Get-Help Get-Process
Get-Command
Get-ChildItem C:\
Set-Location D:\
Get-Content file.txt
Get-Process | Out-File processes.txt
Write-Output âHello, PowerShell!â
Get-Process | Select-Object Name, CPU
Get-Service | Where-Object { $_.Status -eq âRunningâ }
1..5 | ForEach-Object { $_ * 2 }
Get-Process | Format-Table -AutoSize
Get-Service | Sort-Object Status
âHello, PowerShell!â | Measure-Object -Character
New-Item newfile.txt -ItemType File
Remove-Item file.txt
Copy-Item file.txt newfolder
Rename-Item file.txt newname.txt
Test-Path file.txt
Get-Service
Start-Service serviceName
Stop-Service serviceName
Restart-Service serviceName
Get-Process
Start-Process notepad
Stop-Process -Name notepad
Get-WmiObject Win32_ComputerSystem
Get-EventLog -LogName Application
Get-Content file.txt
Set-Content file.txt âNew contentâ
Test-Connection google.com
Test-NetConnection google.com
Invoke-WebRequest https://www.example.com
Get-Process | ConvertTo-Json
â{âNameâ:âJohnâ,âAgeâ:30}â | ConvertFrom-Json
Get-Date
New-Object PSObject
Get-Content file.txt
Set-Content file.txt âNew contentâ
Invoke-Expression âGet-Processâ
Write-Host âHello, PowerShell!â
Get-Process | Out-GridView
Get-Process | Out-Printer
Get-Host
Get-Module
Import-Module MyModule
Remove-Module MyModule
Get-Command
Get-Alias
Set-Alias np Notepad
Clear-Host
Clear-Content file.txt
Clear-Item file.txt
Clear-Variable varName
Clear-RecycleBin
Compare-Object object1 object2
Complete-Transaction
Get-Content data.csv | ConvertFrom-Csv
Get-Process | ConvertTo-Csv -NoTypeInformation
Debug-Process -Id processId
Disable-PSBreakpoint -Id breakpointId
Enable-PSBreakpoint -Id breakpointId
Exit
Get-Alias | Export-Alias -Path aliases.txt
Get-Process | Export-Clixml process.xml
Get-Process | Export-Csv process.csv
1..5 | ForEach-Object { $_ * 2 }
Get-Process | Format-Custom
Format-Hex 123
Get-Process | Format-List
Get-Process | Format-Table -AutoSize
Get-Process | Format-Wide
Get-Acl file.txt
Set-Acl file.txt -AclObject $aclObj
Get-Alias
Get-AuthenticodeSignature file.exe
Get-ChildItem C:\
Get-Clipboard
Get-Command
Get-ComputerInfo
Get-Content file.txt
Get-Credential
Get-Culture
Get-Date
Get-Event
Get-History
Get-Host
Get-HotFix
Get-Item
Get-ItemProperty file.txt -Name Length
Get-Job
Get-Location
Get-Process | Get-Member
Get-Module
Get-WmiObject Win32_OperatingSystem | Select-Object Caption
Get-Process
Get-Random -Minimum 1 -Maximum 100
Get-Service
Get-Transaction
Get-UICulture
Get-ChildItem | Get-Unique
Start-Transcript
Start-Transcript -Path "C:\transcripts\transcript0.txt" -NoClobber
$sharepath = '\\Server01\Transcripts'
$username = $env:USERNAME
$hostname = hostname
$version = $PSVersionTable.PSVersion.ToString()
$datetime = Get-Date -f 'yyyyMMddHHmmss'
$filename = "Transcript-${username}-${hostname}-${version}-${datetime}.txt"
$Transcript = Join-Path -Path $sharepath -ChildPath $filename
Start-Transcript
#STOP THE RUNNING SCRIPT
Stop-Transcript
Notes
To stop a transcript, use the Stop-Transcript cmdlet.
To record an entire session, add the Start-Transcript command to your profile. For more information, see about_Profiles.
$letterArray = 'a','b','c','d'
foreach ($letter in $letterArray)
{
Write-Host $letter
}
foreach ($file in Get-ChildItem)
{
Write-Host $file
}
foreach ($file in Get-ChildItem)
{
if ($file.Length -gt 100KB)
{
Write-Host $file
}
}
foreach ($file in Get-ChildItem)
{
if ($file.Length -gt 100KB)
{
Write-Host $file
Write-Host $file.Length
Write-Host $file.LastAccessTime
}
}
$i = 0
foreach ($file in Get-ChildItem) {
if ($file.length -gt 100KB) {
Write-Host $file 'file size:' ($file.length / 1024).ToString('F0') KB
$i = $i + 1
}
}
if ($i -ne 0) {
Write-Host
Write-Host $i ' file(s) over 100KB in the current directory.'
}
else {
Write-Host 'No files greater than 100KB in the current directory.'
}
Get-ItemProperty -Path HKCU:\Network\* |
ForEach-Object {
Set-ItemProperty -Path $_.PSPath -Name RemotePath -Value $_.RemotePath.ToUpper()
}
$nameSID = Get-ADUser -Identity 'E0507454' | select SID
Write-Host $nameSID
Get-WindowsCapability -Name RSAT.ActiveDirectory* -Online | Add-WindowsCapability -Online
>>>>>>>>>>>>>>>>>>>>>>>>DISPLAY ALL USER FOLDERS ONLY
Get-CimInstance -ClassName Win32_UserProfile -Filter 'Special="False"' | where {$_.LocalPath -ne $null -and $_.localPath -notlike "C:\windows\*"} | foreach {$_.localpath.replace('C:\Users\','')}
>>>>>>>>>>>>>>>>>>>>>>>>DISPLAY ALL USER FOLDERS ONLY
>>>>>>>>>>>>>>>>>>>>>>>>DISPLAY ALL USER FOLDERS AND SERVICES
$computerName = $env:COMPUTERNAME
# Get local user profiles
$localProfiles = Get-ChildItem "C:\Users\" | Where-Object {$_.PSIsContainer} | Select-Object -ExpandProperty Name
# Get domain user profiles
$domainProfiles = (Get-WmiObject -Class Win32_UserProfile -ComputerName $computerName).LocalPath.Replace("C:\Users\", "") | Select-Object -Unique
# Combine local and domain user profiles
$userProfiles = $localProfiles + $domainProfiles
# Output the list of user profiles
$userProfiles
>>>>>>>>>>>>>>>>>>>>>>>>DISPLAY ALL USER FOLDERS AND SERVICES
CTRL+C
Get-LocalUser | Select-Object -Property @('Name', 'SID')
[Security.Principal.WindowsIdentity]::GetCurrent() | Select-Object -Property @('Name', 'User')
Get-LocalUser | Select-Object -Property @('Name', 'SID')
Start-Transcript -Path "transcript.log"
# your code here
Stop-Transcript
Clear-RecycleBin -Force
Clear-RecycleBin -DriveLetter C
Clear-RecycleBin
-Confirm:$false.2121221222121
Get-WmiObject win32_bios | select Serialnumber
#PowerShell Script to Query a Specific OU and export Computer Names to a Text File:
#$OU = "OU=AMER,OU=ZZ MDM, DC=pharma,DC=aventis,DC=com" # Replace with your OU > WORX
$OU = "OU=Office,OU=MDM IA,OU=ZZ MDM, DC=pharma,DC=aventis,DC=com" # Replace with your OU > WORX
$OutputFile = "C:\TEMP\ComputerNames.txt"
$computers = Get-ADComputer -SearchBase $OU -Filter *
$computers | Select-Object -ExpandProperty Name | Out-File $OutputFile
Get-WmiObject Win32_Service -Credential FABRIKAM\administrator -ComputerName Fabrikam
Get-WmiObject -Class Win32_Bios | Format-List -Property *
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
Format-Table -AutoSize
# Define the time range to search
$StartTime = (Get-Date).AddDays(-7) # Adjust as needed
$EndTime = Get-Date
# Define the computer name (Distinguished Name or part of it)
$RestoredComputerName = "CN=PCNAME" # Replace with actual name
# Search the Security log for Event ID 5136
Get-WinEvent -FilterHashtable @{
LogName = 'Security'
ID = 5136
StartTime = $StartTime
EndTime = $EndTime
} | ForEach-Object {
$xml = [xml]$_.ToXml()
$objectDN = $xml.Event.EventData.Data | Where-Object { $_.Name -eq "ObjectDN" } | Select-Object -ExpandProperty '#text'
$attribute = $xml.Event.EventData.Data | Where-Object { $_.Name -eq "AttributeLDAPDisplayName" } | Select-Object -ExpandProperty '#text'
$newValue = $xml.Event.EventData.Data | Where-Object { $_.Name -eq "AttributeValue" } | Select-Object -ExpandProperty '#text'
if ($objectDN -like "*$RestoredComputerName*" -and $attribute -eq "isDeleted" -and $newValue -eq "FALSE") {
[PSCustomObject]@{
TimeCreated = $_.TimeCreated
RestoredBy = $_.Properties[1].Value # SubjectUserName
ObjectDN = $objectDN
}
}
}
# Set the directory path
$directoryPath = "C:\Your\Target\Directory"
# Set the output file path
$outputFile = "C:\Your\Output\file_fldr_list.txt"
# Get list of files and folders
Get-ChildItem -Path $directoryPath -Recurse |
Select-Object FullName |
Out-File -FilePath $outputFile -Encoding UTF8
Write-Host "File and folder list saved to $outputFile"
# 1) Replace C:\Your\Target\Directory with the path of the directory you want to scan.
# 2) Replace C:\Your\Output\file_list.txt with the desired output file path.
# Define output file paths
$fullListPath = "$env:USERPROFILE\Desktop\InstalledApps_FullList.txt"
$filteredListPath = "$env:USERPROFILE\Desktop\InstalledApps_FilteredList.txt"
# Define common apps to exclude (customize this list as needed)
$commonApps = @(
"Microsoft Edge",
"Microsoft OneDrive",
"Microsoft Office",
"Microsoft Teams",
"Visual C++",
"Skype",
"Windows Terminal",
"PowerShell",
"Adobe Acrobat Reader",
"Zoom",
"Google Chrome",
"Mozilla Firefox"
)
# Get installed apps from registry (32-bit and 64-bit)
$installedApps = @()
$registryPaths = @(
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
foreach ($path in $registryPaths) {
$installedApps += Get-ItemProperty $path -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName } |
Select-Object DisplayName, DisplayVersion, Publisher
}
# Save full list to file
$installedApps | Sort-Object DisplayName | Format-Table -AutoSize | Out-File $fullListPath
# Filter out common apps
$filteredApps = $installedApps | Where-Object {
$appName = $_.DisplayName
$isCommon = $false
foreach ($common in $commonApps) {
if ($appName -like "*$common*") {
$isCommon = $true
break
}
}
-not $isCommon
}
# Save filtered list to file
$filteredApps | Sort-Object DisplayName | Format-Table -AutoSize | Out-File $filteredListPath
# Output summary
Write-Host "â
Full list saved to: $fullListPath"
Write-Host "â
Filtered list saved to: $filteredListPath"
# Ensure the output folder exists
$OutputPath = "C:\temp\MyPC_Certs.txt"
if (!(Test-Path "C:\temp")) {
New-Item -ItemType Directory -Path "C:\temp"
}
# Get all certificates from Local Machine store
$certs = Get-ChildItem -Path Cert:\LocalMachine\My
# Write details to file
$certs | ForEach-Object {
"Subject: $($_.Subject)" +
"`nIssuer: $($_.Issuer)" +
"`nThumbprint: $($_.Thumbprint)" +
"`nNotBefore: $($_.NotBefore)" +
"`nNotAfter: $($_.NotAfter)" +
"`n----------------------------------------"
} | Out-File -FilePath $OutputPath -Encoding UTF8
Write-Host "Certificate details saved to $OutputPath"
# Ensure output folder exists
$OutputPath = "C:\temp\MyPC_Certs.txt"
if (!(Test-Path "C:\temp")) {
New-Item -ItemType Directory -Path "C:\temp"
}
# Get all certificates from Local Machine store
$certs = Get-ChildItem -Path Cert:\LocalMachine\My
# Write details to file
$certs | ForEach-Object {
"Subject: $($_.Subject)" +
"`nIssuer: $($_.Issuer)" +
"`nThumbprint: $($_.Thumbprint)" +
"`nInstallDate (approx): $($_.NotBefore)" +
"`nExpires: $($_.NotAfter)" +
"`n----------------------------------------"
} | Out-File -FilePath $OutputPath -Encoding UTF8
Write-Host "Certificate details saved to $OutputPath"
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing
# Create output folder if it doesn't exist
$folder = "C:\Temp"
if (!(Test-Path $folder)) { New-Item -ItemType Directory -Path $folder | Out-Null }
# Capture the primary screen
$bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
$bitmap = New-Object System.Drawing.Bitmap($bounds.Width, $bounds.Height)
$graphics = [System.Drawing.Graphics]::FromImage($bitmap)
# Copy screen into bitmap
$graphics.CopyFromScreen($bounds.Location, [System.Drawing.Point]::Empty, $bounds.Size)
# Save as JPG
$path = "\\swtflsusswtdep1\is2000\DEPLOY\SCREEN PRINTS\COMPLIANCE_APP\scrprint.jpg"
$bitmap.Save($path, [System.Drawing.Imaging.ImageFormat]::Jpeg)
# Clean up
$graphics.Dispose()
$bitmap.Dispose()
Write-Host "Screen print saved to $path"
Get-ChildItem "C:\Path\To\Folder" -File |
Select-Object Name |
Out-File "C:\Path\To\filelist.txt"
Get-ChildItem "C:\Path\To\Folder" -File -Recurse |
Select-Object FullName |
Out-File "C:\Path\To\filelist.txt"
Get-ChildItem "C:\Path\To\Folder" -File |
Select-Object Name, Length, LastWriteTime |
Out-File "C:\Path\To\filelist.txt"
Get-ChildItem "C:\Path\To\Folder" -Directory -Recurse |
Select-Object FullName |
Out-File "C:\Path\To\folderlist.txt"
must be run from > C:\Windows\System32
bcdedit /set {current} safeboot minimal Restart-Computer
Your Script Goes Here