Microsoft.PowerShell.Diagnostics module: setup and commands

Module 2 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Read Windows event and diagnostic data with Get-WinEvent and related cmdlets while filtering at the provider instead of after retrieval.

Getting it

Part of the Windows install of PowerShell. Both cmdlets are Windows only and are absent from Linux and macOS builds.

Examples

1PS> Get-WinEvent -LogName System -MaxEvents 10

Show reference output

1 TimeCreated Id LevelDisplayName ProviderName

2 --------------------- ---- ---------------- -----------------------------------

3 9/10/2026 10:51:12 PM 4625 Information Microsoft-Windows-Security-Auditing

4 9/10/2026 10:32:05 PM 7031 Error Service Control Manager

1PS> Get-Counter "\Processor(_Total)\% Processor Time"

Show reference output

1 Timestamp CounterSamples

2 --------- --------------

3 9/10/2026 11:47:12 PM \SRV01\processor(_total)\% processor time : 12.48

4 9/10/2026 11:47:14 PM \SRV01\processor(_total)\% processor time : 18.06

What it is for

Use Get-WinEvent whenever events need filtering on the server side rather than being pulled in bulk and filtered afterwards. Get-Counter suits a short live sample of processor or memory counters when standing up real monitoring would be overkill.

Typical tasks

Pull errors and warnings from the last day
Filter security events by event ID
Read an application-specific event channel
Sample processor and memory counters
Correlate a failure window across two logs
Export events for offline review

Check the installed version

1PS> Get-Module -ListAvailable Microsoft.PowerShell.Diagnostics | Select-Object Name, Version, Path

2PS> Get-Command -Module Microsoft.PowerShell.Diagnostics

Compare the module path and version with the session used by your scheduled task or automation account. Use Get-WinEvent whenever events need filtering on the server side rather than being pulled in bulk and filtered afterwards. Get-Counter suits a short live sample of processor or memory counters when standing up real monitoring would be overkill.

Primary documentation

Get-WinEvent reference

Continue