PowerShell Cheat Sheet: Essential Commands Quick Reference

You know what you want to do, you just cannot remember the exact parameter name or syntax right now. This PowerShell cheat sheet puts the essential commands for files, processes, services, networking, strings, and error handling on one page. Bookmark it, print it, pin it to your monitor — whatever keeps it one click away on a Monday morning when the server alert fires at 7 AM.

File and Folder Commands

The most frequent file system operations you run in PowerShell, with the key parameters that matter for scripting.

# Navigate and list
Set-Location C:\Logs                         # cd equivalent
Get-Location                                 # print current path (pwd)
Get-ChildItem -Path C:\Logs -Filter *.log -Recurse  # ls -r *.log

# Create, copy, move, delete
New-Item -Path C:\Logs\app -ItemType Directory -Force
Copy-Item C:\Source\file.txt C:\Dest\ -Force
Move-Item C:\Old\file.txt C:\New\file.txt
Remove-Item C:\Temp\* -Recurse -Force

# Read and write files
Get-Content C:\Logs\app.log                  # read all lines
Get-Content C:\Logs\app.log -Tail 50         # last 50 lines
Set-Content  C:\Config\settings.txt 'value'  # overwrite
Add-Content  C:\Logs\script.log 'entry'      # append
Out-File     C:\Reports\out.txt              # write pipeline output

# Test and measure
Test-Path C:\Logs\app.log                    # Boolean: does it exist?
(Get-Item C:\Logs\app.log).Length            # file size in bytes
Get-Content C:\Data\file.csv | Measure-Object -Line  # count lines
Get-FileHash C:\Installer.exe -Algorithm SHA256

# Archive
Compress-Archive -Path C:\Logs\* -DestinationPath C:\Archive\logs.zip -Force
Expand-Archive   -Path C:\Archive\logs.zip  -DestinationPath C:\Logs\Expanded

Process and Service Commands

Service and process management — the commands for keeping Windows systems running and diagnosing what is consuming resources.

# Services
Get-Service                              # list all services
Get-Service -Name W3SVC                  # specific service
Start-Service   W3SVC                    # start
Stop-Service    W3SVC -Force             # stop
Restart-Service W3SVC                    # restart
Set-Service     W3SVC -StartupType Automatic  # change startup type
Get-Service | Where-Object Status -ne Running  # stopped services

# Processes
Get-Process                              # all processes
Get-Process -Name chrome                 # specific process
Stop-Process -Name notepad -Force        # kill by name
Stop-Process -Id 1234 -Force             # kill by PID
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10  # top 10 CPU
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10  # top 10 RAM

# Scheduled tasks
Get-ScheduledTask | Where-Object State -eq 'Running'
Start-ScheduledTask -TaskName 'MyTask'
Stop-ScheduledTask  -TaskName 'MyTask'

Networking and Remote Commands

Network diagnostics, web requests, and remote execution — the commands for working across systems.

# Network info
Get-NetIPAddress -AddressFamily IPv4     # IP addresses
Get-NetAdapter | Where-Object Status -eq Up  # active adapters
Get-NetTCPConnection | Where-Object State -eq Listen  # listening ports
Test-Connection -ComputerName server01 -Count 1  # ping
Test-NetConnection -ComputerName server01 -Port 443  # TCP port test
Resolve-DnsName server01.contoso.com     # DNS lookup

# HTTP requests
Invoke-WebRequest  -Uri 'https://api.example.com' -Method GET
Invoke-RestMethod  -Uri 'https://api.example.com/data' -Method POST -Body ($body | ConvertTo-Json) -ContentType 'application/json'

# Remoting
Invoke-Command -ComputerName server01 -ScriptBlock { Get-Service }
Enter-PSSession -ComputerName server01
$session = New-PSSession -ComputerName server01
Invoke-Command -Session $session -ScriptBlock { hostname }
Remove-PSSession $session

String and Data Manipulation

String operations, type conversions, JSON, and CSV — the data manipulation toolkit.

# String operations
'hello world'.ToUpper()                  # HELLO WORLD
'hello world'.Replace('hello','hi')      # hi world
'hello world' -split ' '                 # @('hello','world')
'a','b','c' -join ', '                   # a, b, c
'hello world' -match 'w(\w+)'            # True; $Matches[1] = 'orld'
'  hello  '.Trim()                        # 'hello'

# Format and date
Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
'{0:N2}' -f 1234567.89                   # 1,234,567.89
[math]::Round(3.14159, 2)                # 3.14

# JSON / CSV
$obj  | ConvertTo-Json -Depth 5
$json | ConvertFrom-Json
Import-Csv   C:\data.csv
Export-Csv   C:\out.csv  -NoTypeInformation
$str | ConvertFrom-Csv -Header Name,Dept

# Variables and types
$psvt = $PSVersionTable.PSVersion       # PS version
[int]'42'                                # cast string to int
[string]42                               # cast int to string
$null -eq $var                           # null check
@($result).Count                         # safe count (handles null)

Error Handling and Logging

The constructs that separate scripts that run in production from ones that run once and never again.

# Error handling
$ErrorActionPreference = 'Stop'          # make all errors terminating
try {
    Get-Content C:\Logs\missing.txt -ErrorAction Stop
} catch [System.IO.FileNotFoundException] {
    Write-Warning "File not found: $($_.Exception.Message)"
} catch {
    Write-Error "Unexpected error: $($_.Exception.Message)"
} finally {
    Write-Host 'Cleanup done'
}

# Write to output streams
Write-Host    'Normal output'            # console only
Write-Verbose 'Diagnostic info'          # visible with -Verbose
Write-Warning 'Caution message'          # yellow warning
Write-Error   'Error message'            # red error stream
Add-Content C:\Logs\script.log "$(Get-Date) - Entry"  # log to file

# Null coalescing (PS 7+)
$value = $maybeNull ?? 'default'
$obj?.Property                           # safe navigation

Active Directory Quick Reference

The AD cmdlets you reach for most often in day-to-day administration.

# Users
Get-ADUser -Identity 'jsmith' -Properties *
Get-ADUser -Filter "Department -eq 'IT'" -Properties Department, Mail
New-ADUser -Name 'Jane Doe' -SamAccountName 'jdoe' -AccountPassword (Read-Host -AsSecureString) -Enabled $true
Set-ADUser -Identity 'jsmith' -Title 'Senior Engineer'
Disable-ADAccount 'jsmith'
Enable-ADAccount  'jsmith'
Unlock-ADAccount  'jsmith'
Set-ADAccountPassword -Identity 'jsmith' -Reset -NewPassword (ConvertTo-SecureString 'NewP@ss!' -AsPlainText -Force)

# Groups
Get-ADGroup -Identity 'Domain Admins' -Properties Members
Get-ADGroupMember -Identity 'IT-Admins'
Add-ADGroupMember -Identity 'IT-Admins' -Members 'jsmith'
Remove-ADGroupMember -Identity 'IT-Admins' -Members 'jsmith' -Confirm:$false

Useful One-Liners

High-value one-liners to copy and adapt for common daily tasks.

# Find large files
Get-ChildItem C:\ -Recurse -File -ErrorAction SilentlyContinue |
    Sort-Object Length -Descending | Select-Object -First 20 |
    Select-Object FullName, @{N='MB';E={[math]::Round($_.Length/1MB,2)}}

# Get local admins on a machine
Get-LocalGroupMember -Group 'Administrators'

# Find open firewall ports
Get-NetFirewallRule -Enabled True -Direction Inbound |
    Get-NetFirewallPortFilter | Select-Object Protocol, LocalPort

# Export running services to CSV
Get-Service | Where-Object Status -eq Running |
    Export-Csv C:\Reports\running_services.csv -NoTypeInformation

# Kill all processes matching a name
Get-Process notepad -ErrorAction SilentlyContinue | Stop-Process -Force

# Get Windows version info
$PSVersionTable.PSVersion                # PowerShell version
(Get-CimInstance Win32_OperatingSystem).Caption  # OS name

# Find recently modified files
Get-ChildItem C:\Logs -Recurse -File |
    Where-Object LastWriteTime -gt (Get-Date).AddHours(-24) |
    Select-Object Name, LastWriteTime

Common Errors and Fixes

• Commands that work in PS5 may not exist in PS7 — version noted. Out-GridView requires Windows. Get-WmiObject is deprecated — use Get-CimInstance instead. Get-Date -AsUTC requires PS7.1+. Always check $PSVersionTable.PSVersion when a known command throws “not recognized.”
• Aliases differ between PowerShell and CMD — stick to full cmdlet names. ls, dir, and gci all alias to Get-ChildItem. curl is an alias for Invoke-WebRequest in PowerShell (not the Linux curl). Scripts using aliases may behave differently across environments. Use full cmdlet names in scripts and reserve aliases for interactive use.

Related Cmdlets / See Also

• PowerShell Beginners Guide
• PowerShell Profile Setup

Wrapping Up

This cheat sheet covers the commands that solve 90% of everyday PowerShell tasks. Save it, share it, and use it as the starting point for new scripts. The patterns repeat across domains: get the item, filter it with Where-Object, transform it with Select-Object or ForEach-Object, and export it with Export-Csv or Out-File. Master these fundamentals and every more advanced topic becomes a variation on the same theme.