PowerShell for Administrators
PowerShell is regular in a way that makes it guessable: every cmdlet is a verb and a noun. Learning the verbs and the discovery cmdlets is worth more than memorising any particular command.
PowerShell for Administrators · firsttry.app/cheatsheets/powershell-commands · original reference written from published exam objectives. Not affiliated with any certification body.
Discovery, which replaces memorising
| Command | What it does |
|---|---|
| Get-Command -Noun Service | Every cmdlet acting on services |
| Get-Help Get-Service -Examples | Worked examples for a cmdlet |
| Get-Member | What properties and methods an object has |
| Get-Verb | The approved verbs and what each one implies |
| Update-Help | Download current help content |
Windows administration
| Command | What it does |
|---|---|
| Get-Service -Name W32Time | Service state |
| Restart-Service -Name Spooler | Restart a service |
| Get-Process | Sort CPU -Descending | Processes by CPU |
| Stop-Process -Id 1234 -Force | Terminate a process |
| Get-EventLog -LogName Security -Newest 50 | Recent security events |
| Get-WinEvent -FilterHashtable @{LogName='Security';ID=4625} | Failed logons only |
| Get-LocalUser / Get-LocalGroupMember | Local accounts and group membership |
| Test-NetConnection host -Port 443 | Connectivity to a port |
| Get-NetIPConfiguration | Addressing, gateway and DNS |
| Get-ChildItem -Recurse -Filter *.log | Recursive file search |
| Set-ExecutionPolicy RemoteSigned | Allow local scripts to run |
Azure and Entra ID
| Command | What it does |
|---|---|
| Connect-AzAccount | Sign in to Azure |
| Get-AzSubscription | Subscriptions you can reach |
| Set-AzContext -Subscription NAME | Choose the working subscription |
| Get-AzResourceGroup | Resource groups |
| New-AzVM -Name web01 -ResourceGroupName rg | Create a virtual machine |
| Get-AzRoleAssignment -Scope /subscriptions/ID | Who has what access |
| New-AzRoleAssignment -RoleDefinitionName Reader | Grant a role |
| Connect-MgGraph -Scopes User.Read.All | Sign in to Microsoft Graph |
| Get-MgUser -All | Entra ID users |
Pipeline and structure
| Pattern | What it does |
|---|---|
| Where-Object { $_.Status -eq 'Running' } | Filter objects by a property |
| Select-Object Name, Status | Choose which properties to keep |
| Sort-Object -Property CPU -Descending | Order results |
| ForEach-Object { ... } | Act on each object |
| Export-Csv out.csv -NoTypeInformation | Write results to CSV |
| | Out-GridView | Open results in a sortable window |
| $var = Get-Service | Store objects, not text. This is the difference from a shell |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.