# PowerShell The importance of system administrators in companies should not be underestimated because only by having a reliable and continuously functioning IT infrastructure can a company achieve maximum economic efficiency. Depending on the size of the organization, this requires the **monitoring and control of dozens, if not hundreds, of computers simultaneously**. A mammoth task that can only be mastered by trained specialists with a deep insight into intrasystem connections. If a problem occurs on several computers simultaneously, or a new security solution needs to be loaded onto the entire network as quickly as possible, it would be neither time-efficient nor economical for an administrator to have to find each individual device and always repeat the same steps. Windows PowerShell makes it possible to **speed up a process like this immensely and automate routine tasks as much as possible**. This simplifies the work of the system administrator considerably. You can find out what else the software can do in our article. [![Image: Windows PowerShell window](https://www.ionos.com/digitalguide/fileadmin/_processed_/b/5/csm_windows-powershell_a32ab83ac1.webp "Windows PowerShell window")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell.png) Windows PowerShell looks very similar to the command prompt at first glance, but there are fundamental differences. ## What is Windows PowerShell? As the name suggests, Windows PowerShell is a **shell**. In information technology, this is an **interface between a computer and its user**. In computer science, the term refers to the **visible user interface** via which you can interact with the computer’s intrasystem functions. Shells are **usually command-oriented and are controlled exclusively by keyboard and text input**. They are an alternative to *graphical user interfaces* (GUI) that are primarily navigated using the mouse – such as Windows Explorer. Since shells also provide access to significantly more and subjacent PC functions and components, they are preferred by many IT professionals and system administrators. ## Why does Windows PowerShell exist? Until recently, the “***command.com”* command line and the “*cmd.exe”* prompt were the default shells on DOS and Windows operating systems**. They allow advanced computer users to open console applications, troubleshoot problems, or navigate a PC’s drives. For example, the command [netstat](https://www.ionos.com/digitalguide/server/tools/introduction-to-netstat/) makes it possible to receive basic information on all network activities. However, “command.com” and “cmd.exe” have always stood out due to two problems: **Not all system components are accessible through them** and their **script languages are considered to be limited in their functionality**. Therefore, for quite some time they weren’t considered as fully developed as the current Linux and Unix shells. As a result, Microsoft developers had been planning to remove these restrictions since the 1990s. In the course of time, they developed different shells, which sometimes helped, but sometimes made things worse. **Monad**, which was first introduced in 2003 and renamed **PowerShell** three years later, proved to be particularly groundbreaking. Microsoft’s “Common Engineering Criteria”, which has required all of the company’s server products to support PowerShell since 2009, **has advanced to become the central management and automation solution in Windows**. From Windows 2008 onwards, it came as standard with the operating system. It is also available as an **open source framework** to download for earlier Windows versions. [![Image: Windows PowerShell in Windows Explorer search results](https://www.ionos.com/digitalguide/fileadmin/_processed_/e/d/csm_windows-powershell2_8f36484730.webp "Windows PowerShell in Windows Explorer search results")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell2.png) Windows PowerShell has been pre-installed by default on all versions of Windows since 2008. In 2016, the decision was made to offer the shell **independently of the platform**. Microsoft’s intention: PowerShell should become a **universal tool for system administrators** outside of Windows i.e. on Linux and macOS. Since then, the shell has spread more and more, and is constantly receiving new supporters. To summarize, PowerShell is the long overdue successor of the command prompt. ## What is the difference between PowerShell and the command prompt? What exactly sets the new Microsoft framework apart from the familiar command prompt? To put it simply: **PowerShell has all the features of cmd.exe, can do a lot of it much better, and also performs other tasks that were previously unthinkable with Windows**. PowerShell basically provides **the same range of commands as cmd.exe**. With sufficient knowledge of the common standard commands, PowerShell can be used in the same way as the command prompt. However, it also enables access to subjacent Windows internals that were previously not accessible with cmd.exe. e.g. the **Windows Registry** and the **Windows Management Instrumentation (WMI)**. The command line of Windows PowerShell also follows the clear **logic of a consistent command structure and syntax** and makes more sense than cmd.exe in this respect. Another feature that makes Windows PowerShell stand out: Unlike the command prompt and Unix-like systems, the program works **completely object-based** instead of issuing the results of commands in text form (strings). Each object has both **properties** and **methods** that define how it can be used. This is how the Windows process object represents properties such as process names and IDs, and methods for pausing and terminating processes. Because the results of commands are always issued as .NET objects, **pipelining in PowerShell enables you to perform much more complex tasks than cmd.exe**. This works by using the output of one object in the pipe as input for the next object. For example, large and complex amounts of data can be filtered by file extensions and formatted as a clear list. Windows PowerShell is not just a command line, it also acts as a **rich and powerful scripting environment**. In it, you can write your own commands or combine several commands into complex scripts to simplify system management tasks. **Remoting** also makes it possible to run scripts on any number of systems simultaneously, regardless of their location, and thereby manage, set up, record, and repair them. This variety of options and features also reveals what Windows PowerShell’s primary target group is: **IT professionals and system administrators** who have a deep understanding of shells and are willing to familiarize themselves with Windows PowerShell for increased efficiency. Users who mainly work with Windows’ graphical user interface and only use the command prompt sporadically, however, will notice that PowerShell does not offer any particular added value, especially since it takes a while to get used to the framework. Here’s a quick summary of the **advantages and disadvantages of Windows PowerShell** compared to the command prompt:
What’s right with PowerShell? What’s wrong with PowerShell?
All commands available from the command prompt Complex and steep learning curve
Access to subjacent Windows internals like the Registry and WMI Targeted primarily at IT professionals and system administrators
More efficient operation thanks to consistent command structure and syntax No increased benefit for GUI users who rarely use the command prompt
Complete object orientation enables more complex tasks to be executed through pipelining Familiarization required
Comprehensive scripting environment enables efficient automation of processes
Location-independent administration of multiple systems via remoting.
## How does Windows PowerShell work? PowerShell basically consists of two components, namely the **PowerShell Engine** and the **PowerShell scripting language**. Both can be used separately or together to get the maximum functionality out of the program. ### The PowerShell engine PowerShell’s **command-line interpreter** (CLI) gives the user access to internal operating system **functions via keyboard entries**. The program’s commands are called “**cmdlets**” (pronounced “commandlets”). According to a consistent syntax, they are always composed **of a verb and a noun** in the singular form e.g. “*stop process”* or “*sort object”*. Parameters are specified in a cmdlet according to the – *Parameter \[value\]* formula, for example: ```none Get-EventLog System Newest 3 (to access the three most recent entries in the system event log) ``` --- ### Tip In PowerShell, it’s normal to enter commands with capital letters, but lower case works well too. --- The more than 100 core cmdlets also include frequently used standard commands from the command prompt, which are available as “**aliases**”, among other things, to help users get started with the new shell. For example, the *cd* command intended to change a directory has the equivalent “*set location”*, which performs exactly the same function. To view all pre-built aliases, use the “*Get-Alias”* cmdlet. You can also use the *Set-Alias* cmdlet to create your own aliases. For example, you can use the following pipeline to assign the alias “ed” to the command “notepad” (for the Notepad program), so that fewer keystrokes are required to execute the program: ```none Set-Alias ed notepad (to open Notepad with the ed command) Set-Alias scr1 C:\Users\IEUser\Desktop\script1.ps1 (to start a script with the abbreviation scr1) ``` [![Image: Results of the “Get-Alias” cmdlets](https://www.ionos.com/digitalguide/fileadmin/_processed_/8/4/csm_windows-powershell3_b87a30956d.webp "Results of the “Get-Alias” cmdlets")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell3.png) The “Get-Alias” cmdlet displays all of PowerShell’s default aliases. The following table contains some examples of **frequently used cmdlets and their related aliases**:
Alias Cmdlet Function
cd Set-Location Change current directory
dir Get-ChildItem List all items in a folder
gi Get-Item Access a specific element
ps Get-Process List all processes
gsv Get-Service List all installed services
gm Get-Member Show all properties and methods of an object
clear Clear-Host Empty the PowerShell host
PowerShell’s strict and easy-to-understand command structure allows you to work more efficiently than in the command prompt. To save even more time, **you can use the \[Tab\] key to automatically complete half-written cmdlets**. In many cases, the program even recognizes incompletely typed commands. Cmdlets can be executed individually or **pipelined together** so that the output of an object can be read and reused by the following object. To add two cmdlets to the same pipeline, simply use the “|” icon. This way you can, for example, list all available processes and at the same time sort them by their ID: ```none Get-Process | Sort-Object ID ``` [![Image: Results of the pipeline “Get-Process” | “Sort-Object ID”](https://www.ionos.com/digitalguide/fileadmin/_processed_/e/1/csm_windows-powershell4_bc010ab70d.webp "Results of the pipeline “Get-Process” | “Sort-Object ID”")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell4.png) Using pipelining, Windows PowerShell can handle complex tasks, such as viewing all processes and sorting by ID. **Variables** are defined with the $ symbol. As usual, they can be used to **store outputs** so that they can be accessed again at a later point during pipelining. PowerShell is even able to store the **results of multiple pipelined commands at once**, for example: ```none $a = (Get-Process | Sort-Object ID) ``` ### The PowerShell scripting language Much of PowerShell’s scripting language may seem familiar to C# and other [scripting languages](https://www.ionos.com/digitalguide/websites/web-development/what-are-scripting-languages/ "What are scripting languages?"). Not only can you use it to write your own cmdlets (and share them with other users if necessary), you can also package **multiple commands in sequence in a script file** with the .ps1 format to **extend the functionality of the shell**. Numerous application examples are conceivable: from the execution of simple routine tasks to the almost complete automation of monitoring and control processes. Scripts always contain an application description and are executed with the prefix “.” followed by the complete file path. An example: ```none .C:\Users\IEUser\Desktop\script1.ps1 ``` ## What are typical PowerShell applications? With sufficient practice and expertise, PowerShell can make many **system management tasks much more efficient**. In the following paragraph, we explain four typical application examples. ### Directory organization: Renaming multiple files at once If, hypothetically, you need to rename about 1,000 documents of the “*Text (1)[.docx](https://www.ionos.com/digitalguide/online-marketing/online-sales/what-is-a-docx-file/ "What is a .docx File?")”*, “*Text (2).docx”* etc. scheme so that the spaces in the file name are replaced by underscores: It would not be advisable to change each document individually. Instead, you would probably use cmd.exe or – even better – an external tool. **Pipelining in PowerShell allows even more flexibility when renaming large amounts of data**. To do this, first go to the **directory in which the documents are located**. This can easily be done using the “*Set-Location”* cmdlet in combination with the full file path. Here is an example: ```none Set-Location C:\Users\IEUser\Desktop\Text folder ``` [![Image: Input field in the path of a directory in which “powershell” was entered](https://www.ionos.com/digitalguide/fileadmin/_processed_/e/e/csm_windows-powershell5_d2668ccee1.webp "Input field in the path of a directory in which “powershell” was entered")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell5.png) By entering the term “powershell” in the path of a directory, you open a PowerShell window at this point instead of having to navigate there by entering text. Alternatively, you can navigate the directory **using Windows Explorer: Simply click in the path list and enter “powershell”** to open the PowerShell window for the directory. You can change the name of the selected document with the following cmdlet: ```none Get-ChildItem *docx | Rename-Item -NewName {$_.name -replace " ","_"} ``` Explanation: “*Get-ChildItem”* lists all files in the directory. The “*\*docx”* addition only filters out Word documents with the corresponding format – PDF documents in the folder would also not be taken into account. Use the “|” item to add another command to the pipeline, “*Rename-Item”*, which signals that something should be renamed. “*–NewName”* specifies the new name using a script block that works with the “*$\_.name”* variable that represents the current object. And “*.name”* is the property with the file name. Finally, use the “*–replace”* parameter to specify that all spaces should be converted to underscores. [![Image: Result of renaming files via PowerShell](https://www.ionos.com/digitalguide/fileadmin/_processed_/4/b/csm_windows-powershell6_bd08707fc4.webp "Result of renaming files via PowerShell")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell6.png) If you have predefined “\*docx” as the file format, the PDF is excluded from renaming. ### Data acquisition: Checking running services on a PC Before implementing a new security solution on the network, you should check **which services are already installed on a particular PC**. The basic tool is the “*Get-Service”* cmdlet, which lists all services. You can also use the **filter functions in PowerShell** to display only a partial amount of the results – for example, all running services. This works with the following cmdlet: ```none Get-Service | Where-Object {$_.status -eq "running"} ``` The output of “*Get-Service”* is forwarded to the “*Where-Object”* by the pipeline. “*Where-Object”* filters all services by their status (represented by the variable “*$\_.status”* and the parameter *-eq "running"*) and lists the running services. If necessary, you can also **sort** the prefiltered list by display name by adding another cmdlet to the pipeline: ```none Get-Service | Where-Object {$_.status -eq "running"} | Sort-Object DisplayName ``` [![Image: Results of the “Get-Service pipeline|Where-Object” {$_.status –eq "running"} |Sort-Object DisplayName.](https://www.ionos.com/digitalguide/fileadmin/_processed_/2/3/csm_windows-powershell7_2ae72f22d3.webp "Results of the “Get-Service pipeline|Where-Object” {$_.status –eq "running"} |Sort-Object DisplayName.")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell7.png) You can use PowerShell’s filtering functions to view a subset of the services installed on a system. --- ### Tip With the pipeline addition “*more”*, you can also restructure the long service list so that you can scroll through it page by page. --- ### Troubleshooting: Searching event log for system errors Event logs provide system administrators with information about error messages in applications, in the operating system, or in the security functions of a device. Use the “*Get-EventLog”* command to **view and manage these logs**. For example, if you want to take a look at the error messages in the “System” event display, enter the following: ```none Get-EventLog System | Where-Object {$_.entryType -Match "Error"} ``` If PowerShell outputs too many results, you can use the “*Newest 100”* parameter to restrict the list to the 100 most recent system log entries that are then filtered for errors: ```none Get-EventLog System -Newest 100 | Where-Object {$_.entryType -Match "Error"} ``` You can get detailed information about individual error messages if you forward the output of this pipeline to the “*Format-List”* cmdlet: ```none Get-EventLog System -Newest 100 | Where-Object {$_.entryType -Match "Error"} | Format-List ``` [![Image: Results of the Get-EventLog System -Newest 100 pipeline| Where-Object {$_.entryType -Match "Error"} and Format-List](https://www.ionos.com/digitalguide/fileadmin/_processed_/5/e/csm_windows-powershell8_8c8add0356.webp "Results of the Get-EventLog System -Newest 100 pipeline| Where-Object {$_.entryType -Match "Error"} and Format-List")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell8.png) Large amounts of data, such as event logs, can be condensed and viewed more precisely according to the criteria you select. ### Remote management: Controlling services on remote computers **Windows Management Instrumentation (WMI)** provides access to almost all settings and functions of Windows computers, making it the most important tool for process automation and remote management of digital workstations. You can also apply the associated “*Get-WmiObject”* cmdlet to remote computers, so you can also use the **Windows PowerShell as a system management tool**. For example, if you need information of the Win32\_BIOS class on a computer in the network (represented by the parameter “*–Computername”*), the following command will help you: ```none Get-WmiObject Win32_Bios -Computername ``` Alternatively, you can work with the parameter “*–Class”* followed by the complete path of the class: ```none Get-WmiObject -Rechnername -Class Win32_Service ``` You can now access the internal system settings of the third-party computer remotely. The following example shows how to retrieve the methods of the Windows Update Client service to find out which cmdlets can be used to start, stop, and restart it: ```none Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'" ``` [![Image: Results of the pipeline Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'"](https://www.ionos.com/digitalguide/fileadmin/_processed_/2/c/csm_windows-powershell9_fe72ff6f67.webp "Results of the pipeline Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'"")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell9.png) The Cmdlet “Get-WmiObject” allows you to access not only the internal settings and functions of a remote computer, but also those of your own computer. As you can see, the “*Get-WmiObject –Computername”* first locates the desired host and then selects the “*Win32\_Service”* class using the “*–Class”* parameter. The Windows Update Client with the abbreviation “*wuauserv”* is then filtered out of the existing services. The well-known “*Get-Member”* cmdlet and the “*-Type Method”* parameter give you an overview of all methods for “*wuauserv”* that enable you to fully control the client remotely: ```none Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'" | Get-Member -Type Method ``` [![Image: Results of the pipeline Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'" | Get-Member -Type Method](https://www.ionos.com/digitalguide/fileadmin/_processed_/6/c/csm_windows-powershell10_432af69c99.webp "Results of the pipeline Get-WmiObject -Computername -Class Win32_Service -Filter "Name='wuauserv'" | Get-Member -Type Method")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2018/windows-powershell10.png) The cmdlet Get-Member lists all properties and methods that are available for a .NET Object. This is a markdown version of: [https://www.ionos.com/digitalguide/server/know-how/windows-powershell/](https://www.ionos.com/digitalguide/server/know-how/windows-powershell/) for AI/LLM consumption.