Site index

Build practical PowerShell admin projects for reporting, onboarding, inventory, troubleshooting and automation, with safety checks and verification steps.

Start with objects and pipelines, then build scripts for Active Directory, reporting and remote administration. Follow a learning track or choose a task.

Browse 182 PowerShell commands with syntax, parameters, object output, examples, and module notes for Windows, Microsoft 365, Azure, AD, files, and automation.

Match your error message to one of 15 guides. Each explains what failed, likely causes, diagnostic checks and the next steps to resolve it.

Browse PowerShell learning paths by task: Active Directory, remoting, cloud administration, files, debugging and Windows operations.

Prepare for PowerShell interviews with explained scenario questions, then test your understanding with a 12-question PowerShell quiz.

Find module prerequisites, installation guidance and the commands used for Windows, Active Directory and cloud administration.

Answer topic-based questions about commands, scripting and administration. Read the explanation, revisit the lesson and try the next question.

Explore explained scripts for Windows, Active Directory, Microsoft Entra and reporting. Review the prerequisites and sample output before adapting a script.

Investigate script, module, remoting and permission problems with a focused check, an explanation of the cause and a practical next step.

Practice PowerShell with 40 browser exercises, daily and 30-day challenges, real admin projects, error diagnosis, pipeline labs, and progress tracking.

Inspect the Entra Connect scheduler, choose Delta or Initial sync and verify connector results before declaring directory synchronization complete.

Query users, groups and domain controllers; validate directory state before making changes.

Learn Azure PowerShell administration with the Az module. Explore command examples, inspect the results and practice working with Azure resources and context.

Check $PSVersionTable, distinguish Windows PowerShell from PowerShell 7 and identify the executable used by a script or scheduled task.

Learn Exchange Online PowerShell for mailbox and mail-flow administration. Follow command examples, interpret the output and practice working with cloud mail.

Identify which policy applies before changing a setting or unblocking a script. Read the command examples and check the expected output.

Copy, query, compare and export files while checking paths, encoding, byte counts and integrity.

Learn how Where-Object tests each pipeline object one at a time with comparison operators like -eq, -gt, and -like.

Learn to discover PowerShell commands with Get-Command. Filter by verb, noun or module, inspect available commands and practice with explained examples.

Learn to use Get-Help in PowerShell to find syntax, parameters and examples. Explore the help system and practice checking command usage before running scripts.

Learn to inspect PowerShell objects with Get-Member. Discover their types, properties and methods, interpret the output and apply the lesson in an exercise.

Learn to install and verify PowerShell, identify the executable in use and check your version. Follow practical examples before starting your scripting work.

Connect to the right tenant, request the required permissions and inspect cloud inventory as objects.

Learn Microsoft Graph PowerShell for cloud identity administration. Explore command examples, understand returned objects and practice Microsoft cloud queries.

Learn how PowerShell modules package reusable automation. Explore module examples, understand their structure and practice organizing commands for reuse.

Understand how PowerShell object pipelines differ from text processing, inspect properties and keep structured data available for the next command.

Windows PowerShell 5.1 vs PowerShell 7: key differences, .NET Framework vs .NET, and what works where. Know which version to target for your scripts.

Learn to inventory Active Directory computer accounts with PowerShell. Follow query examples, inspect returned properties and practice interpreting the results.

Learn Active Directory group management with PowerShell. Explore group membership and structure through command examples, explained output and a practice task.

Learn to diagnose Active Directory replication with PowerShell. Follow examples, inspect returned results and practice investigating replication failures.

Learn to query and manage Active Directory users with PowerShell. Follow command examples, inspect user properties and practice working with directory objects.

Manage AD users, groups, computers and OUs with the ActiveDirectory module. Installation, key cmdlets like Get-ADUser, and hands-on examples.

Turn plain functions into advanced functions with [CmdletBinding()]. Get -Verbose, -Debug and common parameters for free, plus pipeline support and validation.

Learn PowerShell arrays for working with collections. Follow examples for reading values, understand the output and practice processing multiple items.

Run long tasks without blocking your prompt using PowerShell background jobs. Start-Job, Get-Job, Receive-Job and Wait-Job explained with practical examples.

Learn the differences between CIM and WMI in PowerShell. Explore the Windows management interface through command examples, explained results and an exercise.

Learn to import and export CSV data in PowerShell. Follow examples, understand how rows become objects and practice moving tabular data through your scripts.

Learn PowerShell code signing and trust verification. Follow examples for signed scripts, inspect the results and practice checking trust before execution.

PowerShell Comparison operators: read the examples, check prerequisites and follow the explanation before using the command in your environment.

Compare the same DNS question across the resolution paths your application actually uses. Read the command examples and check the expected output.

Describe what a machine should look like and let DSC make it so. Write Configuration blocks with resources that declare desired state, not steps.

Manage Entra ID users and groups through Microsoft Graph with PowerShell. Learn the cmdlets, avoid common pitfalls, and script identity tasks safely.

Learn to inspect PowerShell ErrorRecord objects beyond the error headline. Follow diagnostic examples and practice reading exception details to trace failures.

Learn to query Windows event logs with PowerShell. Explore diagnostic and security log examples, interpret the results and practice narrowing a query.

Learn Active Directory FSMO roles and inspect operations master role holders with PowerShell. Follow examples and practice interpreting domain information.

Control Windows Firewall with the NetSecurity module. Get-NetFirewallRule, New-NetFirewallRule and Set-NetFirewallRule with real-world rule examples.

Speed up loops with ForEach-Object -Parallel in PowerShell 7. Run iterations concurrently in separate runspaces and learn throttle limits and gotchas.

Learn to turn repeated PowerShell commands into reusable functions. Follow worked examples, understand function behavior and practice organizing script logic.

Trace the effective policy for an affected user and computer instead of guessing from a GPO link. Read the command examples and check the expected output.

Learn PowerShell hashtables for key-value data. Follow examples for storing and reading entries, inspect the output and practice using structured lookups.

Learn Just Enough Administration in PowerShell to constrain operator capabilities. Explore examples, understand access models and practice applying the lesson.

Learn to work with JSON in PowerShell for APIs and configuration. Follow conversion examples, inspect returned objects and practice handling structured data.

Understand Service Principal Names and how Kerberos authentication works. Diagnose SPN issues that cause silent NTLM fallback or outright auth failures.

Stop over-privileging automation accounts. Learn to scope service accounts and scheduled tasks to minimum rights without breaking scripts.

Structure PowerShell modules others can actually use. Learn the conventional layout: public vs private functions, manifests, one function per file.

Write runbooks someone can follow at 3 AM. Learn to document procedures clearly, then automate from the runbook with PowerShell.

Learn to build PowerShell reporting objects with PSCustomObject. Follow examples for named properties, inspect the output and practice creating structured data.

Catch bugs before runtime with PSScriptAnalyzer. Run Invoke-ScriptAnalyzer to check code against best-practice rules without executing anything.

Reject invalid inputs at the boundary and explain what your function accepts. Read the command examples and check the expected output.

Find slow code with Measure-Command. Learn to benchmark script blocks, compare approaches, and spot performance bottlenecks in your automation.

Learn to write automated PowerShell tests with Pester. Follow worked examples, understand assertions and test results, then practice verifying script behavior.

Make your functions accept pipeline input. Learn [Parameter(ValueFromPipeline)], process blocks, and how objects flow between commands.

Learn to inspect CPU and memory usage with PowerShell process commands. Follow examples, interpret process properties and practice investigating programs.

Learn to call REST APIs with PowerShell and handle structured responses. Follow request examples, inspect returned objects and practice using service data.

Stop mixing up PowerShell's two pattern systems. Learn when to use wildcards vs regex, with -like, -match and -replace explained through examples.

Learn PowerShell remoting for remote Windows administration. Follow command examples, understand session behavior and practice working with remote results.

Learn how PowerShell runspaces support concurrent work. Explore execution examples, understand the output and practice the concepts behind parallel automation.

Learn cross-platform PowerShell remoting over SSH. Review the session examples, understand remote command execution and practice interpreting returned output.

Automate with the ScheduledTasks module. Build tasks from actions, triggers and principals, then register them with Register-ScheduledTask.

Learn PowerShell scope and variable visibility. Follow examples showing variable visibility, inspect the results and practice reasoning about script state.

Keep your script library from becoming a liability. Learn versioning, review practices, and standards that make automation safe to change.

Learn to inspect and control Windows services with PowerShell. Follow examples, understand service state and practice checking results before taking action.

Check client subnet mapping and replication topology as separate parts of a site problem. Read the command examples and check the expected output.

Learn how to pass named parameters with a PowerShell hashtable, keep command calls readable and reuse options with splatting.

Learn lightweight PowerShell concurrency with thread jobs. Follow examples for starting work and collecting results, then practice inspecting job behavior.

Record every command and output with Start-Transcript and Stop-Transcript. Create audit trails for change windows and incident response.

Master PowerShell's six output streams. Learn when to use Write-Verbose, Write-Debug and Write-Warning, and how to redirect each stream.

Learn WinRM prerequisites for Windows PowerShell remoting. Follow the examples, understand connection requirements and practice checking your remoting setup.

Replace ipconfig with objects. Use Get-NetAdapter, Get-NetIPAddress and Get-NetRoute from the NetTCPIP module for scriptable network admin.

Read error records, test assumptions and preserve useful evidence when automation fails.

Master PowerShell's three remaining loops: for, while, and do. Learn when each runs, how conditions are tested, and avoid infinite loops with clear examples.

Learn to iterate collections with foreach in PowerShell. Follow worked examples, understand how each item is processed and practice writing your own loop.

Control script flow with if, elseif and else. Learn condition syntax, comparison operators, and how PowerShell evaluates truthiness in branching logic.

Learn to treat PowerShell scripts as software in CI/CD workflows. Follow examples, understand automated checks and practice preparing scripts for a pipeline.

Learn filters, projections, sorting, functions and data types, then check your understanding in the practice console.

Diagnose WinRM, sessions, remote queries and authentication with checks that isolate the failing layer.

Learn the PowerShell switch statement for handling multiple cases. Follow worked examples, understand matching behavior and practice choosing the right branch.

Learn which errors catch handles, when to use ErrorAction Stop and how finally supports cleanup after a command succeeds or fails.

Learn how $ErrorActionPreference decides what happens after a cmdlet error. Compare Continue, SilentlyContinue, Stop, and Inquire.

Navigate the registry, certificates and variables like filesystems. Learn PowerShell providers and PSDrives: Get-ChildItem and Set-Location work everywhere.

Launch powershell.exe or pwsh from CMD, choose -File or -Command, quote paths correctly and inspect the process exit code.

Learn SharePoint Online administration with PowerShell. Explore site and permission management examples, inspect results and practice administrative queries.

Learn Microsoft Teams administration with PowerShell. Follow command examples, inspect returned data and practice using Teams queries in administrative work.

Learn how the PowerShell pipeline passes objects between commands. Follow examples, inspect properties and practice combining commands into useful queries.

Update PowerShell 7, distinguish engine updates from module updates and verify which executable your automation uses after the change.

Learn how PowerShell variables store values and how scope affects access. Follow assignment examples, inspect output and practice using variables in scripts.

Learn what PowerShell is, how its object pipeline works and how it differs from a traditional command prompt. Explore examples and try the lesson exercise.

Inspect installed hotfixes, understand Get-HotFix coverage and distinguish Windows Update automation from PowerShell and module updates.

Inspect service state, process memory, CPU totals, event logs and scheduled tasks without confusing state with health.

Every PowerShell command is Verb-Noun. Learn the naming pattern so you can guess Get-Process, Stop-Service and New-Item correctly on the first try.

Return the disabled accounts and their sign-in names.

Return services that are both stopped and configured for Manual startup.

Practice PowerShell: return services that are both Running and Manual, sorted by Name. Both conditions must hold. Build the pipeline and check the result.

Return the two processes with the largest working sets.

Practice PowerShell: return all processes except the one named chrome, sorted by Name. Build the pipeline and check the result.

Practice PowerShell: return processes whose cumulative CPU time is greater than five seconds. Build the pipeline and check the result.

Practice PowerShell: return processes with more than 100 MiB of working-set memory. The WS property is measured in bytes.

Return every account that is not in the IT department.

Practice PowerShell: return services with an Automatic start type, sorted by Name. Build the pipeline and check the result.

Return the VMs that are deallocated.

Return the enabled accounts in the IT department, with their sign-in names.

Return .log files larger than 10 MiB, largest first.

Practice PowerShell: return all services configured for Manual startup, including stopped services. Build the pipeline and check the result.

Practice PowerShell: return processes whose Id is greater than 9000, sorted by Id. Build the pipeline and check the result.

Practice PowerShell: return processes with cumulative CPU time below two seconds. Build the pipeline and check the result.

Practice PowerShell: return running services whose Name matches W*, sorted by Name in descending order.

Practice PowerShell: return every service whose StartType is not Automatic. Build the pipeline and check the result.

Return the VMs that are stopped, with their resource groups.

Practice PowerShell: return every stopped service from the sample machine. Build the pipeline and check the result.

Practice PowerShell pipeline reasoning using fictional services data. Build the pipeline in your browser and check the expected result for this task.

Practice PowerShell: return the two processes with the highest cumulative CPU time, highest first. CPU is measured in seconds, not percent.

Practice PowerShell: exclude processes using 100 MiB or more of working-set memory, then return the single largest remaining process.

Practice PowerShell: return the one process with the largest WS value. Build the pipeline and check the result.

Practice PowerShell: return the three processes with the smallest working-set memory, smallest first. Sort all processes before limiting the result.

Return available modules whose ModuleType is Script.

Practice PowerShell: return processes whose Name matches pw*, sorted by CPU descending. Build the pipeline and check the result.

Return event IDs and providers for Error events.

Return every account in the Finance department.

Return every VM in the Lab resource group.

Practice PowerShell filtering: Return every running service. Run the pipeline against fictional services data in your browser and check the expected result.

Practice PowerShell: return the Name values of every service whose name begins with W, sorted alphabetically. Include stopped services.

Practice PowerShell: return all services in descending Name order. Build the pipeline with fictional sample data, run it in the browser, and check your result.

Return the names and power states of non-running VMs.

Practice PowerShell: among processes using less than 100 MiB of working-set memory, return the two with the highest cumulative CPU seconds, highest first.

Return all accounts in alphabetical order, showing whether each is enabled.

Return all VMs in alphabetical order with their power states.

Practice PowerShell: return every process in ascending Name order. Build the pipeline with fictional sample data, run it in the browser, and check your result.

Practice PowerShell: return every service, sorted alphabetically by Name. Build the pipeline and check the result.

Practice PowerShell: sort service names alphabetically, then return the first three. Build the pipeline and check the result.

Return all other service names in alphabetical order.

Build a PowerShell service health review: inspect fictional service objects, filter stopped services, compare startup policy, and hand off a status report.

Build a PowerShell AD account review: inspect fictional users, find disabled accounts, scope by department, and prepare a readable exception report.

Build a PowerShell event log triage project: filter fictional System errors, inspect providers, and prepare an incident handoff with verification steps.

Build a PowerShell log file inventory: filter fictional files by extension and size, rank the largest logs, and prepare a safe cleanup review.

How PowerShell Genie stores local learning progress and optional Google account sync data.

Guided PowerShell project: build a process health snapshot across five milestones -- discover objects, filter with Where-Object, sort, shape a report, and defend it.

Practise Entra ID PowerShell workflows for users, groups, permissions, identity inventory and safe changes using Microsoft Graph.

Build PowerShell fluency with 30 daily command challenges, browser-based checking, solutions and local progress that stays on your device.

Build a PowerShell Verb-Noun command shape with parameters and values, then verify the real syntax and parameter sets with Get-Help.

Build a service or process query and inspect the objects after every stage. Compare the generated PowerShell with a transparent, repeatable sample result.

Quick-reference PowerShell cheat sheet: essential commands, pipeline patterns, and syntax on one page.

Choose a PowerShell learning path for Windows, Active Directory, Microsoft 365, Azure and Entra, automation, or help desk work. Track practical progress.

Paste a PowerShell script and inspect its commands, variables, pipelines and control flow with a browser-based learning explainer.

Learn how PowerShell Genie checks examples, labels fictional output, uses primary documentation and prepares reproducible correction reports.

Learn DSC concepts through practical PowerShell examples covering resources, desired state, idempotency, testing and configuration workflows.

Compare PowerShell approaches with measurement-first exercises for filtering, loops, pipelines and parallel work before optimising scripts.

Plan a safer move from Windows PowerShell 5.1 to PowerShell 7 by checking modules, editions, remoting, compatibility and script behavior.

Compare Windows PowerShell 5.1 and PowerShell 7 behavior, editions, modules and platform support before running or migrating scripts.

Download a PowerShell cheat sheet PDF with common commands, pipeline patterns, object filtering, sorting, services, processes, CSV export, and visual examples.

Read new PowerShell practice challenges and reference updates, then open the featured exercises and command guides.

Paste common PowerShell error text to identify the likely category, understand what it means and start with safer diagnostic checks.

Assemble PowerShell command blocks into a working pipeline — predict the output, check stage order, and diagnose errors.

Browse practical PowerShell scripts with prerequisites, expected behavior, safety notes and verification steps for common admin work.

Explore PowerShell labs for commands, pipelines, debugging, performance, migration, cloud administration and interview practice.

Practise realistic PowerShell interview scenarios, write your answer first, then compare it with an operational reasoning rubric.

Study one practical PowerShell script at a time with context, safety notes, explanation and ideas for adapting it to real admin work.

Step through short PowerShell visual demos for pipelines, objects, Get-Member and error handling, then continue into hands-on practice.

Explore PowerShell objects for services, processes, files and Active Directory. Inspect properties and methods, then build Select-Object pipelines.

Track completed PowerShell challenges, labs and practice activities locally in your browser without creating an account.

Browse PowerShell Genie lessons, command examples, troubleshooting guides, practice tasks, and reference pages from one organized site index.

Practice one short PowerShell admin challenge every day. Write a command, check the pipeline, reveal a hint, and build a local practice streak.

Work through a 60–90 minute challenge lab combining command choice, object filtering, verification and practical reasoning.

Review notable PowerShell platform changes and connect release differences to migration, compatibility and administrator learning resources.

Improve PowerShell scripts by spotting brittle patterns, refactoring for clarity, adding error handling and verifying behavior after each change.

Practise Microsoft 365 PowerShell workflows for Graph, Exchange Online, permissions, reporting, tenant context and safe automation.

Practise Azure PowerShell with subscription context, resource discovery, reporting, safe changes and automation patterns for administrators.

Use Add-ADGroupMember to add users, computers or other groups to an Active Directory group.

Use Add-Content to append a value to the end of a file, leaving existing content in place.

Use Clear-Content to empty a file without deleting it, leaving a zero-length file behind.

Use Compare-Object to compare two sets of objects and report which items are only in one of them.

Use Compress-Archive to create a zip archive from files or folders.

Use Connect-AzAccount to sign in to Azure and verify the tenant and subscription context. See Az module requirements and examples.

Use Connect-ExchangeOnline to connect to Exchange Online and verify the administrator session. See ExchangeOnlineManagement module requirements and examples.

Use Connect-MgGraph to connect to Microsoft Graph with delegated or app-only authentication. See Microsoft.Graph module requirements and examples.

Use ConvertFrom-Json to convert a JSON-formatted string to a PowerShell object. See Microsoft.PowerShell.Utility module requirements and examples.

Use ConvertTo-Json to convert an object to a JSON-formatted string. See Microsoft.PowerShell.Utility module requirements and examples.

Use ConvertTo-Xml to convert objects into an XML representation of their properties.

Use Copy-Item to copy files or directories. Review path handling, recursive copies and examples before choosing a destination.

Use Disable-ADAccount to disable an Active Directory user or computer account, blocking sign-in while keeping the object.

Use Enable-ADAccount to enable a disabled Active Directory user or computer account.

Use Enter-PSSession to start an interactive remoting session, redirecting your prompt to a remote computer.

Use Expand-Archive to extract the contents of a zip archive to a folder.

Use Export-Csv to convert objects into CSV-formatted data and write it to a file. See Microsoft.PowerShell.Utility module requirements and examples.

Use Find-Module to search a registered repository for modules without installing anything.

Use ForEach-Object to perform an operation on each item in a collection of input objects. See Microsoft.PowerShell.Utility module requirements and examples.

Use Format-List to render each object as a vertical list of property names and values.

Use Format-Table to render objects as a table of columns for display.

Use Get-ADComputer to retrieve computer accounts from Active Directory.

Use Get-ADDomain to return information about an Active Directory domain, including its FSMO role holders and naming contexts.

Use Get-ADDomainController to retrieve domain controllers in a domain or forest, with their roles, site and status.

Use Get-ADForest to return information about an Active Directory forest, including its domains, sites and forest-level role holders.

Use Get-ADGroup to retrieve security and distribution groups from Active Directory.

Use Get-ADGroupMember to list the members of an Active Directory group, optionally expanding nested groups.

Use Get-ADObject to retrieve any object from Active Directory regardless of type, including deleted objects.

Use Get-ADOrganizationalUnit to list Active Directory OUs with their distinguished names — the containers Group Policy and delegated administration target.

Use Get-ADReplicationFailure to report AD replication failures per domain controller, so an unreplicated change stops looking like a permissions problem.

Use Get-ADReplicationPartnerMetadata to show when each replication partner last succeeded — the complement to Get-ADReplicationFailure.

Use Get-ADUser to retrieve user accounts from Active Directory by identity, filter or LDAP query.

Use Get-Acl to return the security descriptor of a file, folder, registry key or other securable object.

Use Get-Alias to list the aliases defined in the session, or resolve an alias to the command it points at.

Use Get-AuthenticodeSignature to read a file's signature status: Valid, NotSigned, HashMismatch, NotTrusted, NotSupportedFileFormat, or UnknownError.

Use Get-AzContext to inspect the active Azure account, tenant and subscription. See Az module requirements and examples.

Use Get-AzDisk to inventory Azure managed disks and inspect attachment state. See Az module requirements and examples.

Use Get-AzKeyVault to list Azure vault resources and distinguish access to secret values. See Az module requirements and examples.

Use Get-AzResource to inventory Azure resources by resource group and resource type. See Az module requirements and examples.

Use Get-AzResourceGroup to query Azure resource groups and inspect location and tags. See Az module requirements and examples.

Use Get-AzRoleAssignment to query Azure role assignments by identity, scope and role. See Az module requirements and examples.

Use Get-AzStorageAccount to inventory Azure storage accounts and inspect configuration. See Az module requirements and examples.

Use Get-AzSubscription to list accessible Azure subscriptions and inspect their tenant IDs. See Az module requirements and examples.

Use Get-AzVM to retrieve Azure VM configuration and check power state with Status. See Az module requirements and examples.

Use Get-ChildItem to get the items and child items in one or more specified locations.

Use Get-CimInstance to get instances of CIM classes from a CIM server. See CimCmdlets module requirements and examples.

Use Get-CimSession to list the CIM sessions open in the current PowerShell session.

Use Get-Command to get information about PowerShell commands, including cmdlets, aliases, functions, filters, scripts, applications, and external commands.

Use Get-ComputerInfo to return a single object with over a hundred properties describing the operating system and hardware.

Use Get-Content to get the content of an item at the specified location, most commonly a text file.

Use Get-Counter to read Windows performance counter values, once or as a continuous sample.

Use Get-Date to return the current date and time, or convert and format a date you supply.

Use Get-DistributionGroup to list distribution groups and mail-enabled security groups. See ExchangeOnlineManagement module requirements and examples.

Use Get-DistributionGroupMember to list a distribution group's direct members; nested groups are separate objects.

Use Get-DnsClientServerAddress to show the DNS servers configured per network interface.

Use Get-EXOMailbox to inventory Exchange Online mailboxes with explicit properties. See ExchangeOnlineManagement module requirements and examples.

Use Get-EXOMailboxPermission to inspect mailbox permissions — User, AccessRights, IsInherited and Deny together.

Use Get-EXOMailboxStatistics to return mailbox storage statistics such as TotalItemSize.

Use Get-Error to display the most recent errors in full detail, including nested exceptions and invocation information.

Use Get-ExecutionPolicy to report the effective execution policy, or the policy set at each scope with -List.

Use Get-FileHash to compute a cryptographic hash of a file, defaulting to SHA256.

Use Get-GPO to retrieve Group Policy objects by name, GUID or full inventory. See GroupPolicy module requirements and examples.

Use Get-GPOReport to export Group Policy reports as HTML or XML for inspection. See GroupPolicy module requirements and examples.

Look up syntax, parameters and examples for a PowerShell command. Use the help output to understand a command before running it.

Use Get-History to return the commands run in the current session, with an id for each.

Use Get-HotFix to list installed updates that were delivered as hotfix packages.

Use Get-InboundConnector to inspect inbound mail connectors and their sender restrictions. See ExchangeOnlineManagement module requirements and examples.

Use Get-InboxRule to inspect mailbox inbox rules, including hidden rules and forwarding. See ExchangeOnlineManagement module requirements and examples.

Use Get-InstalledModule to list modules installed by Install-Module, with the version and repository they came from.

Use Get-Item to return the item at a path — file, folder, registry key, or any provider item — to inspect its properties.

Use Get-Job to list the jobs in the session with their current state.

Use Get-LocalGroup to list local security groups on a Windows machine.

Use Get-LocalGroupMember to list the members of a local group, including domain accounts that belong to it.

Use Get-LocalUser to list local user accounts on a Windows machine with their enabled state and password settings.

Use Get-Location to return the current working directory for the session.

Use Get-Member to list an object's properties and methods — the fastest way to discover what pipeline output can do.

Use Get-MgApplication to list app registrations and inspect credential expiry in Microsoft Graph.

Use Get-MgAuditLogSignIn to query Entra sign-in logs with date filters and pagination. See Microsoft.Graph module requirements and examples.

Use Get-MgGroup to list Microsoft Graph groups and distinguish their membership types. See Microsoft.Graph module requirements and examples.

Use Get-MgGroupMember to enumerate direct Microsoft Graph group members with pagination. See Microsoft.Graph module requirements and examples.

Use Get-MgServicePrincipal to list tenant service principals and distinguish object IDs from application IDs.

Use Get-MgSubscribedSku to compare purchased and consumed Microsoft 365 license units. See Microsoft.Graph module requirements and examples.

Use Get-MgUser to query Microsoft Graph users with pagination and explicit properties. See Microsoft.Graph module requirements and examples.

Use Get-MgUserAuthenticationMethod to list a user's registered authentication methods.

Use Get-Module to list modules loaded in the session, or with -ListAvailable those installed and ready to load.

Use Get-NetAdapter to list the network adapters on a Windows machine with their status, speed and MAC address.

Use Get-NetFirewallRule to list Windows Firewall rules with their direction, action and enabled state.

Use Get-NetIPAddress to list the IP addresses configured on the machine's interfaces.

Use Get-NetIPConfiguration to return a per-interface summary combining IP address, gateway and DNS servers.

Use Get-NetRoute to list the machine's IP routing table entries with their destinations and metrics.

Use Get-NetTCPConnection to list TCP connections and listening ports with the owning process id.

Use Get-OutboundConnector to inspect outbound mail connectors and recipient routing settings. See ExchangeOnlineManagement module requirements and examples.

Use Get-PSDrive to list the drives available in the session, including those that are not filesystems.

Use Get-PSSession to list the PSSessions in the current session, or those available on a remote computer.

Use Get-Process to get the processes that are running on the local computer.

Use Get-Random to return a random number, or pick random items from a collection.

Use Get-SPOSite to inventory SharePoint Online site collections and check query limits.

Use Get-SPOUser to list users in a SharePoint site collection and check access assumptions.

Use Get-ScheduledTask to list scheduled tasks with their definitions, triggers and current state.

Use Get-ScheduledTaskInfo to return run history for a scheduled task: last run time, last result and next run time.

Command reference for Get-Service: list services, filter by status, and inspect service objects in the pipeline.

Use Get-Team to inventory Microsoft Teams and check account visibility limits. See MicrosoftTeams module requirements and examples.

Use Get-TransportRule to inspect Exchange mail-flow rules, priorities, conditions and modes. See ExchangeOnlineManagement module requirements and examples.

Use Get-Variable to list the variables in the current scope, or retrieve one by name.

Use Get-WinEvent to get events from event logs and event tracing log files on local and remote computers.

Use Group-Object to group objects that share a value for one or more properties, and count each group.

Use Import-Csv to read a CSV file and return one object per row, with the header line becoming property names.

Use Import-Module to load a module into the session so its commands are available.

Use Install-Module to download a module from a registered repository and install it for the current user or all users.

Use Invoke-Command to run a command or script block on one or more remote computers and return the results.

Use Invoke-RestMethod to call a REST endpoint and convert the JSON or XML response into PowerShell objects automatically.

Use Invoke-WebRequest to fetch a URL and return the full response: status code, headers, and the raw or parsed content.

Use Join-Path to combine path segments into one path using the correct separator for the platform.

Use Measure-Object to count objects, or calculate sum, average, minimum and maximum for a numeric property.

Use Move-ADObject to move an Active Directory object to a different organizational unit or container.

Use Move-Item to move a file or directory to a new location, and rename it if you change the leaf name.

Use New-ADComputer to create a computer account in Active Directory before the machine joins the domain.

Use New-ADGroup to create a security or distribution group in Active Directory.

Use New-ADUser to create an Active Directory user account with identity attributes like -Name, -SamAccountName, -UserPrincipalName, and -AccountPassword.

Use New-CimSession to create a reusable CIM session to a remote computer for use with the CIM cmdlets.

Use New-GPO to create a Group Policy object and verify its GUID before linking it. See GroupPolicy module requirements and examples.

Use New-Item to create a new item, such as a file, directory, registry key, or provider-specific object.

Use New-PSSession to open a persistent connection to a remote computer and return a session object.

Use Out-File to write the formatted text representation of objects to a file.

Use Out-Host to send output to the host for display, optionally one screen at a time.

Use Out-String to convert objects into the string form PowerShell would have displayed.

Use Receive-Job to collect the output of a job and, by default, remove it from the job's buffer.

Use Register-ScheduledTask to create a scheduled task from action, trigger, principal and settings objects.

Use Remove-ADGroupMember to remove members from an Active Directory group.

Use Remove-ADUser to delete an Active Directory user account. Confirm the identity first — deletion is immediate and hard to undo.

Use Remove-CimSession to close CIM sessions and release their connections.

Use Remove-Item to delete files, folders, registry keys, or other provider items; -Recurse and -Force clear non-empty trees.

Use Remove-Job to delete a job from the session, discarding any output it still holds.

Use Remove-Module to unload an imported module from the current session — handy when testing a new version of your own module.

Use Remove-PSSession to close a PSSession and release the resources it holds on the remote computer.

Use Remove-Variable to delete a variable and its value from the session; -Force also clears read-only variables.

Use Resolve-DnsName to query DNS for a name or address and return the records, bypassing the local cache when asked.

Use Resolve-Path to turn a relative path or a wildcard into one or more full paths, failing if nothing matches.

Use Restart-Computer to restart the local computer or a remote one by name; -WhatIf shows the target without restarting, and -Wait blocks until a remote Windows endpoint responds again.

Use Restart-Service to stop and then start one or more Windows services.

Use Save-Module to download a module and its dependencies to a folder without installing it.

Use Search-ADAccount to find accounts matching a built-in condition such as locked out, disabled, expired or inactive.

Use Select-Object to keep only chosen properties, take the first N objects, or expand one property into its values.

Use Set-ADComputer to modify attributes on an existing Active Directory computer account.

Use Set-ADUser to modify attributes on an existing Active Directory user account.

Use Set-Acl to apply a security descriptor to a file, folder or registry key.

Use Set-AuthenticodeSignature to sign a script with a code-signing certificate, proving origin and integrity.

Use Set-AzContext to select and verify the Azure subscription and tenant for later commands. See Az module requirements and examples.

Use Set-Content to replace the entire contents of a file with the value you supply.

Use Set-ExecutionPolicy to change the execution policy for a scope, controlling whether script files may run.

Use Set-GPLink to change GPO link order, enforcement and enabled state for a target OU. See GroupPolicy module requirements and examples.

Use Set-Location to change the current working directory, on any drive a provider exposes.

Use Set-NetFirewallRule to change properties of existing Windows Firewall rules.

Use Set-Service to start, stop or suspend a service, and change service properties such as StartupType and DisplayName.

Use Set-Variable to create or change a variable, with control over its scope and options.

Use Sort-Object to order objects by property, ascending by default or -Descending; -Unique drops duplicates.

Use Split-Path to return one part of a path: the parent directory, the file name, the extension, or the qualifier.

Use Start-ADSyncSyncCycle to request a Microsoft Entra Connect Sync cycle after checking scheduler state and the intended server.

Use Start-Job to run a script block in a separate background process and return a job object immediately.

Use Start-Process to launch an executable or open a file with its associated program.

Use Start-ScheduledTask to run a scheduled task immediately, without waiting for its trigger.

Use Start-Service to start a stopped Windows service by name or display name.

Use Start-ThreadJob to run a script block on a thread inside the current process and return a job object.

Use Start-Transcript to begin recording the session, both commands and their output, to a text file.

Use Stop-Job to stop a running job, leaving it in the session so partial output can still be collected.

Use Stop-Process to stop running processes by name or ID; -Force ends processes that ignore a normal stop request.

Use Stop-ScheduledTask to terminate a running instance of a scheduled task.

Use Stop-Service to stop a running Windows service; -Force also stops services that depend on it.

Use Stop-Transcript to end the current transcript and close the file. See Microsoft.PowerShell.Host module requirements and examples.

Use Tee-Object to pass objects along the pipeline while also saving them to a file or a variable.

Use Test-NetConnection to test connectivity to a host, optionally on a specific TCP port, and report the route and DNS resolution.

Use Test-Path to return $true or $false for whether a path exists — the guard to run before reading, writing, or deleting.

Use Trace-Command to trace PowerShell's internal operations while running an expression, showing how it resolved what you asked for.

Use Unlock-ADAccount to clear the lockout on an Active Directory account after too many failed sign-in attempts. Review examples and related commands.

Use Wait-Process to block until one or more processes exit, or until a timeout expires.

Use Where-Object to select objects from a collection based on their property values. See Microsoft.PowerShell.Utility module requirements and examples.

Use Write-Debug to write a developer-facing message to the debug stream, hidden unless -Debug is passed.

Use Write-Error to write a non-terminating error to the error stream without stopping execution.

Use Write-Information to write a tagged message to the information stream, which can be captured separately from output.

Use Write-Output to send objects to the success stream, which is the stream the pipeline carries and a caller can capture.

Use Write-Verbose to write a diagnostic message that stays hidden unless the caller asks for it with -Verbose.

Use Write-Warning to write a message to the warning stream, shown by default but kept out of your data.

Query users, groups and computers with Get-ADUser and Get-ADGroup, then avoid broad searches by choosing a search base and requested properties.

Connect with Connect-AzAccount, inspect subscriptions with Get-AzSubscription and set the intended tenant and subscription context before Azure changes.

Inspect Azure VMs with Get-AzVM, read power state explicitly and manage disks or scale sets without confusing configuration with live status.

Find vaults with Get-AzKeyVault, retrieve secrets deliberately and distinguish control-plane access from permission to read secret values.

Inspect Azure virtual networks, subnets, NSGs and public IPs with Az.Network while keeping resource group, region and object IDs explicit.

Inventory Azure resources with Get-AzResource and Get-AzResourceGroup, then scope changes carefully by subscription, resource group, type and tag.

Work with Azure storage accounts and data services, keeping management-plane resources separate from blob, file, queue and table operations.

Inspect DHCP scopes, leases, reservations and options with Get-DhcpServerv4Scope before changing address pools or client configuration.

Query DNS zones and records with Get-DnsServerZone and Get-DnsServerResourceRecord before changing forwarders, aging or scavenging.

Connect with Connect-ExchangeOnline and query mailboxes with Get-EXOMailbox while requesting only the properties your report actually needs.

Find Group Policy objects with Get-GPO and export evidence with Get-GPOReport before changing links, inheritance or enforcement.

Inspect VMs with Get-VM, review checkpoints and virtual switches, and distinguish configured state from replication and runtime health.

Connect to Microsoft Graph with explicit scopes, inspect the active context and query only the users, groups or devices your automation needs.

Connect to the SharePoint Online admin service, inventory sites with Get-SPOSite and verify tenant permissions before changing site settings.

Read Windows event and diagnostic data with Get-WinEvent and related cmdlets while filtering at the provider instead of after retrieval.

Use core management cmdlets for services, processes, files and computers, and verify object types before filtering or formatting output.

Discover and install modules with Find-PSResource and Install-PSResource, checking repository trust, version constraints and command-name changes.

Inspect execution policy, signatures and secure strings with security cmdlets while treating execution policy as a safety feature, not a boundary.

Record console sessions with transcripts and interact with the host using Read-Host, Start-Transcript, and Stop-Transcript.

Transform, measure, sort and export objects with Utility cmdlets while keeping formatting commands at the end of the pipeline.

Connect to Microsoft Teams, inspect teams and policies, and account for role permissions and eventual consistency before judging a change unsuccessful.

Inspect Windows Firewall profiles and rules with Get-NetFirewallProfile and Get-NetFirewallRule before changing direction, scope or enforcement.

Diagnose addresses, routes and TCP connections with Get-NetIPAddress, Get-NetRoute and Get-NetTCPConnection using the correct interface context.

Configure command history, prediction, completion and key handlers with PSReadLine while checking host support and avoiding shared-history surprises.

Run Invoke-ScriptAnalyzer with explicit rules and settings, separate style findings from correctness issues and suppress rules only with a reason.

Write repeatable PowerShell tests with Describe, It and Should, then isolate dependencies with mocks that target the command actually called.

Inspect task definitions, triggers and principals with Get-ScheduledTask, then verify execution history instead of assuming registration means success.

Inspect physical disks, partitions, volumes and Storage Spaces with Get-Disk and Get-Volume before any destructive initialization or formatting step.

Get-VMReplication returns the replication configuration for each participating guest, and the projection keeps the VM name with State, Health, and LastReplicationTime.

Read the PowerShell ScriptBlockLogging policy registry key with Get-ItemProperty and interpret missing settings before drawing conclusions.

Get-NetFirewallProfile returns one object per profile, and Select-Object reports the profile name with Enabled plus the two default action fields.

Get-NetFirewallRule is constrained by three parameters at once, returning rules that are enabled, inbound, and set to block.

A single Get-ADUser call requests Enabled, MemberOf and LastLogonDate for the account named in $Sam.

An array holds the four group names worth watching, and the loop calls Get-ADGroupMember with -Recursive on each so nested membership is flattened into leaf members.

Get-ADUser requests the delegation-related properties explicitly because they are not returned by default.

Import-Csv reads the file into objects with one property per column, and ForEach-Object calls Add-ADGroupMember once per row.

Get-Item runs with -EA Stop, which promotes its non-terminating error into a terminating one so control transfers into the catch block.

Get-ADReplicationPartnerMetadata with -Target * and -Scope Domain collects the metadata each controller keeps about its replication partners.

Get-MpComputerStatus returns the live state of the Defender engine as a single object.

Get-ChildItem recurses through $Path with a -Filter of *.cer and reports each match with its full path, last write time, and size.

Inspect a Windows pending reboot indicator with PowerShell. Review the specific check and its limits before using it in a wider maintenance workflow.

Collect CPU model, RAM in GiB, and BIOS version with Get-CimInstance, then combine the results into one PowerShell object.

Get-HotFix wraps the Win32_QuickFixEngineering class and returns one row per servicing update.

Query recent System errors with a server-side Get-WinEvent filter. Inspect the event time, ID and provider to focus the investigation.

The loop asks each server in $DnsServers to resolve $Name and stamps the responding server onto every record with a calculated property.

Get-FileHash reads each file using SHA256. LiteralPath treats brackets in filenames literally.

Both sides get enumerated with Get-ChildItem into a projection of FullName, Length, and LastWriteTime, and Compare-Object is told to compare on exactly those three properties.

Inventory Exchange Online inbound and outbound connectors, including enabled state, connector type, and outbound recipient domains.

Select-Object accepts a hashtable with an n key naming the new column and an e key holding a script block that computes its value.

The [pscustomobject] cast applied to a hashtable literal produces one object whose properties are the hashtable keys, in the order they were written.

Get-DistributionGroup with -ResultSize Unlimited enumerates every distribution and mail-enabled security group, and the projection keeps just the display name and primary SMTP address.

The outer enumeration returns every distribution group, and for each one Get-DistributionGroupMember lists its members with its own unlimited result size.

Get-Process emits its objects and Get-Member consumes them, reporting the type name once and then every property, method, and property set that type exposes.

List configured IPv4 DNS servers with Get-DnsClientServerAddress. Pair each interface with its resolver addresses and exclude empty lists.

Get-NetIPAddress limited to -AddressFamily IPv4 returns every address bound to every interface.

Export Active Directory OUs to CSV with their names, distinguished names, and accidental-deletion protection settings.

Review a PowerShell example for exporting recent Microsoft Entra sign-ins. Check access requirements and adapt the query to your reporting task.

Inspect Azure resource tags with Get-AzResource and identify resources missing required keys before planning any changes.

Get-MpPreference returns the local Defender configuration, and the projection pulls the three exclusion collections covering file paths, process images, and extensions.

Get-VM feeds each guest into Get-VMSnapshot, which returns the checkpoints belonging to that machine.

Query Win32_DiskDrive for USB storage devices. Report model, device ID, size in bytes, and available serial numbers with PowerShell.

Every user object is retrieved, then Where-Object keeps the ones whose DistinguishedName fails to match a regular expression describing the approved containers.

git diff with --name-only prints paths instead of patch content, and the pathspec arguments after the double dash restrict output to ps1 and psm1 files.

The -Filter argument hands accountEnabled eq false to Graph as an OData expression so the service performs the selection.

Use Get-NetAdapter to list interfaces whose status is not Up. Include the interface name, status, and driver description for investigation.

Query Active Directory servicePrincipalName values, expand the collections, and group repeated SPNs to investigate duplicate registrations.

Every user is retrieved with the mail attribute, accounts holding no address are dropped, Group-Object buckets the remainder by address, and only buckets with more than one member survive.

Find empty folders with Get-ChildItem and Where-Object. Count hidden and system entries when deciding whether a directory is empty.

Get-ADGroup returns security groups, then ForEach-Object tests each by calling Get-ADGroupMember against it.

Enabled users are retrieved with the mail attribute requested explicitly, and the intent of the middle stage is to keep only accounts where mail holds nothing.

Group established TCP connections by remote address, then sort by count to find the endpoints with the most concurrent connections.

Find local-machine certificates with an expiry before a 30-day cutoff. Report subject, thumbprint, expiry, and private-key availability.

Every mailbox is enumerated, and for each one Get-InboxRule is called against its primary SMTP address with errors suppressed so mailboxes that cannot be reached are skipped quietly.

Get-ScheduledTask enumerates every registered task, and piping it into Get-ScheduledTaskInfo attaches the runtime history to each.

A userType eq 'Guest' filter is evaluated by Graph, with the literal in single quotes because OData string comparisons require them.

Get-Process emits one process object per running executable, Sort-Object orders them by the CPU property in descending order, and -First 15 trims the tail.

The pipeline sorts Get-Process output on WorkingSet64, the resident set in bytes as reported by the 64-bit counter, then keeps the top fifteen.

A cutoff is calculated ninety days back, then Get-ADUser retrieves enabled accounts and asks for LastLogonDate explicitly because that property is outside the default property set.

Get-NetTCPConnection with -State Listen returns only sockets sitting in the listening state rather than the full connection table.

Search-ADAccount -LockedOut asks the directory for accounts currently in a locked state, so the selection happens server-side with no client filtering involved.

Query fixed local disks with Get-CimInstance and Win32_LogicalDisk, calculate free space, and identify volumes below the script's threshold.

Get-EXOMailbox runs with -PropertySets All so the forwarding attributes come back, since they sit outside the minimal default set this cmdlet returns.

Find VMware snapshots older than seven days with Get-Snapshot. Report the VM, snapshot name, creation date, and size in GB.

Get-ChildItem walks the current user's temp directory recursively for files only, with -EA SilentlyContinue swallowing the access denials that a deep walk inevitably hits.

Query Win32_Process with Get-CimInstance to inspect executable paths outside C:\Windows, alongside process names and IDs.

Find enabled AD computer accounts with a recorded LastLogonDate older than 120 days. Review the evidence before treating an account as unused.

Filter Azure VM status data for stopped and deallocated machines. Keep the resource group and power state so the two conditions remain distinct.

Use Get-Service and Where-Object to find automatic-start services that are not running. Return service names and display names for investigation.

Get-AzDisk enumerates the managed disks in the subscription and Where-Object keeps those whose DiskState reads Unattached.

Get-ADUser filters server-side on PasswordNeverExpires being true and requests the same attribute so the value returns with each object.

Enabled accounts come back with the Department attribute requested, the middle stage keeps the ones where it is empty, and the output is narrowed to the account name.

The query pulls enabled users with the Manager attribute requested, filters down to accounts where that attribute is unpopulated, and reports the account name.

Create an HTML report of domain Group Policy settings with Get-GPOReport -All, including configured settings rather than only GPO names.

Combine server health measurements into a structured PowerShell object that can be inspected, filtered or exported.

Query Win32_OperatingSystem on each computer and calculate uptime from LastBootUpTime. Check unreachable hosts before using the report.

A WQL filter restricts Win32_Process to the two PowerShell image names so the selection happens inside the CIM provider rather than in the pipeline.

Get-AzVM with -Status queries each machine's instance view in addition to its model, and that is what populates the PowerState property.

Get-AzResourceGroup returns every group in the subscription the context points at, and the projection keeps the group name with its location and provisioning state.

Get-AzSubscription lists the subscriptions the signed-in identity can see in the current tenant, and the projection keeps name, ID, tenant ID and State.

Inventory Entra ID groups with Microsoft Graph PowerShell, selecting the group properties needed for a directory report.

Get-MgUser with -All pages through the whole directory instead of stopping at the first page, and -Property maps to the underlying $select so only the four requested properties come back.

Get-GPO -All enumerates every policy object in the domain and the projection keeps the display name with its GUID and both timestamps.

List Hyper-V guests with Get-VM and report state, CPU usage, assigned memory in bytes, and status for each virtual machine.

Get-VM against a connected vCenter returns the guests, and the projection keeps the name with PowerState, NumCpu, MemoryGB, and the VMHost the guest is running on.

One Get-CimInstance call against Win32_OperatingSystem returns a single instance per machine.

Get-ItemProperty reads the uninstall hives directly, covering both the native path and Wow6432Node so 32-bit packages on a 64-bit host are included.

Inventory network interfaces with Get-NetAdapter. Report status, link speed, MAC address, and driver description beside each interface name.

List tenant service principals with Microsoft Graph PowerShell. Review application identities and the properties returned by the inventory.

Query Security event ID 4740 from the last eight hours. Inspect the timestamp, logging computer, and message for account-lockout evidence.

Get-EXOMailbox with -ResultSize Unlimited pages through all recipients rather than stopping at the default first thousand.

Inspect a mailbox’s access rights and inherited permissions with Get-EXOMailboxPermission before preparing a permissions report.

Use Get-EXOMailboxStatistics to report mailbox item counts and total sizes, then sort the results to inspect the largest mailboxes first.

Established connections come back from Get-NetTCPConnection, and ForEach-Object builds a fresh [pscustomobject] per row carrying the local port with the owning process name.

The loop sends four ICMP probes per target with Test-Connection and pipes the replies into Measure-Object, which computes the average, minimum, and maximum response time.

Report Azure role assignments with Get-AzRoleAssignment, including principal identity, role, scope, and object type in the active context.

Find all five FSMO role holders with Get-ADForest and Get-ADDomain. Read the forest-wide and domain-specific role properties separately.

Get-MgUser -All requests AssignedLicenses alongside the display name.

List AD domain controllers with their sites, IPv4 addresses, operating systems, and global-catalog status using Get-ADDomainController.

Get-LocalGroupMember resolves the group membership and returns each principal with two useful qualifiers.

The task inventory is read first, then each configured principal is translated to a SID.

Retry Invoke-Command up to three times with increasing delays. Use terminating error handling and rethrow the final failure.

Filtering Get-NetRoute to the destination prefix 0.0.0.0/0 returns only the default routes.

Check PowerShell script signatures without executing the files. Identify unsigned scripts and review their signature status.

Scan scripts and modules recursively with Invoke-ScriptAnalyzer, then export rule names, severity, and line numbers to CSV for review.

Invoke-Pester executes the test files under the tests directory with normal console output, and -PassThru returns the run object instead of only printing to the console.

Inventory SharePoint Online site collections with Get-SPOSite -Limit All and inspect the returned site properties.

Passing -RecipientTypeDetails SharedMailbox to Get-EXOMailbox filters at the service rather than in the pipeline, and -ResultSize Unlimited keeps the full result set.

Query AD computer operating systems, group matching values, and sort by count to report how many machine accounts use each OS.

The FilterHashtable pins the Security channel and event ID 4625 with a start time one day back, so the log service performs the selection rather than the pipeline.

Use Get-Team to report team names, Microsoft 365 group IDs, visibility, and archived status in a PowerShell inventory.

The loop walks $Computers and calls Test-NetConnection against each with the port held in $Port, capturing the result object.

The script asks each configured IPv4 DNS server directly. That removes the local resolver cache and server-selection ambiguity from the comparison.

Get-TransportRule returns every rule in the organization and the projection keeps the name with State, Mode, Priority, and Description.

A hashtable holds parameter names as keys with their values attached, then @params in place of the individual parameters hands the whole set to Get-CimInstance.

Get-ChildItem finds every psd1 file under the current directory and ForEach-Object runs Test-ModuleManifest against each full path.

Check a backup folder for files written since an expected timestamp. Report the twenty newest matching names, sizes, and write times.

Each line is a complete JSON object with an ISO-8601 UTC timestamp and one correlation ID.

A [pscustomobject] literal captures the timestamp and host name along with the action, status, and message supplied by the caller.

AD query is unexpectedly slow: a wildcard -Filter pulls every object across the wire before Where-Object filters client-side, so cost tracks directory size, not answer size.

Authenticode signature status changes to HashMismatch: the file bytes changed after the file was signed.

CIM works locally but not remotely: adding -ComputerName switches the transport to WS-Management on port 5985, which needs the remoting infrastructure in place.

Certificate is installed but the application rejects it: applications check far more than validity - trust chain, key usage, and the binding the application actually reads.

Command works on one host but not another: hosts drift over time - different PowerShell versions, module versions, or module paths.

Connect-AzAccount succeeds but Get-AzResource returns the wrong subscription: Az PowerShell maintains a current context that may still point at a different subscription.

Copied files have different SHA256 hashes: hashing compares raw bytes, so any changed byte - line endings, metadata - changes the hash.

DNS resolves but the application is unreachable: resolution and reachability are independent - a correct record proves only that the record exists.

Export-Csv output looks wrong: Format-Table replaces real objects with formatting instructions, which Export-Csv then faithfully serializes instead of the data.

GPO processing is slow: policy processing is a sequence of directory lookups and SYSVOL file reads, inheriting every DNS and domain-controller location delay.

Get-ADUser is not recognized: the AD cmdlets live in the ActiveDirectory module, which ships with the RSAT feature - not with PowerShell itself.

Locked user account keeps locking: lockout counters accumulate failures from every source - a stale cached password on a service, scheduled task, or phone mail.

Module imports but command is missing: the manifest's FunctionsToExport controls what gets exported, so the command may be excluded deliberately or by accident.

Null-valued expression: a cmdlet that finds nothing returns nothing rather than raising an error, so the next line operates on $null and fails only when reaching inside it.

Parallel script is slower than serial: every runspace pays startup and module-import costs that exceed the savings for small units of work.

Parameter binding fails: PowerShell resolves parameter sets before executing, so a combination spanning two mutually exclusive sets is unresolvable.

PowerShell JSON log contains truncated nested data: ConvertTo-Json limits serialization depth, so deeper nested properties are dropped.

PowerShell job completes but no result is visible: job output is buffered on the job object until Receive-Job collects it - it never reaches the console on its own.

REST call returns certificate or TLS errors: the .NET stack validates the chain, hostname, and expiry before any request leaves; Windows PowerShell 5.1.

Remote file share access fails from a remoting session: credentials cannot forward to a second hop by default - the remote session holds a network logon token with no reusable secret.

Resolve-DnsName works against one DNS server only: the DNS servers do not currently hold equivalent data.

Scheduled task returns 0x8007052E: Windows rejected the supplied logon credentials.

Scheduled task works interactively but fails when scheduled: a task runs under its configured identity, so mapped drives, stored credentials, and profile.

Script execution is blocked: execution policy is a per-scope setting - the effective value is the first one set in a fixed precedence order that puts machine policy above user choice.

Service is running but the application is down: the service control manager tracks whether a process started, not whether the code inside is doing anything.

Fix PowerShell WinRM remoting failures with checks for connectivity, configuration and access. Trace the connection error and verify the result before retrying.

Check the calling identity, elevation and resource permissions when a PowerShell operation returns access denied.

Check argument types, parameter sets and pipeline input when PowerShell cannot bind a parameter.

Investigate CIM class names, namespaces, permissions and connectivity when Get-CimInstance fails.

Check spelling, command discovery and required modules when PowerShell says a command is not recognized.

Check file locks, directories, free space and storage connectivity when a PowerShell file operation fails.

Inspect the original response and JSON structure when ConvertFrom-Json cannot parse its input.

Inspect module prerequisites, manifest settings and dependencies when Import-Module cannot load a module.

Check module installation, name and PSModulePath when PowerShell cannot find the requested module.

Check lookup results and object properties before accessing a member that may be missing or null.

Inspect object state, method requirements and collection changes when PowerShell reports an invalid operation.

Find incorrect paths, unexpected working directories and wildcard interpretation when PowerShell cannot locate an item.

Check the remoting transport, target address, authentication and endpoint when a PowerShell remote connection fails.

Check execution-policy scopes, script signatures and downloaded-file marks when a PowerShell script is blocked.

Find mismatched quotes, brackets and incomplete expressions when a PowerShell script fails to parse.

Separate HTTP status errors from DNS, proxy, TLS and timeout failures when a PowerShell web request fails.

Capstone assessment for the PowerShell Functions lesson: six checks — predict output, diagnose an output bug, judge pipeline statements, choose the fix, verify with Pester.

Test how do you get the smallest three processes by memory in PowerShell. Compare the choices and understand why the answer is correct.

Test what does Get-Member tell you in PowerShell. Compare the choices and understand why the answer is correct.

Test what does a matching SHA256 file hash establish in PowerShell. Compare the choices and understand why the answer is correct.

Test your understanding of Just Enough Administration in PowerShell. Compare answer choices and review the explanation of how JEA limits operator capabilities.

Test your understanding of Pester, the PowerShell testing framework. Compare the answer choices and read the explanation to see why the correct option fits.

Test what is ValueFromPipelineByPropertyName in PowerShell. Compare the choices and understand why the answer is correct.

Test when should you measure performance in PowerShell. Compare the choices and understand why the answer is correct.

Test why you should avoid hard-coded passwords in PowerShell. Compare the choices and understand why the answer is correct.

Test why can catch miss an error in PowerShell. Compare the choices and understand why the answer is correct.

Test why should formatting usually be late in a pipeline in PowerShell. Compare the choices and understand why the answer is correct.

Test why use PSCustomObject in reports in PowerShell. Compare the choices and understand why the answer is correct.

Test why use server-side AD filtering in PowerShell. Compare the choices and understand why the answer is correct.

Check command resolution, installed modules, PSModulePath, PowerShell edition, architecture and import errors.

Explain object pipelines, discover properties with Get-Member, and keep structured data intact until export or display.

Double-quoted strings expand variables and subexpressions; single-quoted strings are literal except for the escape rules needed to represent a quote.

Start from module and platform compatibility, authentication requirements, remoting behavior and support policy.

Log decisions, targets, start/end times, correlation identifiers, errors and verification results.

Use Get-Command with Verb, Noun, Module or wildcard filters, then inspect Get-Help examples and syntax before running anything that changes state.

Keep Azure and Microsoft Graph automation in the intended tenant: set context explicitly, check permissions, and isolate concurrent operations.

Speed up PowerShell pipelines by measuring queries, filtering at the source, reducing remote calls, and comparing results with a known baseline.

Design scripts that compare current and desired state, change only what differs, and report repeatable administrative outcomes.

Use the organization's approved secret store or workload identity, request the narrowest scope, keep secrets out of source and logs, and rotate secrets on a schedule.

Write structured objects to the success stream and keep display formatting outside the function.

Check AD replication partners, DNS, time, and affected naming contexts before making directory changes. Verify recovery across domain controllers.

Plan bulk PowerShell changes with target previews, ShouldProcess, checkpoints, partial-failure handling, and independent result verification.

Design cross-tenant PowerShell automation with separate identities, explicit context, bounded concurrency, and retries that avoid duplicate changes.

Use SupportsShouldProcess on an advanced function and call $PSCmdlet.ShouldProcess around the state-changing operation.

First prove the first remote connection works, then identify whether the remote session must authenticate to a second resource.

Govern shared PowerShell automation with controlled modules, review rules, CI checks, consistent logging, and separate privileged runbooks.

Structure a maintainable PowerShell module with a manifest, deliberate exports, stable object output, tests and versioned releases.

Work through WinRM connectivity, listeners, authentication and endpoint authorization without weakening security defaults.

Diagnose slow AD queries by measuring scope, server-side filters, returned properties, connectivity and repeated lookups.

Use JEA endpoints and role capabilities to limit administrative commands. Choose the execution identity, audit sessions, and test denied operations.

Imported CSV values begin as strings, headers become property names, and Export-Csv should receive objects before formatting.

$_ is the current pipeline object inside contexts such as Where-Object and ForEach-Object.

Explain PowerShell splatting, named parameter hashtables, conditional options and the difference between $params and @params.

A terminating error stops the current operation and can be caught directly.

Capture run identity, version, inputs or safe hashes, targets, timing, decisions, errors, retries and verification results with a correlation ID.

Plan Pester coverage for logic, parameter contracts, errors, and real integrations. Learn where mocks help and where acceptance checks are needed.

Evaluate PowerShell against the workload: runtime availability, desired-state management, orchestration and application requirements.

Use LiteralPath when the path must be interpreted exactly, especially when names contain wildcard characters such as brackets.

Choose Select-Object for reusable data and Format-Table for display. Understand why formatting before Export-Csv causes problems.

Aliases are convenient interactively, but shared scripts should favor full command and parameter names so intent survives code review, different profiles and hosts.

The task may run under a different identity, engine, working directory, profile, environment, network context or permission scope.

Learn why catch can miss a PowerShell error, how ErrorAction Stop changes cmdlet behavior, and where finally belongs.

Execution policy is a safety feature that controls script-loading behavior and trust signals.

Learn PowerShell with object and pipeline lessons, command examples, admin scripts, and browser exercises using sample data.