Power­Shell

The im­port­ance of system ad­min­is­trat­ors in companies should not be un­der­es­tim­ated because only by having a reliable and con­tinu­ously func­tion­ing IT in­fra­struc­ture can a company achieve maximum economic ef­fi­ciency. Depending on the size of the or­gan­isa­tion, this requires the mon­it­or­ing and control of dozens, if not hundreds, of computers sim­ul­tan­eously. A mammoth task that can only be mastered by trained spe­cial­ists with a deep insight into in­trasys­tem con­nec­tions.

In 2016, the decision was made to offer the shell in­de­pend­ently of the platform. Microsoft’s intention: Power­Shell should become a universal tool for system ad­min­is­trat­ors outside of Windows i.e. on Linux and macOS. Since then, the shell has spread more and more, and is con­stantly receiving new sup­port­ers. To summarise, Power­Shell is the long overdue successor of the command prompt.

What exactly sets the new Microsoft framework apart from the familiar command prompt? To put it simply: Power­Shell has all the features of cmd.exe, can do a lot of it much better, and also performs other tasks that were pre­vi­ously un­think­able with Windows.

Power­Shell basically provides the same range of commands as cmd.exe. With suf­fi­cient knowledge of the common standard commands, Power­Shell can be used in the same way as the command prompt. However, it also enables access to subjacent Windows internals that were pre­vi­ously not ac­cess­ible with cmd.exe. e.g. the Windows Registry and the Windows Man­age­ment In­stru­ment­a­tion (WMI). The command line of Windows Power­Shell also follows the clear logic of a con­sist­ent command structure and syntax and makes more sense than cmd.exe in this respect.

Another feature that makes Windows Power­Shell stand out: Unlike the command prompt and Unix-like systems, the program works com­pletely object-based instead of issuing the results of commands in text form (strings). Each object has both prop­er­ties and methods that define how it can be used. This is how the Windows process object rep­res­ents prop­er­ties such as process names and IDs, and methods for pausing and ter­min­at­ing processes.

Because the results of commands are always issued as .NET objects, pipelin­ing in Power­Shell enables you to perform much more complex tasks than cmd.exe. This works by using the output of one object in the pipe as input for the next object. For example, large and complex amounts of data can be filtered by file ex­ten­sions and formatted as a clear list.

Windows Power­Shell is not just a command line, it also acts as a rich and powerful scripting en­vir­on­ment. In it, you can write your own commands or combine several commands into complex scripts to simplify system man­age­ment tasks. Remoting also makes it possible to run scripts on any number of systems sim­ul­tan­eously, re­gard­less of their location, and thereby manage, set up, record, and repair them.

This variety of options and features also reveals what Windows Power­Shell’s primary target group is: IT pro­fes­sion­als and system ad­min­is­trat­ors who have a deep un­der­stand­ing of shells and are willing to fa­mil­i­ar­ise them­selves with Windows Power­Shell for increased ef­fi­ciency. Users who mainly work with Windows’ graphical user interface and only use the command prompt sporad­ic­ally, however, will notice that Power­Shell does not offer any par­tic­u­lar added value, es­pe­cially since it takes a while to get used to the framework.

Here’s a quick summary of the ad­vant­ages and dis­ad­vant­ages of Windows Power­Shell compared to the command prompt:

Power­Shell basically consists of two com­pon­ents, namely the Power­Shell Engine and the Power­Shell scripting language. Both can be used sep­ar­ately or together to get the maximum func­tion­al­ity out of the program.

Power­Shell’s command-line in­ter­pret­er (CLI) gives the user access to internal operating system functions via keyboard entries. The program’s commands are called “cmdlets” (pro­nounced “com­mand­lets”). According to a con­sist­ent syntax, they are always composed of a verb and a noun in the singular form e.g. “stop process” or “sort object”. Para­met­ers are specified in a cmdlet according to the – Parameter [value] formula, for example:

The more than 100 core cmdlets also include fre­quently used standard commands from the command prompt, which are available as “aliases”, among other things, to help users get started with the new shell. For example, the cd command intended to change a directory has the equi­val­ent “set location”, which performs exactly the same function. To view all pre-built aliases, use the “Get-Alias” cmdlet. You can also use the Set-Alias cmdlet to create your own aliases. For example, you can use the following pipeline to assign the alias “ed” to the command “notepad” (for the Notepad program), so that fewer key­strokes are required to execute the program:

The following table contains some examples of fre­quently used cmdlets and their related aliases:

Power­Shell’s strict and easy-to-un­der­stand command structure allows you to work more ef­fi­ciently than in the command prompt. To save even more time, you can use the [Tab] key to auto­mat­ic­ally complete half-written cmdlets. In many cases, the program even re­cog­nises in­com­pletely typed commands.

Cmdlets can be executed in­di­vidu­ally or pipelined together so that the output of an object can be read and reused by the following object. To add two cmdlets to the same pipeline, simply use the “|” icon. This way you can, for example, list all available processes and at the same time sort them by their ID:

Variables are defined with the $ symbol. As usual, they can be used to store outputs so that they can be accessed again at a later point during pipelin­ing. Power­Shell is even able to store the results of multiple pipelined commands at once, for example:

Much of Power­Shell’s scripting language may seem familiar to C# and other scripting languages. Not only can you use it to write your own cmdlets (and share them with other users if necessary), you can also package multiple commands in sequence in a script file with the .ps1 format to extend the func­tion­al­ity of the shell. Numerous ap­plic­a­tion examples are con­ceiv­able: from the execution of simple routine tasks to the almost complete auto­ma­tion of mon­it­or­ing and control processes. Scripts always contain an ap­plic­a­tion de­scrip­tion and are executed with the prefix “.” followed by the complete file path. An example:

With suf­fi­cient practice and expertise, Power­Shell can make many system man­age­ment tasks much more efficient. In the following paragraph, we explain four typical ap­plic­a­tion examples.

If, hy­po­thet­ic­ally, you need to rename about 1,000 documents of the “Text (1).docx”, “Text (2).docx” etc. scheme so that the spaces in the file name are replaced by un­der­scores: It would not be advisable to change each document in­di­vidu­ally. Instead, you would probably use cmd.exe or – even better – an external tool. Pipelin­ing in Power­Shell allows even more flex­ib­il­ity when renaming large amounts of data.

To do this, first go to the directory in which the documents are located. This can easily be done using the “Set-Location” cmdlet in com­bin­a­tion with the full file path. Here is an example:

Al­tern­at­ively, you can navigate the directory using Windows Explorer: Simply click in the path list and enter “power­shell” to open the Power­Shell window for the directory. You can change the name of the selected document with the following cmdlet:

Before im­ple­ment­ing a new security solution on the network, you should check which services are already installed on a par­tic­u­lar PC. The basic tool is the “Get-Service” cmdlet, which lists all services. You can also use the filter functions in Power­Shell to display only a partial amount of the results – for example, all running services. This works with the following cmdlet:

The output of “Get-Service” is forwarded to the “Where-Object” by the pipeline. “Where-Object” filters all services by their status (rep­res­en­ted by the variable “$_.status” and the parameter -eq "running") and lists the running services. If necessary, you can also sort the pre­filtered list by display name by adding another cmdlet to the pipeline:

Event logs provide system ad­min­is­trat­ors with in­form­a­tion about error messages in ap­plic­a­tions, in the operating system, or in the security functions of a device. Use the “Get-EventLog” command to view and manage these logs. For example, if you want to take a look at the error messages in the “System” event display, enter the following:

If Power­Shell outputs too many results, you can use the “Newest 100” parameter to restrict the list to the 100 most recent system log entries that are then filtered for errors:

You can get detailed in­form­a­tion about in­di­vidu­al error messages if you forward the output of this pipeline to the “Format-List” cmdlet:

Windows Man­age­ment In­stru­ment­a­tion (WMI) provides access to almost all settings and functions of Windows computers, making it the most important tool for process auto­ma­tion and remote man­age­ment of digital work­sta­tions. You can also apply the as­so­ci­ated “Get-WmiObject” cmdlet to remote computers, so you can also use the Windows Power­Shell as a system man­age­ment tool. For example, if you need in­form­a­tion of the Win32_BIOS class on a computer in the network (rep­res­en­ted by the parameter “–Com­puter­name”), the following command will help you:

Al­tern­at­ively, you can work with the parameter “–Class” followed by the complete path of the class:

You can now access the internal system settings of the third-party computer remotely. The following example shows how to retrieve the methods of the Windows Update Client service to find out which cmdlets can be used to start, stop, and restart it:

As you can see, the “Get-WmiObject –Com­puter­name” first locates the desired host and then selects the “Win32_Service” class using the “–Class” parameter. The Windows Update Client with the ab­bre­vi­ation “wuauserv” is then filtered out of the existing services. The well-known “Get-Member” cmdlet and the “-Type Method” parameter give you an overview of all methods for “wuauserv” that enable you to fully control the client remotely: