Live Cyber Attack Lab 🎯 Watch our IR team detect & respond to a rogue insider trying to steal data! Choose a Session


Windows PowerShell Tutorial For Beginners

Data Security, PowerShell

PowerShell Tutorial: What is it?

Windows PowerShell is an interactive object-oriented command environment developed by Microsoft to automate tasks and simplify configuration. It’s used to automate almost any area of the Windows ecosystem, including Active Directory and Exchange. After reading this post, you’ll understand why it’s become so popular amongst perpetually overworked sysadmins and other IT pros. We’ll teach you how to use cmdlets, go through a few task-based PowerShell examples and share a few resources that can help you jumpstart your PowerShell training.

So, let’s get started.

Launching PowerShell (and Run as Administrator)

In Windows 10, the search field is one of the fastest way to launch PowerShell. From the taskbar, in the search text field, type powershell. Then, click or tap the ‘Windows PowerShell’ result.

To run PowerShell as administrator, right-click (touchscreen users: tap and hold) on the Windows PowerShell search result, then click or tap ‘Run as administrator’.

Keep in mind, there are many other ways to start a PowerShell console.

PowerShell Cmdlets

As an IT pro, many command lines you’re familiar with also work in PowerShell.

Try typing: DIR, CD, IPCONFIG, and PING.

If you look closer, they do work slightly different in PowerShell, but for now, typical commands work exactly the same way as they have always worked.

By the way, PowerShell is fundamentally case insensitive. There are instances when you’ll need to pay attention to how you type them, like with Active Directory Services Interface.

What are cmdlets

Cmdlets are PowerShell commands and organized in the form of a verb-noun string. Once you understand this template, you can practically guess the meaning of any cmdlet.

Guess and then type these cmdlets:

  • Get-Command (outputs a list of all available cmdlets)
  • Get-Help (shows help information about cmdlets)
  • Get-EventLog (displays Windows event logs)
  • Get-Acl (retrieves access control lists (ACLs)

Knowing what commands you can use is great, but it doesn’t help if you don’t know how you can use them.

How to use a cmdlet

To see how to use a cmdlet, enter the cmdlet name followed by ”-?“.



Click here for a full list of approved verbs for Windows PowerShell Commands.


Aliases in PowerShell are just an alternate name for the underlying cmdlet. There are two reasons for aliases. One is that they allow for more concise code on Command Prompt. Second is that they ease a user’s transition from other shells to PowerShell.

Here’s an example: dir is an alias for the get-childitem cmdlet.
To prove that the cmdlet defined in PowerShell for dir is indeed get-childitem, try this:

get-alias dir

And to go the other direction and discover all the aliases defined for the get-childitem cmdlet:

    get-alias –definition get-childitem


Nice! PowersShell gives Linux users a break by setting up an alias for ls.

Also set-alias allows you to map a new alias to a cmdlet. For instance, list can be an alias for get-childitem, if you type:

set-alias list get-childitem


The screenshot shows that if you type list or get-childitem, you get the same result! Magic!

Practical Cmdlets

In this next tutorial, you’ll learn three very useful cmdlets: get-command, get-help, and get-member. This foundational language will eventually empower us execute task-based cmdlets.


get-command outputs all commands available to you in your current session.

Try it! Type: get-command


But other than that, using the get-command by itself isn’t particularly helpful. You’re most likely going to use get-command to find commands you’ll want to work with.

For instance, if you want to find all the commands that begin with the letter “s”, type:
get-command s*commands that start with s

In our last post, we mentioned that PowerShell cmdlet names are based on “verb-noun” template. So to see all cmdlets that use the verb get, type:
get-command -verb get

Get-Command -Verb Get

I got excited about this function and tried a few more commands. Join me for some fun?  To see all the things you can start, type:
get-command -verb start


And to see all the things you can stop, type:
get-command -verb stop


Let’s do the same thing with noun!  It’s very helpful because it outputs a set of commands that affect the same type of object. For example, if you want to see which commands are available for managing services, type:
get-command -noun service

noun service


Let’s face it, we all need a little help sometimes. For a list of all available help topics, type:
get-help *


Once you have this list, you can then get help on a specific cmdlet. Try this:
get-help get-service

gethelp getservice

Remember our last lesson? You can display the same output if you type -? after the cmdlet. See for yourself! Type:
get-service -?


And now for my favorite part! If you ever need an example to see how to use a cmdlet, type:
get-help get-service – examples

get service examples

While my screenshot displays five, there are a total of eleven get-service examples.


get-member pulls more information about an object. To see what the get-member can do, type: get-help get-member -examples


While my screenshot displays five, there are a total of seven get-member examples.

In the examples, you’ll notice that you’ll often need to use get-member with a pipeline. Pipelines act like a series of connected segments of pipe. Items moving along the pipeline pass through each segment. To create a pipeline in PowerShell, you connect commands together with the pipe operator “|”. The output of each command is used as input to the next command.

Let’s go over an example. If you want to know which properties and methods are available for event logs, you’d type:
get-eventlog -list | get-member

get member event log

get-eventlog cmdlet enables you to manage your event logs, and enables you to get at the events contained within those event logs.

-list is a parameter.

Simple Task-Based PowerShell Examples

After the novelty of learning something new wears off – unless you can connect the subject to your work – it’s often hard to want to continue practicing.

So, let me introduce you to a few practical, task-based PowerShell examples.

What’s the date?



Simple, right?

But what if you just wanted day of the year, week, hour of day, or today’s date?







The results tell me that today is the 320th day of the year, Monday, a little after 12pm, and is November 16th.   With all this power, who needs to look at their iPhone?

You’ve just been told you have 16 days to complete a project. What date is that?

Try this: (get-date).adddays(16)

Alternatively, we can get the same results by creating a variable:

$a = Get-Date

Then type:

"Month: " + $a.Dayofyear

"Day of the Week: " + $a.Dayofweek

"Hour: " + $a.Hour

“Day:” + $


Here’s a table to summarize some of the PowerShell punctuation we’ve used:

Symbol Name Function Example
$ Dollar Sign Declares a variable $a
= Equal Assigns a value to the variable $a=get-date
“” Double Quote Use double quotes to display text If $a = Monday

“Day of the Week: $a”
will output as:

Day of the Week: Monday

+ Plus Concatenates $a = November

“Day of the Week: ”
+ $a.Dayofweek

Day of the Week: Monday

( ) Parenthesis Groups to create argument  (get-date).day

To get more date and time properties, we can use a cmdlet from our previous lesson:

get-date  | get-member

get date get member

Force Stop a Service

When you have a Windows service running that will not respond to stop commands, you can use PowerShell. For instance, suppose my Lync freezes and  Lync’s process ID is 9212, then this command will stop it in its tracks:

stop-process 9212


stop-process –processname lync

(And I check. Yep, my lync closed)

To get a full list of processes running, type:


In the last line, you can see that Lync corresponds with the process ID 9212.

Check if a File Exists

Suppose you need to delete multiple files, you might want to first check to see if the files even exist.

test-path, as the name implies, lets you verify whether elements of the path exist. It’ll return TRUE, if all elements exist, and FALSE if any are missing.

You simply type:

test-Path (And then the file path)

I wanted to see if the article I wrote on SIEM vs. UBA exists. So I typed the file path:

test-path C:\users\cng\filesforDN\Blogs\SIEMandUBA.docx


True! It’s exists!

PowerShell Recap

In this post, we’ve learned what a cmdlet is, how to use a cmdlet (enter the cmdlet name followed by ” -?“), and practical task-based examples.

You’ve been a witness to why PowerShell has been so helpful and we hope we’ve inspired you to want to learn more.

PowerShell Resources

Below are the latest tutorials—hmm, maybe that’s a task for PowerShell as well–and I’ve culled them down to a top ten:

Getting Started with PowerShell

  1. PowerShell for Beginners – A library of links to get started, best practices, command line syntax and more!
  2. Don Jones’ bestselling PowerShell book, Learn Windows PowerShell in a Month of Lunches is also in video! After 3-4 months of lunches with the tutorial video series, you’ll be automating admin tasks faster than you ever thought possible. By the way, the author answers questions at There are numerous PowerShell resources, events, and even free ebooks!
  3. If you’re taking the MCSA 70-410 Microsoft Exam, these flashcards will help: PowerShell commands.
  4. PowerShell allows you to string multiple commands together on one line using a technique called pipelining. It makes complex things much simpler, and you can learn about it here.

Configure and Manage Active Directory

Save even more time by learning how to configure and manage Active Directory using PowerShell with these resources:

  1. Use PowerShell to Search AD for High-Privileged Accounts.
  2. Use AD module cmdlets to perform various administrative, configuration, and diagnostic tasks in your AD DS and AD LDS environments.
  3. Build an AD utility from scratch in this epic 3 hour PowerShell video course (unlock for free with code:

Automate Exchange

With all that free time you have, why not learn how to automate Exchange with these resources:

  1. An excellent video on Managing Exchange Online Using PowerShell
  2. If you’re an Exchange Admin, make sure you have these 5 skills down
  3. Click here for more PowerShell tips for Exchange Admins. Then scroll down for the good stuff.
Cindy Ng

Cindy Ng

Cindy is the host of the Inside Out Security podcast.


Does your cybersecurity start at the heart?

Get a highly customized data risk assessment run by engineers who are obsessed with data security.