PowerShell

// Display help for a specific cmdlet
Get-Help Get-Process # Displays help information for the 'Get-Process' command
Get-Help Get-Service
// List all available cmdlets
Get-Command
// Display help for a specific topic
Get-Help about_If
// Display help for a specific provider
Get-Help FileSystem
// Display help for a specific script
Get-Help C:\Scripts\MyScript.ps1
// Retrieve detailed information about PowerShell commands
Get-Command -Noun Service # Lists all commands that involve services
Get-Command -Verb Get # Lists all commands that use the 'Get' verb
Get-Command -Module Net* # Lists all commands from modules starting with 'Net'

// Stops a service named 'bits'
Stop-Service -Name 'bits'

// Starts a service named 'bits'
Start-Service -Name 'bits'

// Displays used and free space for all drives
Get-PSDrive | Select-Object Used, Free

// Creates a new local user with a specified password
$password = ConvertTo-SecureString 'Password123' -AsPlainText -Force
New-LocalUser -Name 'User1' -Password $password

// Removes a local user named 'User1'
Remove-LocalUser -Name 'User1'

// Retrieves a list of all currently running processes
Get-Process

// Stops a process named 'notepad'
Stop-Process -Name 'notepad'

// Lists all network adapters with their IP configurations
Get-NetIPAddress

// Tests network connectivity to www.example.com on port 80
Test-NetConnection -ComputerName 'www.example.com' -Port 80

// Displays the contents of a file named 'log.txt'
Get-Content 'C:\log.txt'

// Writes 'New Log Entry' to a file named 'log.txt'
Set-Content 'C:\log.txt' -Value 'New Log Entry'

// Copies 'source.txt' from C:\ to D:\
Copy-Item 'C:\source.txt' -Destination 'D:\'

// Exports object data to a CSV file without type information
$data | Export-Csv -Path 'C:\export.csv' -NoTypeInformation

// Imports data from a CSV file into a PowerShell object
$data = Import-Csv 'C:\data.csv'

// Retrieves the 10 most recent entries from the System event log
Get-EventLog -LogName System -Newest 10

// Retrieves detailed information about the computer system
Get-WmiObject -Class Win32_ComputerSystem

// Sets a registry key value
Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion' -Name 'Test' -Value 'Data'

// Displays the current system date and time
Get-Date

// Retrieves and displays all drives on the computer
Get-PSDrive

// Shows the current location in the file system
Get-Location

// Sets the current directory to the C: drive root
Set-Location C:\

// Retrieves a list of all processes running on the system
Get-Process

// Creates a new directory on the desktop
New-Item -Path 'C:\Users\Public\Desktop\NewFolder' -ItemType Directory

// Gets all installed programs from the registry
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select-Object DisplayName, DisplayVersion, Publisher

// Empties the Recycle Bin for all drives
Clear-RecycleBin -Force

// Lists configuration details of all network adapters
Get-NetAdapter | Select-Object Name, Status, MacAddress, LinkSpeed

// Displays all TCP ports on which the system is listening
Get-NetTCPConnection | Where-Object { $_.State -eq 'Listen' }

// Finds files larger than 500MB in the C: drive
Get-ChildItem C:\ -Recurse | Where-Object { $_.Length -gt 500MB } | Select-Object FullName, Length

// Retrieves the status of the Windows Firewall
Get-NetFirewallProfile | Select-Object Name, Enabled

// Gets detailed information about the system
Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, CsManufacturer, CsModel

// Lists all environment variables
Get-ChildItem Env:

// Measures how long it takes to calculate the square roots of numbers 1 through 1000
Measure-Command { 1..1000 | ForEach-Object { [Math]::Sqrt($_) } }

// Creates a custom PSObject with properties
$customObject = New-Object PSObject -Property @{
  Name = 'John Doe';
  Age = 30;
  Department = 'HR'
}
// Displays the custom object
$customObject

// Starts a background job that runs a script block
$job = Start-Job -ScriptBlock {
  Get-Process | Where-Object {$_.CPU -gt 100}
}
// Gets the job results after completion
Receive-Job -Job $job
Remove-Job -Job $job

// Uses pipeline to filter and select properties from processes
Get-Process | Where-Object {$_.WorkingSet -gt 100MB} | Select-Object Name, ID, WorkingSet

// Loop through all services and restart if stopped
Get-Service | ForEach-Object {
  if ($_.Status -eq 'Stopped') {
    Start-Service $_.Name
  }
}

// Deletes files older than 30 days in a specific directory
Get-ChildItem 'C:\OldFiles' | Where-Object {
  $_.LastWriteTime -lt (Get-Date).AddDays(-30)
} | Remove-Item

// Replaces all occurrences of 'text' with 'info' in 'log.txt'
$content = Get-Content 'C:\log.txt'
$updatedContent = $content -replace 'text', 'info'
Set-Content -Path 'C:\log.txt' -Value $updatedContent

// Tries to execute a command and catches any exceptions
try {
  Get-WmiObject -Class Win32_BIOS
} catch {
  Write-Output 'An error occurred: $_'
}

// Uses Add-Type to access system functions through the Windows API
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.MessageBox]::Show('Hello, World!')

// Creates a scheduled task to run a script at 7 AM daily
$action = New-ScheduledTaskAction -Execute 'Powershell.exe' -Argument '-File C:\Scripts\DailyReport.ps1'
$trigger = New-ScheduledTaskTrigger -Daily -At 7am
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'DailyReport'

// Changes the IP address and subnet mask of a network adapter
$interface = Get-NetAdapter -Name 'Ethernet'
New-NetIPAddress -InterfaceAlias $interface.Name -IPAddress 192.168.1.100 -PrefixLength 24 -DefaultGateway 192.168.1.1

// Adds a user to a group in Active Directory
Add-ADGroupMember -Identity 'HRStaff' -Members 'JohnDoe'

// Creates a new self-signed certificate for code signing
$cert = New-SelfSignedCertificate -DnsName 'example.com' -CertStoreLocation 'cert:\LocalMachine\My'
$cert | Export-Certificate -FilePath 'C:\exampleCert.cer'

// Retrieves DNS server addresses for a specific adapter
Get-DnsClientServerAddress -InterfaceAlias 'Ethernet'

// Compresses a directory into a zip file
Compress-Archive -Path 'C:\Data' -DestinationPath 'C:\Backup.zip'

// Converts an object to JSON format and writes to a file
$obj = @{Name = 'John'; Age = 31}
$json = $obj | ConvertTo-Json
Set-Content -Path 'C:\user.json' -Value $json

// Uses Get-Counter to monitor CPU and memory usage
$counters = @('\Processor(_Total)\% Processor Time', '\Memory\Available MBytes')
Get-Counter -Counter $counters -SampleInterval 1 -MaxSamples 10

// Queries the Application log for errors that occurred in the past 24 hours
Get-EventLog -LogName Application -EntryType Error |
Where-Object {$_.TimeGenerated -gt (Get-Date).AddDays(-1)}

// Starts a transaction to modify registry values
Start-Transaction
Set-ItemProperty -Path 'HKLM:\Software\MyApp' -Name 'Setting1' -Value 'NewValue' -UseTransaction
Complete-Transaction

// Creates a file system watcher to monitor changes in 'C:\Data', '*.txt' -Property @{
  IncludeSubdirectories = $true;
  NotifyFilter = [System.IO.NotifyFilters]'FileName, LastWrite'
}
// Register an action to be performed when a file is changed
Register-ObjectEvent $watcher 'Changed' -Action {
  Write-Host 'A file was modified.'
}

// Adds a new inbound rule to allow TCP traffic on port 8080
New-NetFirewallRule -DisplayName 'Allow Port 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

// Deletes files in the Temp folder older than 7 days
Get-ChildItem 'C:\Windows\Temp' |
Where-Object { $_.CreationTime -lt (Get-Date).AddDays(-7) } |
Remove-Item -Force

// Creates a new local group 'Developers'
New-LocalGroup -Name 'Developers'
// Adds a user to the 'Developers' group
Add-LocalGroupMember -Group 'Developers' -Member 'User1'

// Retrieves BIOS information and displays serial number
$bios = Get-WmiObject Win32_BIOS
Write-Output 'BIOS Serial Number: ' + $bios.SerialNumber

// Finds and replaces phone number formats in a text string
$text = 'Call us at 123-456-7890'
$newText = $text -replace '\d{3}-\d{3}-\d{4}', '555-1234'
Write-Output $newText

// Disables all users in the 'Sales' department
Get-ADUser -Filter 'Department -eq "Sales"' |
Set-ADUser -Enabled $false

// Uses PowerShell to install or update a softwarepackage from a repository
Install-Package -Name 'Git' -Source 'PSGallery' -Force

// Initializes a new disk and creates a new volume
Initialize-Disk -Number 2 -PartitionStyle GPT
New-Partition -DiskNumber 2 -UseMaximumSize -AssignDriveLetter |
Format-Volume -FileSystem NTFS -NewFileSystemLabel 'NewVolume'

// Lists all network adapters with their current IP configuration
Get-NetAdapter | Get-NetIPAddress

// Enables Remote Desktop on the machine
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0

// Backs up the Application event log to a file
wevtutil epl Application 'C:\Backups\AppEvent.evtx'

// Generates a system health report and saves it as an HTML file
$report = Get-WmiObject Win32_ComputerSystem | ConvertTo-Html
Set-Content -Path 'C:\SystemReport.html' -Value $report

// Creates a scheduled task to run a script every day at 7 AM
$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-File "C:\Scripts\DailyJob.ps1"'
$trigger = New-ScheduledTaskTrigger -Daily -At 7am
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'DailyTask' -Description 'Performs daily maintenance tasks'

// Queries performance data for the SQL Server service
Get-Counter -Counter '\SQLServer:Databases(_Total)\Transactions/sec' -SampleInterval 5 -MaxSamples 3

// Sets a service to run with a specific user account
Set-Service -Name 'MyService' -Credential (Get-Credential)

// Defines a function to repeatedly test connectivity
function Test-ConnectionRepeatedly {
  param ([string]$computerName, [int]$count)
  // Loop to perform the test multiple times
  for ($i=0; $i -lt $count; $i++) {
    Test-Connection -ComputerName $computerName
    Start-Sleep -Seconds 10
  }
}
// Calls the function with parameters
Test-ConnectionRepeatedly -computerName 'server01' -count 5

// Establishes a remote session and executes a command
$session = New-PSSession -ComputerName 'Server01'
Invoke-Command -Session $session -ScriptBlock {
  Get-Service
}
Remove-PSSession -Session $session

// Example script with error handling and logging
try {
  $result = Get-Item 'C:\NonExistentFile.txt'
} catch {
  Write-Error 'An error occurred: $_'
  Add-Content -Path 'C:\ErrorLog.txt' -Value ('Error on ' + (Get-Date) + ': ' + $_.Exception.Message)
} finally {
  Write-Host 'Cleanup can go here'
}

// Performs a series of system health checks and compiles a report
$cpuUsage = Get-Counter '\Processor(_Total)\% Processor Time'
$diskSpace = Get-PSDrive C | Select-Object Used, Free
$services = Get-Service | Where-Object {$_.Status -ne 'Running'}
$report = @{
  'CPU Usage' = $cpuUsage.CounterSamples.CookedValue;
  'Disk Space' = $diskSpace;
  'Stopped Services' = $services
}
$report | ConvertTo-Html | Set-Content 'C:\SystemHealth.html'

// Defines a function with parameter validation
function Set-ServerFeature {
  param (
    [Parameter(Mandatory)]
    [string]$FeatureName,
    [ValidateSet('Enabled', 'Disabled')]
    [string]$State
    )
    Write-Host "Setting $FeatureName to $State"
}

// Retrieves data from a REST API
$uri = 'https://api.example.com/data'
$response = Invoke-RestMethod -Uri $uri
$response.items

// Modifies filer permissions for a directory
$acl = Get-Acl 'C:\DataFolder'
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Domain\User1', 'FullControl', 'Allow')
$acl.SetAccessRule($rule)
Set-Acl -Path 'C:\DataFolder' -AclObject $acl

// Demonstrates the use of debugging features
Set-PSDebug -Trace 2
function Test-Debug {
  [CmdletBinding()]
  param($InputData)
  Write-Verbose 'Processing data'
  # Process data here
}
Write scripts that use conditional logic to manage system configurations
```powershell
// Script that adjusts system settings based on current conditions
$systemInfo = Get-ComputerInfo
if ($systemInfo.WindowsVersion -ge '10.0') {
  Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Session Manager\Memory Management' -Name 'ClearPageFileAtShutdown' -Value 1
} else {
  Write-Output 'Older Windows version, no action taken'
}

// Runs a secure query against a SQL database
$connectionString = 'Server=myServerAddress;Database=myDataBase;User Id=myUsername;Password=myPassword;'
$query = 'SELECT * FROM Users WHERE Active = 1'
$connection = New-Object System.Data.SqlClient.SqlConnection $connectionString
$command = $connection.CreateCommand()
$command.CommandText = $query
$connection.Open()
$reader = $command.ExecuteReader()
while ($reader.Read()) {
  [PSCustomObject]@{
    Username = $reader['Username']
    Status = $reader['Active']
  }
}
$connection.Close()

// Checks and restarts a service if it's not running
$serviceName = 'WSearch'
$service = Get-Service -Name $serviceName
if ($service.Status -ne 'Running') {
  Start-Service -Name $serviceName
  Write-Output '$serviceName service started'
} else {
  Write-Output '$serviceName is already running'
}

// Creates a new virtual machine with specified parameters
New-VM -Name 'TestVM' -MemoryStartupBytes 2GB -NewVHDPath 'D:\VMs\TestVM.vhdx' -NewVHDSizeBytes 40GB -Generation 2
// Sets network adapter to use a virtual switch
Add-VMNetworkAdapter -VMName 'TestVM' -SwitchName 'ExternalSwitch'

// Sets DNS client server addresses with primary and secondary DNS
Set-DnsClientServerAddress -InterfaceIndex (Get-NetAdapter).InterfaceIndex -ServerAddresses ('192.168.1.1', '8.8.8.8')

// Retrieves error events related to a specific application and sorts them by time
Get-WinEvent -FilterHashtable @{LogName='Application'; Level=2; Provider Name='MyApp'} |
Sort-Object TimeCreated -Descending

// Modifies registry to enforce strong cryptography in .NET applications
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value 1

// Adjusts the visual effects for best performance
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' -Name 'VisualFXSetting' -Value 2

// Adds a network printer and configures its port
Add-Printer -Name 'OfficePrinter' -DriverName 'HP Universal Printing PCL 6' -PortName 'IP_192.168.1.50'
Add-PrinterPort -Name 'IP_192.168.1.50' -PrinterHostAddress '192.168.1.50'

// Calls an API and parses the JSON response for specific data
$response = Invoke-RestMethod -Uri 'https://api.example.com/data'
$specificData = $response.data | Where-Object { $_.status -eq 'active' }
$specificData

// Installs all available Windows updates
Import-Module PSWindowsUpdate
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

// Sets up a watcher on a folder to trigger actions on file changes
$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = 'C:\DataFolder'
$watcher.Filter = '*.txt'
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher 'Changed' -Action {
  Send-MailMessage -From 'server@example.com' -To 'admin@example.com' -Subject 'File Changed' -Body ('File changed: ' + $Event.SourceEventArgs.FullPath)
}

// Modifies user account settings to disable password expiration
Get-LocalUser -Name 'User1' | Set-LocalUser -PasswordNeverExpires $true

// Configures auditing policy for failed logon events
Auditpol /set /subcategory:'Logon' /failure:enable

// Script to monitor CPU and RAM usage and report via email if thresholds are exceeded
$cpu = Get-Counter '\Processor(_Total)\% Processor Time'.CounterSamples.CookedValue
$ram = Get-Counter '\Memory\Available MBytes'.CounterSamples.CookedValue
if ($cpu -gt 85 -or $ram -lt 300) {
  $body = 'Alert: High CPU or low RAM on server.'
  Send-MailMessage -From 'monitor@example.com' -To 'admin@example.com' -Subject 'Server Alert' -Body $body
}

// Backs up specified directories to a network share with logging
$source = 'C:\ImportantData'
$destination = '\\BackupServer\Share'
Copy-Item -Path $source -Destination $destination -Recurse -Verbose 4>&1 | Out-File 'C:\backup.log'

// Creates a system restore point
Checkpoint-Computer -Description 'PreUpgrade' -RestorePointType 'MODIFY_SETTINGS'

// Changes the system's power plan to high performance
$powerPlan = powercfg /list | Where-Object { $_ -like '*High performance*' }
$planGuid = $powerPlan -split '[()]' -like '*{*' | Out-String
powercfg /setactive $planGuid.Trim()

// Updates DNS records dynamically for a given IP and hostname
Add-DnsServerResourceRecordA -Name 'server01' -IPv4Address '192.168.1.101' -ZoneName 'example.com'

// Monitors log files and triggers alerts for specific patterns
$path = 'C:\Logs\*.*'
Get-Content $path -Tail 1 -Wait | Where-Object { $_ -match 'ERROR' } | ForEach-Object {
  Write-Host 'Error found in log: ' $_
}

// Adds a persistent route to the routing table
route add 0.0.0.0 mask 0.0.0.0 192.168.1.1 -p

// Checks system performance and adjusts application settings based on metrics
$memoryUsage = Get-Counter '\Memory\Available MBytes'
if ($memoryUsage.CounterSamples.CookedValue -lt 500) {
  Write-Output 'Low memory warning. Adjusting application settings.'
  # Adjust settings here
}

// Scans for vulnerabilities and applies patches automatically
Get-WsusComputer | Where-Object { $_.NeedUpdates -eq $true } | Invoke-WsusComputerScan | Out-Null
Start-Sleep -Seconds 3600  // Wait for scan to complete
Get-WsusComputer | Where-Object { $_.NeedUpdates -eq $true } | Approve-WsusUpdate

// Retrieves a list of all event logs
Get-EventLog -List

// Gets the most recent 10 entries from the Application log
Get-EventLog -LogName Application -Newest 10

// Retrieves events with ID 1000 from the System log
Get-EventLog -LogName System | Where-Object { $_.EventID -eq 1000 }

// Finds all error type events from all logs
Get-EventLog -LogName * | Where-Object { $_.EntryType -eq 'Error' }

// Sets up a watcher to monitor Application log for Error events and alerts
$query = '*[System[Level=2]]'  // Level 2 is Error
$watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher('Application', $query, $true)
Register-ObjectEvent $watcher 'EventRecordWritten' -Action {
    Send-MailMessage -From 'server@example.com' -To 'admin@example.com' -Subject 'Error Event Detected' -Body ($Event.SourceEventArgs.EventRecord.FormatDescription())
}

// Exports security log events to a CSV file
Get-EventLog -LogName Security | Export-Csv 'C:\SecurityLog.csv'

// Clears all entries from the Application event log
Clear-EventLog -LogName Application

// Lists all event sources from the Application log
Get-EventLog -LogName Application | Select-Object Source -Unique

// Creates a new event log 'CustomLog' with a new source 'CustomSource'
New-EventLog -LogName 'CustomLog' -Source 'CustomSource'

// Writes an informational event to the 'CustomLog'
Write-EventLog -LogName 'CustomLog' -Source 'CustomSource' -EntryType Information -EventID 1 -Message 'This is a test event.'

// Uses XML to query the Security log for audit failures
$xmlFilter = "<QueryList><Query Id='0' Path='Security'>
<Select Path='Security'>*[System[(EventID=4625)]]</Select>
</Query></QueryList>"
$events = Get-WinEvent -FilterXml $xmlFilter
$events

// Removes an event source named 'CustomSource'
Remove-EventLog -Source 'CustomSource'

// Retrieves the Application log from a remote computer named 'Server01'
Get-EventLog -LogName Application -ComputerName 'Server01'

// Generates a report of Warning and Error events from the System log
$events = Get-EventLog -LogName System | Where-Object { $_.EntryType -match 'Warning|Error' }
$events | Format-Table TimeGenerated, Source, Message -AutoSize

// Tracks Event IDs 4624 (logon) and 4634 (logoff) from the Security log
Get-EventLog -LogName Security | Where-Object { $_.EventID -in 4624, 4634 } | Select-Object TimeGenerated, UserName, Message

// Analyzes shutdown (Event ID 1074) and restart events
Get-EventLog -LogName System | Where-Object { $_.EventID -eq 1074 }
Get-EventLog -LogName System | Where-Object { $_.EventID -in 1074, 1076 }

// Monitors for disk space related events and sends an alert if detected
$query = '*[System[Provider[@Name="disk"] and (EventID=11 or EventID=15)]]'
$watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher('System', $query, $true)
Register-ObjectEvent $watcher 'EventRecordWritten' -Action {
    Write-Host 'Disk issue detected: ' + $Event.SourceEventArgs.EventRecord.FormatDescription()
}

// Finds all application crash events (Event ID 1000) in the Application log
Get-EventLog -LogName Application | Where-Object { $_.EventID -eq 1000 }

// Retrieves events related to service failures
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7031} | Select-Object TimeCreated, Message

// Automates the generation of a daily report of critical events
$yesterday = (Get-Date).AddDays(-1)
$events = Get-EventLog -LogName System -After $yesterday | Where-Object { $_.EntryType -eq 'Error' }
$report = $events | Format-Table TimeGenerated, Source, EventID, Message -AutoSize
$report | Out-File 'C:\DailyEventReport.txt'

// Archives and clears event logs monthly
$logs = Get-EventLog -List | Where-Object {$_.Entries.Count -gt 0}
foreach ($log in $logs) {
    $fileName = 'C:\Logs\'+$log.Log+'_'+(Get-Date -Format 'yyyyMMdd')+'.evtx'
    Export-EventLog -LogName $log.Log -Path $fileName
    Clear-EventLog -LogName $log.Log
}

// Views all events triggered by the user 'JohnDoe'
Get-EventLog -LogName Security | Where-Object { $_.ReplacementStrings -contains 'JohnDoe' } | Select-Object TimeGenerated, EventID, Message

// Displays events indicating USB device connections and disconnections
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-DriverFrameworks-UserMode/Operational'; ID=2003, 2100}

// Monitors performance-related events and generates a report
$performanceEvents = Get-EventLog -LogName System | Where-Object { $_.EventID -in 100, 200 }
foreach ($event in $performanceEvents) {
    Write-Output ('Time: ' + $event.TimeGenerated + ', Message: ' + $event.Message)
}

4624 = 'An account was successfully logged on';
4625 = 'An account failed to log on';
4634 = 'An account was logged off';
4647 = 'User initiated logoff';
4672 = 'Special privileges assigned to new logon';
4800 = 'The workstation was locked';
4801 = 'The workstation was unlocked';
4802 = 'The screen saver was invoked';
4803 = 'The screen saver was dismissed';

1102 = 'The audit log was cleared';
4625 = 'An account failed to log on';
4648 = 'A logon was attempted using explicit credentials';
4720 = 'A user account was created';
4728 = 'A member was added to a security-enabled global group';
4732 = 'A member was added to a security-enabled local group';
4756 = 'A member was added to a security-enabled universal group';
4767 = 'A user account was unlocked';
4771 = 'Kerberos pre-authentication failed';
4776 = 'The computer attempted to validate the credentials for an account';

1000 = 'Application Error';
1001 = 'Application Hang';
1002 = 'Application Hang';
1026 = '.NET Runtime Error';
1033 = 'Application Crash';
11707 = 'Installation Completed Successfully';
11708 = 'Installation operation failed';

41 = 'System has rebooted without cleanly shutting down first';
100 = 'Windows is not performing optimally';
200 = 'System performance has degraded';
6008 = 'The previous system shutdown was unexpected';
6013 = 'System uptime';

5152 = 'The Windows Filtering Platform blocked a packet';
5157 = 'The Windows Filtering Platform has blocked a connection';
5447 = 'A Windows Filtering Platform filter has been changed';

5136 = 'Directory Service object was modified';
5137 = 'Directory Service object was created';
5138 = 'Directory Service object was undeleted';
5139 = 'Directory Service object was moved';
5141 = 'Directory Service object was deleted';

Get-Date -UFormat %s -Difference (gcim Win32_OperatingSystem).LastBootUpTime

Get-LocalUser

Get-LocalGroup

New-LocalUser -Name 'NewUser' -Password (ConvertTo-SecureString 'P@ssword!' -AsPlainText -Force)

Add-LocalGroupMember -Group 'Administrators' -Member 'NewUser'

Remove-LocalUser -Name 'OldUser'

Disable-LocalUser -Name 'UserToDisable'

$password = ConvertTo-SecureString 'NewPassword123!' -AsPlainText -Force
Set-LocalUser -Name 'User1' -Password $password

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0

Restart-Service -Name 'Spooler'

Get-Service | Where-Object {$_.Status -eq 'Running'}

Get-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -eq 'Stopped'}

$action = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument '-NoProfile -WindowStyle Hidden -Command "& {Get-Process}"'
$trigger = New-ScheduledTaskTrigger -At 3am -Daily
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'DailyProcessCheck' -Description 'Checks running processes daily at 3 AM'

Update-Help

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher | Export-Csv -Path 'C:\InstalledPrograms.csv' -NoTypeInformation

Get-PSDrive -PSProvider FileSystem

Get-NetAdapter | Select-Object Name, Status, MacAddress, LinkSpeed

Clear-DnsClientCache

Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'}

Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, CsManufacturer, CsModel

Reg Export HKLM\Software C:\BackupReg\SoftwareRegBackup.reg

Reg Import C:\BackupReg\SoftwareRegBackup.reg

Get-Counter '\Processor(_Total)\% Processor Time' -Continuous

Get-Process -Name 'notepad' | Select-Object Name, Id, CPU, WorkingSet

Stop-Process -Id 1234 -Force

New-NetIPAddress -InterfaceAlias 'Ethernet0' -IPAddress 192.168.1.100 -PrefixLength 24 -DefaultGateway 192.168.1.1
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet0' -ServerAddresses 8.8.8.8, 8.8.4.4

Get-NetFirewallRule | Format-Table Name, Enabled, Action, Direction

Enable-NetFirewallRule -DisplayName 'File and Printer Sharing (Echo Request - ICMPv4-In)'

Export-NetFirewallRule -File 'C:\FirewallRulesBackup.wfw'

Import-NetFirewallRule -File 'C:\FirewallRulesBackup.wfw'

New-PSDrive -Name 'Z' -PSProvider 'FileSystem' -Root '\\Server\SharedFolder' -Persist

Remove-PSDrive -Name 'Z'

New-Item -Path 'C:\Users\Public\Documents\example.txt' -ItemType 'file'

Set-Content -Path 'C:\Users\Public\Documents\example.txt' -Value 'Hello, world!'

Get-Content -Path 'C:\Users\Public\Documents\example.txt'

Copy-Item -Path 'C:\Users\Public\Documents\example.txt' -Destination 'C:\Users\Public\Documents\Backup\'

Move-Item -Path 'C:\Users\Public\Documents\example.txt' -Destination 'C:\Users\Public\Documents\NewFolder\'

Remove-Item -Path 'C:\Users\Public\Documents\example.txt'

Rename-Item -Path 'C:\Users\Public\Documents\example.txt' -NewName 'new_example.txt'

Get-ChildItem -Path 'C:\Users\Public\Documents\'

Get-ChildItem -Path 'C:\Users\Public\Documents\' -Filter '*.txt'

Get-ChildItem -Path 'C:\Users\Public\Documents\' -Recurse | Where-Object { $_.Length -gt 1MB }

Set-ItemProperty -Path 'C:\Users\Public\Documents\example.txt' -Name IsReadOnly -Value $true

Compress-Archive -Path 'C:\Users\Public\Documents\Folder' -DestinationPath 'C:\Users\Public\Documents\Archive.zip'

Expand-Archive -Path 'C:\Users\Public\Documents\Archive.zip' -DestinationPath 'C:\Users\Public\Documents\Extracted'

CIPHER /E /S:'C:\Users\Public\Documents\example.txt'

CIPHER /D /S:'C:\Users\Public\Documents\example.txt'

New-Item -ItemType HardLink -Path 'C:\Users\Public\Documents\LinkToFile.txt' -Value 'C:\Users\Public\Documents\example.txt'

New-Item -ItemType SymbolicLink -Path 'C:\Users\Public\Documents\LinkToFolder' -Value 'C:\Users\Public\Documents\Folder'

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = 'C:\Users\Public\Documents'
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher 'Changed' -Action { Write-Host 'File changed: ' + $Event.SourceEventArgs.FullPath }

Get-Acl -Path 'C:\Users\Public\Documents\example.txt' | Select-Object Owner

$acl = Get-Acl -Path 'C:\Users\Public\Documents\example.txt'
$newOwner = New-Object System.Security.Principal.NTAccount('DOMAIN', 'Username')
$acl.SetOwner($newOwner)
Set-Acl -Path 'C:\Users\Public\Documents\example.txt' -AclObject $acl

$acl = Get-Acl -Path 'C:\Users\Public\Documents\example.txt'
$permission = 'DOMAIN\User','FullControl','Allow'
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($permission)
$acl.SetAccessRule($accessRule)
Set-Acl -Path 'C:\Users\Public\Documents\example.txt' -AclObject $acl

Get-ChildItem -Path 'C:\Users\Public\Documents\' -Filter '*.txt' | Rename-Item -NewName { $_.Name -replace '.txt','.log' }

(Get-ChildItem -Path 'C:\Users\Public\Documents\' -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB

Get-ChildItem -Path 'C:\Windows\Temp\' -File | Where-Object { $_.CreationTime -lt (Get-Date).AddDays(-30) } | Remove-Item

Get-Acl -Path 'C:\Users\Public\Documents\example.txt' | Format-List -Property *

$files = Get-ChildItem -Path 'C:\Logs' -Filter '*.log' | Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-90) }
$files | Remove-Item

Get-FileHash -Path 'C:\Users\Public\Documents\example.txt' -Algorithm SHA256

Select-String -Path 'C:\Users\Public\Documents\*.log' -Pattern 'error'

$shadow = Get-WmiObject Win32_ShadowCopy | Select-Object -First 1
Copy-Item -Path ($shadow.DeviceObject + '\Users\Public\Documents\example.txt') -Destination 'C:\Users\Public\Documents\RestoredExample.txt'

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = 'C:\Users\Public\Documents'
$watcher.Filter = '*.txt'
$watcher.NotifyFilter = [System.IO.NotifyFilters]'FileName, LastWrite'
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher 'Changed' -Action {
  $path = $Event.SourceEventArgs.FullPath
  $backupPath = 'C:\Backup' + $path.Substring(2)
  Copy-Item -Path $path -Destination $backupPath
  Write-Host ('Backup of ' + $path + ' was created.')
}

Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, OsManufacturer, OsConfiguration

Get-Process

Get-Counter '\Processor(_Total)\% Processor Time'

Get-PSDrive -PSProvider FileSystem

Get-NetAdapter | Select-Object Name, Status, MacAddress, LinkSpeed

Get-NetAdapterStatistics

Get-LocalUser | Select-Object Name, LastLogon

Get-EventLog -LogName System -EntryType Error

Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' }

Get-CimInstance -ClassName Win32_OperatingSystem | Select-Object LastBootUpTime

Get-ScheduledTask | Select-Object TaskName, State

Get-LocalUser | Where-Object { $_.PasswordNeverExpires -eq $true }

$watcher = New-Object System.IO.FileSystemWatcher
$watcher.Path = 'C:\Path\To\Directory'
$watcher.IncludeSubdirectories = $true
$watcher.EnableRaisingEvents = $true
Register-ObjectEvent $watcher 'Changed' -Action { Write-Host ('File changed: ' + $Event.SourceEventArgs.FullPath) }

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion

Get-Counter '\Memory\Available MBytes'

Get-CimInstance -ClassName Win32_BIOS

Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' }

Get-NetFirewallRule | Export-Csv -Path 'C:\FirewallRules.csv'

Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4624]]"
Get-EventLog -LogName Security | Where-Object { $_.EventID -in 4624, 4625 }

Get-WinEvent -LogName Microsoft-Windows-DriverFrameworks-UserMode/Operational | Where-Object { $_.Id -in 2003, 2100 }

Get-EventLog -LogName System | Where-Object { $_.EventID -eq 1 }

powercfg /query

while ($true) {
  Get-Counter '\Processor(_Total)\% Processor Time' | Out-File -Append -FilePath 'C:\PerfLogs\CpuUtil.log'
  Start-Sleep -Seconds 60
}

Get-ChildItem -Path 'C:\Users\' -Recurse | Group-Object -Property Directory | Select-Object Name, @{Name='Files'; Expression={$_.Group | Measure-Object -Sum Length}}

Open-Files | Select-Object Id, AccessedBy, OpenMode, Path

Get-ChildItem -Path 'C:\Data' -Recurse | Where-Object { (Get-Acl $_.FullName).Owner -eq 'Unknown' }

Get-Process | Where-Object { $_.WS -gt 500MB }

Get-EventLog -LogName System | Where-Object { $_.EventID -in 6006, 6008, 1074 } | Out-File 'C:\SystemLogs\RebootLog.txt'

Get-WinEvent -LogName Setup | Where-Object { $_.ProviderName -eq 'Microsoft-Windows-Servicing' }