PowerShell troubleshooting: diagnose the symptom

CIM works locally but not remotely: adding -ComputerName switches the transport to WS-Management on port 5985, which needs the remoting infrastructure in place.

DNS resolves but the application is unreachable: resolution and reachability are independent - a correct record proves only that the record exists.

Diagnose remote file-share access failures caused by PowerShell remoting second-hop credential delegation before changing permissions or remoting policy.

Resolve-DnsName works against one DNS server only: the DNS servers do not currently hold equivalent data. Check the evidence and verify the fix.

REST call returns certificate or TLS errors: the .NET stack validates the chain, hostname, and expiry before any request leaves; Windows PowerShell 5.1.

Fix PowerShell WinRM remoting failures with checks for connectivity, configuration and access. Trace the connection error and verify the result before retrying.

A broad AD filter can transfer too many objects before client-side filtering. Narrow the server-side query and measure again.

Get-ADUser is not recognized: the AD cmdlets live in the ActiveDirectory module, which ships with the RSAT feature - not with PowerShell itself.

Locked user account keeps locking: lockout counters accumulate failures from every source - a stale cached password on a service, scheduled task, or phone mail.

A completed job keeps output until Receive-Job retrieves it. Check the job state and collect the buffered results. Inspect job errors.

Scheduled task returns 0x8007052E: Windows rejected the supplied logon credentials. Check the evidence and verify the fix.

Diagnose a PowerShell script that works interactively but fails in Task Scheduler by comparing identity, working directory, profiles, paths, and captured evidence.

Command works on one host but not another: hosts drift over time - different PowerShell versions, module versions, or module paths.

Fix malformed PowerShell CSV output by keeping objects intact, using Select-Object instead of formatting cmdlets, and exporting structured data at the end.

Module imports but command is missing: the manifest's FunctionsToExport controls what gets exported, so the command may be excluded deliberately or by accident.

Trace a null-valued expression to the command that returned no object, then guard or validate the value before using it.

Parameter binding fails: PowerShell resolves parameter sets before executing, so a combination spanning two mutually exclusive sets is unresolvable.

PowerShell JSON log contains truncated nested data: ConvertTo-Json limits serialization depth, so deeper nested properties are dropped.

Diagnose a blocked script by checking the effective execution policy and its scope precedence before changing settings. Check each scope.

Authenticode signature status changes to HashMismatch: the file bytes changed after the file was signed. Check the evidence and verify the fix.

A certificate can be installed yet fail application checks. Inspect trust, key usage, private key access, and hostname requirements.

Copied files have different SHA256 hashes: hashing compares raw bytes, so any changed byte - line endings, metadata - changes the hash.

Service is running but the application is down: the service control manager tracks whether a process started, not whether the code inside is doing anything.

Az PowerShell may keep a different active subscription after sign-in. Inspect the context and select the intended subscription.

GPO processing is slow: policy processing is a sequence of directory lookups and SYSVOL file reads, inheriting every DNS and domain-controller location delay.

Parallel script is slower than serial: every runspace pays startup and module-import costs that exceed the savings for small units of work.