PowerShell for Administrators
PowerShell is regular in a way that makes it guessable: every cmdlet is a verb and a noun. Learning the verbs and the discovery cmdlets is worth more than memorizing any particular command.
PowerShell for Administrators · firsttry.app/cheatsheets/powershell-commands · original reference written from published exam objectives. Not affiliated with any certification body.
Discovery, which replaces memorizing
| Command | What it does |
|---|---|
| Get-Command -Noun Service | Every cmdlet acting on services |
| Get-Help Get-Service -Examples | Worked examples for a cmdlet |
| Get-Member | What properties and methods an object has |
| Get-Verb | The approved verbs and what each one implies |
| Update-Help | Download current help content |
Windows administration
| Command | What it does |
|---|---|
| Get-Service -Name W32Time | Service state |
| Restart-Service -Name Spooler | Restart a service |
| Get-Process | Sort CPU -Descending | Processes by CPU |
| Stop-Process -Id 1234 -Force | Terminate a process |
| Get-EventLog -LogName Security -Newest 50 | Recent security events |
| Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} | Failed logons only |
| Get-LocalUser / Get-LocalGroupMember | Local accounts and group membership |
| Test-NetConnection host -Port 443 | Connectivity to a port |
| Get-NetIPConfiguration | Addressing, gateway and DNS |
| Get-ChildItem -Recurse -Filter *.log | Recursive file search |
| Set-ExecutionPolicy RemoteSigned | Allow local scripts to run |
Azure and Entra ID
| Command | What it does |
|---|---|
| Connect-AzAccount | Sign in to Azure |
| Get-AzSubscription | Subscriptions you can reach |
| Set-AzContext -Subscription NAME | Choose the working subscription |
| Get-AzResourceGroup | Resource groups |
| New-AzVM -Name web01 -ResourceGroupName rg | Create a virtual machine |
| Get-AzRoleAssignment -Scope /subscriptions/ID | Who has what access |
| New-AzRoleAssignment -RoleDefinitionName Reader | Grant a role |
| Connect-MgGraph -Scopes User.Read.All | Sign in to Microsoft Graph |
| Get-MgUser -All | Entra ID users |
Pipeline and structure
| Pattern | What it does |
|---|---|
| Where-Object { $_.Status -eq 'Running' } | Filter objects by a property |
| Select-Object Name, Status | Choose which properties to keep |
| Sort-Object -Property CPU -Descending | Order results |
| ForEach-Object { ... } | Act on each object |
| Export-Csv out.csv -NoTypeInformation | Write results to CSV |
| | Out-GridView | Open results in a sortable window |
| $var = Get-Service | Store objects, not text. This is the difference from a shell |
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
Monitor and maintain Azure resources
What is the longest the soft delete retention period for backup data can be extended to?
2-10Security
A SOHO access point cannot run WPA3 or transitional mode. Which setting is the acceptable fallback?
Plan and automate identity governance
Who should be engaged to confirm that people still need access to a resource?
Five free questions on every practice exam. No account, no card.