CPU

# Get properties and methods
Get-Process | Get-Member

# Properties (data about the object)
Name, Id, CPU, Memory, etc.

# Methods (actions you can perform)
Kill(), Refresh(), etc.

# Basic help
Get-Help Get-Process

# Detailed help
Get-Help Get-Process -Detailed

# Full help with examples
Get-Help Get-Process -Full

# Examples only
Get-Help Get-Process -Examples

# Online help (opens browser)
Get-Help Get-Process -Online

# Update help files (run as Admin)
Update-Help

# Update for specific module
Update-Help -Module Microsoft.PowerShell.Management

# Find cmdlets with "process" in name
Get-Command *process*

# Find cmdlets that work with services
Get-Command -Noun Service

# Search by verb
Get-Command -Verb Get

# Find aliases
Get-Alias

# Find what command an alias points to
Get-Alias ls
Get-Alias dir

# Create new file
New-Item file.txt -ItemType File

# Create new directory
New-Item MyFolder -ItemType Directory

# Copy file
Copy-Item file.txt file_backup.txt

# Move file
Move-Item file.txt C:\Destination\

# Remove file
Remove-Item file.txt

# Remove directory
Remove-Item MyFolder -Recurse

# Test if file exists
Test-Path file.txt

# Read file
Get-Content file.txt

# Read first 10 lines
Get-Content file.txt -Head 10

# Read last 10 lines
Get-Content file.txt -Tail 10

# Write to file (overwrite)
Set-Content file.txt "Hello, World!"

# Append to file
Add-Content file.txt "New line"

# Create file with content
"Hello" | Out-File file.txt

# Get all processes
Get-Process

# Get specific process
Get-Process -Name chrome

# Sort by CPU usage
Get-Process | Sort-Object CPU -Descending

# Stop a process
Stop-Process -Name notepad

# Stop process by ID
Stop-Process -Id 1234

# Start a process
Start-Process notepad

# Get all services
Get-Service

# Get running services
Get-Service | Where-Object {$_.Status -eq "Running"}

# Get specific service
Get-Service -Name wuauserv

# Start service (as Admin)
Start-Service -Name wuauserv

# Stop service (as Admin)
Stop-Service -Name wuauserv

# Restart service (as Admin)
Restart-Service -Name wuauserv

Alias = Shortcut name for cmdlet
Makes PowerShell feel familiar to cmd/bash users

# Navigation
cd   → Set-Location
pwd  → Get-Location
ls   → Get-ChildItem
dir  → Get-ChildItem

# File operations
cp   → Copy-Item
mv   → Move-Item
rm   → Remove-Item
cat  → Get-Content

# Other
cls  → Clear-Host
man  → Get-Help
ps   → Get-Process
kill → Stop-Process

# List all aliases
Get-Alias

# Find alias for cmdlet
Get-Alias -Definition Get-ChildItem

# Find cmdlet for alias
Get-Alias ls

ISE = Integrated Scripting Environment
- Built into Windows
- Script editor + console
- IntelliSense (auto-complete)
- Debugging tools

Start Menu → Windows PowerShell ISE
Or: Run as Administrator for full access

✓ Modern editor
✓ PowerShell extension
✓ Better than ISE
✓ Cross-platform
✓ Git integration

Execution Policy = Security feature
Controls whether scripts can run
Not for security! Prevents accidental execution

Restricted    = No scripts allowed (default)
AllSigned     = Only signed scripts
RemoteSigned  = Local scripts OK, remote must be signed
Unrestricted  = All scripts allowed
Bypass        = Nothing is blocked

# View current policy
Get-ExecutionPolicy

# View all scopes
Get-ExecutionPolicy -List

# Set for current user (no Admin needed)
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

# Set for entire machine (requires Admin)
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

# Bypass for single command
powershell -ExecutionPolicy Bypass -File script.ps1

# Create script
"Write-Host 'Hello, World!'" | Out-File hello.ps1

# Run script (from same directory)
.\hello.ps1

# Run with full path
C:\Scripts\hello.ps1

# Run from anywhere (add to PATH)
hello.ps1

# Run script in current scope (keeps variables/functions)
. .\script.ps1

# Find files larger than 100MB
Get-ChildItem -Recurse | Where-Object {$_.Length -gt 100MB} | Sort-Object Length -Descending

# Get running services sorted by name
Get-Service | Where-Object {$_.Status -eq "Running"} | Sort-Object Name

# Stop all Chrome processes
Get-Process chrome -ErrorAction SilentlyContinue | Stop-Process -Force

# Search for "password" in all .txt files
Get-ChildItem -Recurse -Filter *.txt | Select-String "password"

# Export process list to CSV
Get-Process | Export-Csv processes.csv -NoTypeInformation

# Local users
Get-LocalUser

# Active Directory users (requires AD module)
Get-ADUser -Filter *

# Active connections
Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}

# Installed applications
Get-WmiObject -Class Win32_Product | Select-Object Name, Version

# Network shares
Get-SmbShare

# Download file
Invoke-WebRequest -Uri "http://example.com/file.txt" -OutFile "file.txt"

Tab             = Auto-complete
Ctrl + Space    = IntelliSense (ISE/VS Code)
Up/Down Arrow   = Command history
F7              = Command history window
Ctrl + C        = Cancel current command
Ctrl + L        = Clear screen (or: cls)
Ctrl + R        = Reverse search history

Navigation:
Get-Location (pwd, gl)          # Current directory
Set-Location (cd, sl)            # Change directory
Get-ChildItem (ls, dir, gci)     # List files

File Operations:
New-Item                         # Create file/folder
Copy-Item (cp, copy)             # Copy
Move-Item (mv, move)             # Move/rename
Remove-Item (rm, del)            # Delete
Get-Content (cat, type, gc)      # Read file

Help:
Get-Help <cmdlet>                # Get help
Get-Command                      # Find cmdlets
Get-Alias                        # List aliases
Get-Member                       # Object properties/methods

Pipeline:
|                                # Pipe objects
Where-Object                     # Filter
Select-Object                    # Select properties
Sort-Object                      # Sort

# Wrong:
script.ps1

# Right:
.\script.ps1

# cmd way (works but not PowerShell way):
dir /s

# PowerShell way:
Get-ChildItem -Recurse

# Less efficient:
$procs = Get-Process
foreach ($proc in $procs) {
    if ($proc.CPU -gt 100) {
        Write-Host $proc.Name
    }
}

# PowerShell way:
Get-Process | Where-Object {$_.CPU -gt 100} | Select-Object Name

Get-Help about_*                 # All "about" topics
Get-Help about_Variables         # Learn about variables
Get-Help about_Operators         # Operators
Get-Help about_Pipelines         # Pipelines