PowerShell for Beginners: Commands Every Windows User Should Know

Most Windows problems that take ten clicks in the GUI take one line in PowerShell. Unlike cmd.exe, which passes plain text between programs, PowerShell passes full .NET objects through the pipeline. That one design choice makes filtering, sorting, and exporting data far easier. This guide covers the commands that matter most, with exact syntax, flag explanations, and recovery routines for real problems.

Quick Takeaways

• Verb-Noun syntax (Get-Process, Stop-Service) makes commands predictable and discoverable.
• Get-Help, Get-Command, and Get-Member teach you everything else. Learn these first.
• The pipeline (|) passes objects, not text, so you filter by property instead of parsing strings.
• Run PowerShell as Administrator for services, registry edits, and system-wide changes.

Prerequisites: Know Your PowerShell Version

Windows ships with Windows PowerShell 5.1 (powershell.exe). The newer cross-platform PowerShell 7.x (pwsh.exe) installs side by side. Both run the commands in this guide.

Check your version:

$PSVersionTable.PSVersion

$PSVersionTable is a built-in automatic variable holding version and edition data. To install PowerShell 7 via winget:

winget install --id Microsoft.PowerShell --source winget

Windows PowerShell 5.1 vs. PowerShell 7

Open PowerShell as Administrator

Press Win + X and choose Terminal (Admin). Or run this from a normal session:

Start-Process powershell -Verb RunAs

-Verb RunAs triggers the UAC elevation prompt.

Understanding the Verb-Noun Model

Every cmdlet follows Verb-Noun. Common verbs: Get, Set, New, Remove, Start, Stop, Restart, Test. Once you know Get-Service, you can guess Stop-Service exists.

The Three Discovery Commands

1. Get-Command finds cmdlets by name or noun:

Get-Command -Noun Service
Get-Command *network*

2. Get-Help shows syntax and examples:

Update-Help
Get-Help Get-Process -Examples
Get-Help Get-Process -Online

Update-Help downloads current help files (requires Administrator). -Examples prints only usage samples. -Online opens the current docs in your browser.

3. Get-Member reveals an object’s properties and methods:

Get-Process | Get-Member

This is the key to the object pipeline. You see exactly which properties (CPU, WorkingSet, Id) you can filter on.

File System Navigation and Management

PowerShell treats drives, folders, and even the registry as navigable providers.

Core Navigation Commands

Set-Location C:\Users\$env:USERNAME\Documents
Get-ChildItem -Recurse -Filter *.log

-Recurse descends into subfolders. -Filter applies the match at the file system level, which is faster than piping to Where-Object.

Create, Copy, and Delete

New-Item -Path C:\Temp\Reports -ItemType Directory
New-Item -Path C:\Temp\Reports\notes.txt -ItemType File
Copy-Item C:\Temp\Reports\notes.txt D:\Backup\ -Force
Remove-Item C:\Temp\OldData -Recurse -WhatIf

-ItemType sets file or directory. -Force overwrites existing items. -WhatIf simulates the action without executing it. Always append -WhatIf before destructive deletes, then remove it once the output looks right.

Find the Largest Files on a Drive

Get-ChildItem C:\ -Recurse -File -ErrorAction SilentlyContinue |
  Sort-Object Length -Descending |
  Select-Object -First 10 FullName, @{n='SizeGB';e={[math]::Round($_.Length/1GB,2)}}

-File excludes folders. -ErrorAction SilentlyContinue hides access-denied errors. Select-Object with a calculated property converts bytes to gigabytes.

Read and Search File Contents

Get-Content C:\Windows\Logs\CBS\CBS.log -Tail 50
Get-Content C:\inetpub\logs\app.log -Wait
Select-String -Path C:\Logs\*.log -Pattern "ERROR" -CaseSensitive

-Tail 50 shows the last 50 lines. -Wait streams new lines live, like tail -f on Linux. Select-String is the PowerShell equivalent of grep.

Process Management

List and Filter Processes

Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 Name, Id, CPU
Get-Process -Name chrome

Stop a Frozen Application

Stop-Process -Name notepad -Force
Stop-Process -Id 4812 -Confirm

-Force terminates without waiting for a graceful exit. -Confirm prompts before acting. Prefer -Id when several processes share a name.

Start a Process

Start-Process notepad.exe
Start-Process powershell -Verb RunAs -ArgumentList "-NoProfile"

Service Management

Services are the Windows equivalent of Linux daemons managed by systemd. Most service commands need Administrator rights.

Get-Service | Where-Object Status -eq 'Running'
Get-Service -Name Spooler
Restart-Service -Name Spooler -Force
Set-Service -Name wuauserv -StartupType Disabled

Where-Object Status -eq 'Running' uses simplified syntax to filter by property. -StartupType accepts Automatic, Manual, or Disabled.

Services vs. Processes

Networking Commands

Get-NetIPConfiguration
Test-Connection google.com -Count 4
Test-NetConnection -ComputerName example.com -Port 443
Resolve-DnsName example.com
Get-NetTCPConnection -State Established

Test-Connection replaces ping. Test-NetConnection -Port checks whether a specific TCP port is reachable, which ping cannot do. Get-NetTCPConnection replaces netstat.

Find which process owns a listening port:

Get-NetTCPConnection -LocalPort 8080 |
  Select-Object LocalPort, State, @{n='Process';e={(Get-Process -Id $_.OwningProcess).Name}}

The Pipeline: Filter, Sort, Export

The pipeline is the core of PowerShell. Each cmdlet’s output objects feed the next.

Get-Service |
  Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' } |
  Select-Object Name, DisplayName |
  Export-Csv C:\Temp\stopped-services.csv -NoTypeInformation

$_ is the automatic variable for the current pipeline object.

Execution Policy and Running Scripts

Running a .ps1 script may fail with “running scripts is disabled on this system.” That is ExecutionPolicy at work.

Get-ExecutionPolicy -List
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

-Scope CurrentUser avoids changing the policy machine-wide. Execution policy is a safety feature, not a security boundary, so treat it as a guardrail against accidents.

A Simple Script: Disk Space Report

Save as DiskReport.ps1:

Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" |
  Select-Object DeviceID,
    @{n='SizeGB';e={[math]::Round($_.Size/1GB,1)}},
    @{n='FreeGB';e={[math]::Round($_.FreeSpace/1GB,1)}},
    @{n='Free%';e={[math]::Round(($_.FreeSpace/$_.Size)*100,1)}}

Run it with .\DiskReport.ps1. Get-CimInstance queries WMI data and replaces the deprecated Get-WmiObject. DriveType=3 limits results to local fixed disks.

Practical Troubleshooting Scenarios

Fix Corrupted System Files

Run these from an elevated prompt, in order:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow verifies protected system files. DISM /RestoreHealth repairs the component store that sfc pulls from. If sfc reports errors it cannot fix, run DISM first, then rerun sfc.

Reset a Stuck Windows Update

Stop-Service wuauserv, bits -Force
Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old
Start-Service wuauserv, bits

This clears the update cache. Windows rebuilds the folder on the next check. Error codes such as 0x80070002 (file not found) often resolve with this reset.

Flush DNS and Reset the Network Stack

Clear-DnsClientCache
Get-NetAdapter | Restart-NetAdapter

Find Why a Machine Shut Down Unexpectedly

Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,6008} -MaxEvents 10

Event ID 41 is Kernel-Power (unexpected restart). 6008 records an unexpected previous shutdown. -FilterHashtable filters at the source, which is far faster than piping to Where-Object.

Automate Temp File Cleanup

Get-ChildItem $env:TEMP -Recurse -File |
  Where-Object LastWriteTime -lt (Get-Date).AddDays(-14) |
  Remove-Item -Force -ErrorAction SilentlyContinue

Schedule it with Task Scheduler via Register-ScheduledTask to prevent disk saturation.

Beginner Habits That Prevent Disasters

1. Use -WhatIf first on any Remove-, Set-, or Stop- command.
2. Use tab completion. Press Tab to complete cmdlet names, parameters, and paths.
3. Use Get-History and the Up arrow to recall commands. Press F7 for a history popup in classic consoles.
4. Use Start-Transcript to log a session to a file.
5. Never paste scripts you do not understand into an elevated prompt.

FAQ

What is the difference between PowerShell and Command Prompt?

Command Prompt (cmd.exe) handles plain text and basic batch commands. PowerShell handles structured .NET objects, supports scripting, and manages services, the registry, and remote systems through cmdlets.

How do I run a PowerShell script on Windows?

Open PowerShell, navigate to the script folder, and run .\scriptname.ps1. If blocked, set the policy with Set-ExecutionPolicy RemoteSigned -Scope CurrentUser.

Is PowerShell the same as Windows Terminal?

No. Windows Terminal is a host application with tabs and themes. PowerShell is the shell that runs inside it, alongside cmd and WSL distributions.

Is PowerShell safe for beginners?

Yes, with precautions. Use -WhatIf and -Confirm on risky commands, and run as Administrator only when the task requires it.