PoSh: No GUI 4 U – Server Administration

“I need to know how to do my job and perform certain task”  When it comes to PowerShell this is the most common request I get around PowerShell training topics.  As admins continue to struggle with the decision on whether they use a GUI on Windows Server or to use Core, I want to provide the most basic cmdlets and resources that one would need to administer Windows Server successfully.   This blog entry wont go into the why I think everyone should move to Windows Server Core or why I think everyone needs to learn PowerShell as a scripting language. 

If you would like to learn more about PowerShell and if the company you work for is a Microsoft Premier Customer, reach out to the Technical Account Manager assigned to your company and look into setting up one of Premier’s Workshop around PowerShell.


if you’ve attended one of my brown bags  or Tech Talks around GUI ‘less administration, here is the cmdlets used during those sessions.

All the example cmdlets were tested on a Windows 10 client host using PowerShell direct to the host. They also work the same way performing windows to windows remote pssessions.

PowerShell Direct – Running PowerShell inside a virtual machine from the Hyper-V host


Most Useful Cmdlets

#use this to get help for a particular cmdlet
get-help get-help
#Powershell 5 updates are needed to view help, save help files on host.
save-help -Module * -DestinationPath c:\data\save
    #on vm create folder to save help files to
    New-Item .\save -ItemType directory
    #on host, copy files through the psession to the vm
    copy-item -ToSession $localvm -Path c:\data\save\* -Destination c:\data\save
#on vm, update help on vm server
Update-Help -SourcePath c:\data\save
get-help Get-Service
get-help get-service -Examples
get-help get-service -Detailed
get-help get-service -Full
#will provide help on any particular powershell topic
get-help "about_variable"
get-help about_*
#find cmdlets based on certain criteria
get-command -name *service*
get-command -Verb get
get-command -noun service
get-command -verb get -noun *service*
get-command -ParameterName computername
get-command -ParameterName ciminstance
get-command -Module Microsoft.PowerShell.Management
#find cmdlets in a module
get-command -module storage
#get information about an object, or objects cmdlets return
#get-help about_types
get-service | Get-Member
get-service | Get-Member -MemberType Property 
get-service | Get-Member -MemberType Method 
#find info about an array
,$(get-service) | get-member
#alias's are used to simplify or common name cmdlets
#get-help about_alias
Get-Alias dir
#Execution policy defines how cmdlets and scripts can be ran remotly and locally
#get-help about_Execution_Policies
Get-ExecutionPolicy -List
#can use gpo or similar cmdlet to change.
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
#displays every performed during a session
#get-help about_history
#create a script based on the activity you have done
(Get-History).commandline | Out-File c:\data\examplescript.ps1
#review the results
psedit C:\data\examplescript.ps1

Five Best PowerShell Cmdlets

PowerTip: Find Array Members with Get-Member in PowerShell

Is it safe to use ALIASES in scripts?

Weekend Scripter: Looking at PowerShell Aliases

PowerShell Modules

#get-help about_modules
#get-command *module
get-module -listavailable
import-module activedirectory #if module is installed on newer ps version not needed
#get all available modules and import them.  This is useful for get-command
get-module -ListAvailable | Import-Module
#check the Powershell gallery for a module
find-module azuread
find-module azuread | install-module

Welcome to the PowerShell Gallery

Overview of the PowerShell Get module to find scripts

Features and Roles

#get-command *WindowsFeature*
#get-help Get-WindowsFeature
#get all windows features, format it to make it more readable
Get-WindowsFeature | select displayname,name, installstate, Installed
#just installed features
Get-WindowsFeature | where installed -eq $true | select displayname,name, installstate, Installed
#install the file service role
get-windowsfeature File-Services | Install-WindowsFeature
Get-WindowsFeature *file*
#install the rsat feature
Get-WindowsFeature *rsat* 
get-windowsfeature rsat | Install-WindowsFeature
Get-WindowsFeature | where installed -eq $true | select displayname,name, installstate, Installed


Useful Windows Feature Commands

Server Rename, Shutdown, Restart and Domain Joining

#get-command *-computer*
#get a consolidated view of system and os properties
#rename a computer
rename-computer -NewName server1
#join a computer to Active Directory and Rename it
add-computer -NewName server1 -DomainName contoso.com
#test and repair secure channel between computer and domain
Test-ComputerSecureChannel -Repair
#Resets the machine account password for the computer
#restart and shutdown

Use PowerShell to Reset the Secure Channel on a Desktop


CIM and WMI is an entire session in its self, going to provide some useful links for you to read up on.  The bottom line is wmi cmdlets and cim cmdlets have their uses.  But learing to leverage cimcmdlets will simplify task

#get-help about_WMI
#get-help about_cimsession
#get-command *cim*
#get-command *wmi*
Get-CimClass *service*
Get-wmiobject -list *service*
#get services running
Get-CimInstance Win32_Service | where state -eq "running"
#get account service running under
Get-CimInstance Win32_Service | select name, startname
#cimsession use wsman instead of dcom, cimsession can use dcom though. A CIM session is a client-side object representing a connection to a local or remote computer. 
#The CIM session contains information about the connection, such as ComputerName, the protocol used for the connection, session ID, and instance ID.
get-command -ParameterName cimsession

CIM Cmdlets – Some Tips & Tricks

Remoting Week: Remoting Recap

Remoting the Implicit Way

Introduction to CIM Cmdlets

Should I use CIM or WMI with Windows PowerShell?

Comparing CIM and WMI in PowerShell

Using PowerShell CIM Cmdlets to Explore WMI Classes

Part 1 – Install Bash on Windows 10, OMI CIM Server, and DSC for Linux

Extending Inventory on Linux and UNIX computers using Open Management Infrastructure (OMI)

Services and Processes

#get-help get-service
#get-command *-service
get-service -name w32time
get-service -name w32time | Stop-Service
get-service -name w32time | start-Service
get-service -name w32time | restart-Service
#get-help get-process
#get-command *-process
get-process lsass
Start-Process notepad
Get-Process notepad
get-process notepad -includeusername
get-process notepad -includeusername | select name,username,description,Id,path,ProcessName,fileversion,Handles,NPM,PM,WS,VM,CPU
Get-Process notepad | Stop-Process

The Scripting Wife Uses PowerShell to Find Service Accounts

Use PowerShell to Find Non-Starting Automatic Services

Three Cool PowerShell Service Tricks

Get Process Owner and Other Info with WMI and PowerShell

Use PowerShell to Explore Process Threads in Windows

Local User and Local Groups

#get-command *localuser
#get-help get-localuser
#new for Windows 10/2016 WHAT!!!!!
New-LocalUser -Name Chunk  -Password (ConvertTo-SecureString -AsPlainText P@ssw0rd -Force)
Get-localuser -Name administrator | Set-LocalUser -Password (ConvertTo-SecureString -AsPlainText P@ssw0rd -Force)
#get-command *localgroup*
Get-LocalGroupMember administrators
Add-LocalGroupMember -Member "Chunk" -Name administrators
#old wmi/cim
Get-CimInstance win32_useraccount -filter "domain='$env:computername'“
#really old way WINNT Provider using adsi
$machine = [ADSI]"WinNT://$env:COMPUTERNAME"
$machine | get-member
$machine.Children | where schemaclassname -eq "user" | select *
$machine.Children | where schemaclassname -eq "user" | Select name
$user = $machine.create("User","Larry")

Adding Local Users to Local Groups

Use PowerShell to Add Local Users to Local Groups

Use PowerShell to Create Local Groups

How Can I Use Windows PowerShell to Determine the Status of the Guest Account?

Files and Folders

#Providers and drives first, A Windows PowerShell provider allows any data store to be exposed like a file system as if it were a mounted drive.
#get-help about_provider
#get-help *psdrive*
get-psdrive -PSProvider FileSystem
#does a file exist or not
test-path c:\data
get-command *item* -Module Microsoft.PowerShell.Management
#list files and subfolders
Get-Alias dir
Get-ChildItem -Recurse
#change directory
Get-Alias cd
#filter for file types
get-childitem C:\windows\system32 -recurse |  where {$_.extension -eq ".dll"} | select Directory,name,extension
get-childitem C:\windows\system32 -recurse |  where {$_.extension -eq ".sys"} | select Directory,name,extension
#create a bunch of generic files
1..20 | foreach{new-item ".\test$($_).txt" -itemtype file}
psedit .\test1.txt
Get-Content .\test1.txt
#create a folder
New-Item .\move -ItemType directory
New-Item .\copy -ItemType directory
move-item -Path .\test10.txt -Destination .\move
copy-item -Path .\test11.txt -Destination .\copy
cd .\move
cd .\copy
remove-item  -Path .\test11.txt
#copy an item through pssession/powershell direct
Copy-Item -FromSession $session -Path c:\data\* -Destination c:\data\

Learn How to Use the PowerShell Env: PSDrive

Playing with the AD: Drive for Fun and Profit

Working with Certificates in PowerShell

Use PowerShell to Work Easily with Drives and Paths

Hey scripting guys providers


#get-command *smb*
#get-help get-smbshare
#get a list of smb shares
#see more info
Get-SmbShare | select *
#create a new share give account read access
new-smbshare -name "User_File_Share" -path "c:\data\share" -readaccess "corp\blah"
#add additional access to a share
Grant-SmbShareAccess -Name "User_File_Share" -AccountName corp\chad -AccessRight Full
#find all smb shares with file in its name
Get-smbshare "*file*" | select *
#list open files on shares
#How to map a drive using psdrive
New-PSDrive -Name "P" -PSProvider "FileSystem" -Root "\\Server01\Public"
New-SmbMapping -LocalPath X: -RemotePath "\\Server01\Public"
Remove-SmbMapping -LocalPath X:

The basics of SMB PowerShell, a feature of Windows Server 2012 and SMB 3.0

The built-in SMB PowerShell aliases in Windows Server 2012 and Windows 8


get-psdrive -PSProvider Registry
#use Get-Item. Registry keys have a property with the generic name of "Property" that is a list of registry entries in the key
#get-command *item* -Module Microsoft.PowerShell.Management
#get-help get-item
Get-Item -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion
Get-Item -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion | Select-Object -ExpandProperty Property
#get-help get-childitem
Get-childItem HKLM:\System\CurrentControlSet\Services\Tcpip 
Get-childItem HKLM:\System\CurrentControlSet\Services\Tcpip -Recurse
Get-childItem HKLM:\System\CurrentControlSet\Services\Tcpip -Recurse  -PipelineVariable hive | foreach{$hive.name;$hive | Get-ItemProperty}
#A little more readable with get-itemproperty
Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Services\Tcpip
Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion
New-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name Thisisatest -PropertyType String -Value yep
Remove-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion -Name Thisisatest
#leverage invoke-command to perform remote work with the reistry
$remote_key = "HKLM:\System\CurrentControlSet\Services\Tcpip"
Invoke-Command -ScriptBlock{Get-ItemProperty -Path $using:remote_key} -ComputerName server1

Update or Add Registry Key Value with PowerShell

Use PowerShell to Enumerate Registry Property Values

Use PowerShell to Edit the Registry on Remote Computers

Use PowerShell to Create New Registry Keys on Remote Systems

Event Logs

#get-command *event*        
#get-winevent (everything including event channels) vs get-eventlog (legacy log types)
#get-help get-winevent
#get a list of the available logs
get-winevent -listlog *
Get-WinEvent -listlog *system*
#get particular log
Get-WinEvent -LogName System
Get-WinEvent -LogName System -MaxEvents 50
#format the log
Get-WinEvent -LogName System | select * 
#search for a certain event ID
get-winevent -logname application | where {$_.id -eq "8196"} 
#limit the amount seen
get-winevent -logname application -maxevents 1 | where {$_.id -eq "8196"} 
#leverage the filterhashtable for better filtering
Get-WinEvent -FilterHashtable @{logname='System'; id=7036} -MaxEvents 50
Get-WinEvent -FilterHashtable @{logname='application'; id=8196; StartTime=(Get-Date).date}
#write event id 7036 to a file
Get-WinEvent -FilterHashtable @{logname='System'; id=7036} -MaxEvents 50 | select id, providername, timecreated, message | export-csv c:\data\event7036.csv
#copy file locally to review
copy-item -fromSession $localvm -path c:\data\event7036.csv -Destination c:\data\

Use FilterHashTable to Filter Event Log with PowerShell

Windows Event Log in PowerShell – Part II

Processing Event Logs in PowerShell

Use PowerShell Cmdlet to Filter Event Log for Easy Parsing

Data Mine the Windows Event Log by Using PowerShell and XML

Perfmon or PerfData

#get-command *counter -module Microsoft.PowerShell.Diagnostics 
#get-command -Module Microsoft.PowerShell.Diagnostics 
#get-help get-counter
#Gets list of objects available
Get-counter –listset *
#Cleaner list of counters
Get-Counter -ListSet * | Sort-Object CounterSetName | select CounterSetName 
#Gets list of available counter under a object
(Get-Counter -ListSet Memory).Paths
#To get information on a single counter
Get-Counter -Counter "\physicaldisk(_total)\current disk queue length“
#To get 5 collections of a counter
Get-Counter -Counter "\physicaldisk(_total)\current disk queue length" -MaxSamples 5 
#To get a continuous collection of a counter
Get-Counter -Continuous -Counter "\physicaldisk(_total)\current disk queue length" 
Get-counter '\Process(*)\% Processor Time' 
$p = Get-counter '\Process(*)\% Processor Time‘
$p.CounterSamples | Sort-Object -Property CookedValue -Descending | Format-Table -Auto
#get counters from remove servers
$Counter = "\Process(Idle)\% Processor Time"
Get-Counter -Counter $Counter -ComputerName server1
$DiskReads = "\LogicalDisk(C:)\Disk Reads/sec"
$DiskReads | Get-Counter -Computer server1,server2 -MaxSamples 10 
$_perf_counters = "\Netlogon(_Total)\*","\Security System-Wide Statistics\NTLM Authentications","\Security System-Wide Statistics\Kerberos Authentications","\DirectoryServices(*)\*","\Database(lsass)\*","\NTDS\*","\Memory\*","\PhysicalDisk(*)\*","\Process(*)\*","\Processor(*)\*","\TCPv4\*","\DNS\*"
$_computers = "server1", "server2", "server3"
$_counter_results = get-counter -counter $_perf_counters -computer $_computers -ErrorAction SilentlyContinue -maxsamples 10
$_counter_results | export-counter -Path c:\data\perf.blg -FileFormat BLG -force
$_counter_results | export-counter -Path c:\data\perf.csv -FileFormat csv -force
import-counter -Path c:\data\perf.blg
import-counter -Path c:\data\perf.blg -Summary
$blg_counters = import-counter -Path c:\data\perf.blg -ListSet *memory* | ForEach-Object {$_.counter}
import-counter -Path c:\data\perf.blg -counter $blg_counters 

Using PowerShell To Gather Performance Data

Use PowerShell to Parse Saved Performance Counter Logs

Device and Drivers

#get-command *pnpdevice*
Get-PnpDevice -PresentOnly | select *
#get-command *driver*
Get-WindowsDriver -Online -All | select *

PowerTip: Disable plug and play device with PowerShell

PowerTip: Find all devices connected to a computer

Ooooh… PnP Cmdlets & Surface Book Fun!

Network and Network Capture

#get-command *lbfo*
#get-help Get-NetLbfoTeam
#get a list of nic teams
#get-command *net*
#get-command *netip* -module nettcpip
#Get ip / set ip
New-NetIPAddress -InterfaceAlias Ethernet -IPAddress $ipaddress -AddressFamily IPv4 -PrefixLength 24
#get-command *netadapter*
#get nic
Get-NetAdapter | select *
Get-NetAdapter "ethernet 2"
#disable / enable
Get-NetAdapter "ethernet 2" | Disable-NetAdapter
Get-NetAdapter "ethernet 2" | enable-NetAdapter
#get-command *dnsclient*
#get-command -module dnsclient
#Get / set dns
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses ""
#similiar to nslookup get ip info from hostname
Resolve-DnsName -Name server1
Resolve-DnsName -Name server1 -Type TXT
#get-command *netcon*
#get-help test-netconnection -example
#similar to ping
Test-NetConnection server1
Test-NetConnection server1 -Port 80
Test-NetConnection server1 -Port 80 -DiagnoseRouting
Test-NetConnection server1 -TraceRoute
#Start network strace
#get-command *neteventsession*
#Get-Command Get-NetTCPConnection
#get-help  Get-NetTCPConnection
#view port usauge
Get-NetTCPConnection | group localport -NoElement | sort count -Descending 
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Sort Count 
#add process info
Get-NetTCPConnection | Group-Object -Property State, OwningProcess | `
    Select -Property Count, Name, @{Name="ProcessName";Expression={(Get-Process -PID ($_.Name.Split(',')[-1].Trim(' '))).Name}} | `
    Sort Count -Descending
#get-command *netevent*
#get-command -module NetEventPacketCapture 
#set up network trace
New-NetEventSession -Name "Session2" -LocalFilePath c:\data\capture.etl
Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session2”
#start trace
Start-NetEventSession -Name "Session2"
#stop trace
Stop-NetEventSession -name "session2"
#use get-winevent to read network trace
$log = get-winevent -Path C:\data\capture.etl -Oldest

Windows Server 2012 “Server 8 Beta” NIC teaming

New Networking Diagnostics with PowerShell in Windows Server R2

PowerTip: Use PowerShell to Count Hops to Server

Windows PowerShell equivalents for common networking commands

Packet Sniffing with PowerShell: Getting Started

Use PowerShell to Parse Network Trace Logs

Use PowerShell to Test Connectivity on Remote Servers


#get-command *disk*
#get-command -Module Storage
#get all disk
get-disk | select *
Get-PhysicalDisk | select *
get-Disk | select number, operation*, health*, friendly*, size, @{Name="gb";Expression={$_.size/1GB}}
#prepare and add a new disk
get-disk 1 | Clear-Disk
get-disk 1 | initialize-disk  –PartitionStyle MBR
get-disk 1 | New-Partition -UseMaximumSize -AssignDriveLetter
Get-Disk | Where-Object IsOffline –Eq $True 
#get-command *partition* -module storage
#get-command *volume* -module storage
Get-Volume D | select * 
#move cdrom to another drive letter
$cddrive = Get-CimInstance win32_volume -Filter 'Driveletter = "D:"'
$cddrive | Set-CimInstance -Property @{Driveletter="Z:"}

Managing Storage with Windows PowerShell on Windows Server 2012

Use PowerShell to Initialize Raw Disks and to Partition and Format Volumes


#get-command *hotfix
#get-help get-hotfix
Get-HotFix  $_.InstalledOn -gt "10/1/2014" -AND $_.InstalledOn -lt "12/11/2014" }
#Get a list of failed updates
$Failures = Get-ciminstance Win32_ReliabilityRecords
$Failures | Where { $_.message -match 'failure' } | Select-Object -ExpandProperty message
#retired wuauclt.exe /detectnow
$AutoUpdates = New-Object -ComObject "Microsoft.Update.AutoUpdate"
#Windows update client from repo
find-module PSWindowsUpdate | install-module
Import-Module pswindowsupdate
get-command -Module pswindowsupdate
new-item -ItemType Directory -Path c:\data\windowsupdate
#switch to host
new-item -ItemType Directory -Path c:\data\windowsupdate
Save-Module -Path c:\data\windowsupdate
copy-item -FromSession -Path c:\data\windowsupdate\* -Destination c:\data\windowsupdate

Use PowerShell to Find Hotfixes Installed in Time Range

Features Removed or Deprecated in Windows Server 2016

Date, Time, and Time Zone

#get-command *timezone*
#get-command *-date*
#get timezone information


That is all for now, I hope these blog notes are enjoyed and hopefully found some use out of these cmdlets.



Just a quick note, I use this blog as a way to share things I have discovered.  Most of the times I’m in a rush to get it out and my grammar and spelling is horrific.  I usually proof read after I post and try to fix things as I see them.

Skip to main content