118 commands · 7 cheat sheets · Windows
Monitoring, Policy, and Maintenance master quick reference
Browse 118 commands from 7 focused cheat sheets on page 1 of 1. Each example opens its matching detailed section.
Monitoring, Policy, and Maintenance · 19 commands
PowerShell Windows Event Logs Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| List event logs | Get-WinEvent -ListLog * | View examples |
| Find nonempty enabled logs | Get-WinEvent -ListLog * |
Where-Object { $_.IsEnabled -and $_.RecordCount } | View examples |
| List event providers | Get-WinEvent -ListProvider * | View examples |
| Read recent system events | Get-WinEvent -LogName System -MaxEvents 20 | View examples |
| Read one provider | Get-WinEvent -ProviderName `
'Microsoft-Windows-Kernel-General' -MaxEvents 20 | View examples |
| Filter by start time | Get-WinEvent -FilterHashtable @{ LogName='System'; `
StartTime=(Get-Date).AddHours(-1) } | View examples |
| Filter error levels | Get-WinEvent -FilterHashtable @{ LogName='System'; `
Level=1,2,3 } | View examples |
| Filter event identifiers | Get-WinEvent -FilterHashtable @{ LogName='System'; `
Id=41,6008 } | View examples |
| Filter a provider in a log | Get-WinEvent -FilterHashtable @{ LogName='System'; `
ProviderName='Microsoft-Windows-Kernel-General' } | View examples |
| Suppress information events | Get-WinEvent -FilterHashtable @{ LogName='Application'; `
SuppressHashFilter=@{ Level=4 } } | View examples |
| Select core event fields | Get-WinEvent -LogName System -MaxEvents 5 |
Select-Object TimeCreated, Id, LevelDisplayName, ProviderName | View examples |
| Read rendered messages | $event.Message | View examples |
| Inspect event XML | [xml]$xml = $event.ToXml() | View examples |
| Read an archived log | Get-WinEvent -Path 'C:\Evidence\System.evtx' -MaxEvents `
50 | View examples |
| Query a remote computer | Get-WinEvent -ComputerName 'Server01' -LogName System `
-MaxEvents 20 | View examples |
| Count by event ID | Get-WinEvent -LogName System -MaxEvents 500 |
Group-Object Id -NoElement |
Sort-Object Count -Descending | View examples |
| Export selected fields | $events |
Select-Object TimeCreated, Id, ProviderName, Message |
Export-Csv '.\events.csv' -NoTypeInformation -Encoding utf8 | View examples |
| Return oldest first | Get-WinEvent -LogName System -Oldest -MaxEvents 20 | View examples |
| Preserve record identity | $event |
Select-Object LogName, RecordId, TimeCreated, Id, ProviderName | View examples |
Monitoring, Policy, and Maintenance · 16 commands
Windows CIM, WMI, and Hardware Inventory PowerShell Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| Discover CIM classes | Get-CimClass -Namespace 'root/cimv2' -ClassName 'Win32_*' |
Select-Object -First 25 CimClassName | View examples |
| Inspect class properties | (Get-CimClass -ClassName 'Win32_ComputerSystem').CimClassProperties |
Select-Object Name, CimType | View examples |
| Inventory Windows version | Get-CimInstance -ClassName 'Win32_OperatingSystem' |
Select-Object Caption, Version, BuildNumber, OSArchitecture, LastBootUpTime | View examples |
| Inventory computer identity | Get-CimInstance -ClassName 'Win32_ComputerSystem' |
Select-Object Manufacturer, Model, Name, Domain, TotalPhysicalMemory | View examples |
| Inventory firmware identity | Get-CimInstance -ClassName 'Win32_BIOS' |
Select-Object Manufacturer, SMBIOSBIOSVersion, ReleaseDate, SerialNumber | View examples |
| Inventory processors | Get-CimInstance -ClassName 'Win32_Processor' |
Select-Object DeviceID, Name, NumberOfCores, NumberOfLogicalProcessors, MaxClockSpeed | View examples |
| Inventory memory modules | Get-CimInstance -ClassName 'Win32_PhysicalMemory' |
Select-Object DeviceLocator, Capacity, Speed, Manufacturer, PartNumber | View examples |
| Inventory physical disks | Get-CimInstance -ClassName 'Win32_DiskDrive' |
Select-Object Index, Model, SerialNumber, InterfaceType, Size, Status | View examples |
| Inventory fixed volumes | Get-CimInstance -ClassName 'Win32_LogicalDisk' -Filter 'DriveType = 3' |
Select-Object DeviceID, VolumeName, FileSystem, Size, FreeSpace | View examples |
| Inventory enabled IP adapters | Get-CimInstance -ClassName 'Win32_NetworkAdapterConfiguration' -Filter 'IPEnabled = TRUE' |
Select-Object Description, MACAddress, IPAddress, DefaultIPGateway | View examples |
| Inventory signed drivers | Get-CimInstance -ClassName 'Win32_PnPSignedDriver' |
Select-Object DeviceName, Manufacturer, DriverVersion, DriverDate, InfName | View examples |
| Run a WQL projection | Get-CimInstance -Query `
'SELECT DeviceID,Size,FreeSpace FROM Win32_LogicalDisk WHERE DriveType=3' | View examples |
| Create a Kerberos CIM session | New-CimSession -ComputerName 'server01.contoso.com' `
-Authentication Kerberos | View examples |
| Query through a CIM session | Get-CimInstance -CimSession $session -ClassName 'Win32_OperatingSystem' |
Select-Object CSName, Caption, Version, LastBootUpTime | View examples |
| Close a CIM session | Remove-CimSession -CimSession $session | View examples |
| Export selected inventory | $inventory |
Export-Csv -LiteralPath './hardware-inventory.csv' -NoTypeInformation -Encoding utf8 | View examples |
Monitoring, Policy, and Maintenance · 18 commands
Windows Crash Dumps and WinDbg Troubleshooting Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| Read recent WER events | Get-WinEvent -FilterHashtable @{ LogName='Application'; `
ProviderName='Windows Error Reporting'; `
StartTime=(Get-Date).AddHours(-4) } -MaxEvents 100 | View examples |
| Read application crash events | Get-WinEvent -FilterHashtable @{ LogName='Application'; `
ProviderName='Application Error'; `
StartTime=(Get-Date).AddHours(-4) } -MaxEvents 100 | View examples |
| Read bug-check events | Get-WinEvent -FilterHashtable @{ LogName='System'; `
Id=1001; StartTime=(Get-Date).AddDays(-7) } -MaxEvents `
50 | View examples |
| Inspect kernel dump settings | Get-ItemProperty -LiteralPath `
'HKLM:/SYSTEM/CurrentControlSet/Control/CrashControl' | View examples |
| Inspect page-file usage | Get-CimInstance -ClassName 'Win32_PageFileUsage' |
Select-Object Name, AllocatedBaseSize, CurrentUsage, PeakUsage | View examples |
| Inspect MEMORY.DMP metadata | Get-Item -LiteralPath (Join-Path $env:SystemRoot 'MEMORY.DMP') |
Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc | View examples |
| List recent user dumps | Get-ChildItem -LiteralPath (Join-Path $env:LOCALAPPDATA 'CrashDumps') -Filter '*.dmp' |
Sort-Object LastWriteTimeUtc -Descending | View examples |
| Hash a dump artifact | Get-FileHash -LiteralPath `
'C:/CrashEvidence/App_260812_101500.dmp' -Algorithm `
SHA256 | View examples |
| Inspect LocalDumps policy | Get-ItemProperty -LiteralPath `
'HKLM:/SOFTWARE/Microsoft/Windows/Windows Error Reporting/LocalDumps' `
-ErrorAction SilentlyContinue | View examples |
| Inspect per-app LocalDumps | Get-ItemProperty -LiteralPath `
'HKLM:/SOFTWARE/Microsoft/Windows/Windows Error Reporting/LocalDumps/MyApp.exe' `
-ErrorAction SilentlyContinue | View examples |
| Plan exception capture | procdump.exe -ma -e -n 1 -w 'MyApp.exe' `
'C:/CrashEvidence' | View examples |
| Cancel ProcDump monitoring | procdump.exe -cancel 4321 | View examples |
| Validate dump structure | dumpchk.exe 'C:/CrashEvidence/App_260812_101500.dmp' | View examples |
| Open a dump in WinDbg | windbg.exe -z 'C:/CrashEvidence/App_260812_101500.dmp' | View examples |
| Set Microsoft symbol cache | .symfix C:\Symbols; .reload /f | View examples |
| Run verbose analysis | !analyze -v | View examples |
| Select exception context | .ecxr; kv | View examples |
| List loaded modules | lm t n | View examples |
Monitoring, Policy, and Maintenance · 14 commands
Windows Environment Variables and PATH PowerShell Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| List process environment | Get-ChildItem Env: | Sort-Object Name | View examples |
| Read one value | $env:TEMP | View examples |
| Set for current process | $env:APP_MODE = 'development' | View examples |
| Remove from current process | Remove-Item Env:APP_MODE | View examples |
| Read persistent user value | [Environment]::GetEnvironmentVariable('APP_MODE', `
'User') | View examples |
| Set persistent user value | [Environment]::SetEnvironmentVariable('APP_MODE', `
'production', 'User') | View examples |
| Remove persistent user value | [Environment]::SetEnvironmentVariable('APP_MODE', $null, `
'User') | View examples |
| Read machine value | [Environment]::GetEnvironmentVariable('Path', 'Machine') | View examples |
| Split PATH safely | $env:Path -split [IO.Path]::PathSeparator | View examples |
| Resolve all commands | Get-Command python -All | View examples |
| Expand percent variables | [Environment]::ExpandEnvironmentVariables('%TEMP%\report.log') | View examples |
| Start a fresh process | Start-Process pwsh | View examples |
| Inspect module search paths | $env:PSModulePath -split [IO.Path]::PathSeparator | View examples |
| Inspect runtime identity | [Environment]::UserName | View examples |
Monitoring, Policy, and Maintenance · 19 commands
Windows Group Policy Management PowerShell Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| Check the GroupPolicy module | Get-Module -ListAvailable GroupPolicy |
Select-Object Name, Version, Path | View examples |
| List domain GPOs | Get-GPO -All -Domain 'corp.example.com' -Server 'dc01.corp.example.com' |
Sort-Object DisplayName | View examples |
| Resolve a GPO by GUID | Get-GPO -Guid '11111111-2222-3333-4444-555555555555' `
-Domain 'corp.example.com' -Server `
'dc01.corp.example.com' | View examples |
| Export a GPO report | Get-GPOReport -Guid $gpo.Id -ReportType Html -Path `
'C:\Reports\Pilot-GPO.html' -Domain 'corp.example.com' | View examples |
| Inspect OU inheritance | Get-GPInheritance -Target `
'OU=Pilot,OU=Workstations,DC=corp,DC=example,DC=com' `
-Domain 'corp.example.com' | View examples |
| Audit GPO permissions | Get-GPPermission -Guid $gpo.Id -All -Domain `
'corp.example.com' -Server 'dc01.corp.example.com' | View examples |
| Preview one GPO backup | Backup-GPO -Guid $gpo.Id -Path 'C:\GPOBackups' -Domain `
'corp.example.com' -Comment 'Before approved change' `
-WhatIf | View examples |
| Preview all-GPO backup | Backup-GPO -All -Path 'C:\GPOBackups' -Domain `
'corp.example.com' -Server 'dc01.corp.example.com' `
-WhatIf | View examples |
| Preview an unlinked GPO | New-GPO -Name 'Pilot - Example Policy' -Comment `
'CHG-12345; owner: Endpoint' -Domain `
'corp.example.com' -WhatIf | View examples |
| Read a registry policy | Get-GPRegistryValue -Name 'Pilot - Example Policy' -Key `
'HKLM\Software\Policies\Example' -ValueName 'Mode' | View examples |
| Preview a registry policy | Set-GPRegistryValue -Name 'Pilot - Example Policy' -Key `
'HKLM\Software\Policies\Example' -ValueName 'Mode' `
-Type DWord -Value 1 -WhatIf | View examples |
| Preview removing a setting | Remove-GPRegistryValue -Name 'Pilot - Example Policy' `
-Key 'HKLM\Software\Policies\Example' -ValueName `
'Mode' -WhatIf | View examples |
| Preview a disabled pilot link | New-GPLink -Guid $gpo.Id -Target $pilotOu -LinkEnabled `
No -Domain 'corp.example.com' -WhatIf | View examples |
| Preview enabling a link | Set-GPLink -Guid $gpo.Id -Target $pilotOu -LinkEnabled `
Yes -Enforced No -Domain 'corp.example.com' -WhatIf | View examples |
| Preview unlinking a GPO | Remove-GPLink -Guid $gpo.Id -Target $pilotOu -Domain `
'corp.example.com' -WhatIf | View examples |
| Preview read delegation | Set-GPPermission -Guid $gpo.Id -TargetName `
'GG-GPO-Auditors' -TargetType Group -PermissionLevel `
GpoRead -WhatIf | View examples |
| Collect computer RSoP | Get-GPResultantSetOfPolicy -Computer `
'pc042.corp.example.com' -ReportType Html -Path `
'C:\Reports\PC042-RSoP.html' | View examples |
| Generate local gpresult | gpresult.exe /h 'C:\Reports\gpresult.html' /f | View examples |
| Schedule a remote refresh | Invoke-GPUpdate -Computer 'pc042.corp.example.com' `
-Target Computer -RandomDelayInMinutes 30 -AsJob | View examples |
Monitoring, Policy, and Maintenance · 16 commands
Windows Performance Counters and Resource Monitoring PowerShell Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| List counter sets | Get-Counter -ListSet '*' |
Sort-Object CounterSetName |
Select-Object CounterSetName, CounterSetType | View examples |
| Inspect processor paths | Get-Counter -ListSet 'Processor Information' |
Select-Object -ExpandProperty PathsWithInstances | View examples |
| Sample total CPU | Get-Counter -Counter `
'\Processor Information(_Total)\% Processor Utility' `
-SampleInterval 2 -MaxSamples 15 | View examples |
| Sample memory pressure | Get-Counter -Counter `
'\Memory\Available MBytes','\Memory\Pages/sec' `
-SampleInterval 2 -MaxSamples 15 | View examples |
| Sample physical disk latency | Get-Counter -Counter `
'\PhysicalDisk(*)\Avg. Disk sec/Read','\PhysicalDisk(*)\Avg. Disk sec/Write' `
-MaxSamples 5 | View examples |
| Sample disk queues | Get-Counter -Counter `
'\PhysicalDisk(*)\Current Disk Queue Length' `
-SampleInterval 2 -MaxSamples 15 | View examples |
| Sample network throughput | Get-Counter -Counter `
'\Network Interface(*)\Bytes Total/sec' `
-SampleInterval 2 -MaxSamples 15 | View examples |
| Extract cooked values | $samples.CounterSamples |
Select-Object Timestamp, Path, InstanceName, CookedValue, Status | View examples |
| Average valid samples | $samples.CounterSamples |
Where-Object Status -eq 0 |
Group-Object Path |
ForEach-Object { $_.Group.CookedValue |
Measure-Object -Average } | View examples |
| Snapshot costly processes | Get-Process |
Sort-Object CPU -Descending |
Select-Object -First 15 Id, ProcessName, CPU, WorkingSet64, PrivateMemorySize64 | View examples |
| Sample process CPU rates | Get-Counter -Counter '\Process(*)\% Processor Time' `
-SampleInterval 2 -MaxSamples 5 | View examples |
| Sample a remote host | Get-Counter -ComputerName 'server01.contoso.com' `
-Counter '\Memory\Available MBytes' -MaxSamples 5 | View examples |
| Write a BLG export | $samples |
Export-Counter -Path './perf-sample.blg' -FileFormat blg | View examples |
| Read a BLG capture | Import-Counter -Path './perf-sample.blg' |
Select-Object -ExpandProperty CounterSamples | View examples |
| List collector sets | logman.exe query | View examples |
| Correlate System events | Get-WinEvent -FilterHashtable @{ LogName='System'; `
StartTime=(Get-Date).AddHours(-1) } -MaxEvents 100 | View examples |
Monitoring, Policy, and Maintenance · 16 commands
Windows Update Management and Troubleshooting Cheat Sheet
| Use | Syntax | Examples |
|---|---|---|
| Record OS build | Get-ComputerInfo |
Select-Object WindowsProductName, WindowsVersion, OsBuildNumber, OsArchitecture | View examples |
| List reported hotfixes | Get-HotFix | Sort-Object InstalledOn -Descending | View examples |
| List servicing packages | dism.exe /Online /Get-Packages /Format:Table | View examples |
| Inspect update services | Get-Service wuauserv, bits, cryptsvc |
Select-Object Name, Status, StartType | View examples |
| Read Windows Update policy | Get-ItemProperty `
'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
-ErrorAction SilentlyContinue | View examples |
| Create WUA searcher | $searcher = (New-Object -ComObject `
Microsoft.Update.Session).CreateUpdateSearcher() | View examples |
| Scan for missing updates | $result = `
$searcher.Search("IsInstalled=0 and IsHidden=0") | View examples |
| Review scan results | $result.Updates |
Select-Object Title, MsrcSeverity, IsDownloaded, RebootRequired | View examples |
| Query WUA history | $searcher.QueryHistory(0, 30) |
Select-Object Date, Title, Operation, ResultCode, HResult | View examples |
| Read operational events | Get-WinEvent -LogName `
'Microsoft-Windows-WindowsUpdateClient/Operational' `
-MaxEvents 50 | View examples |
| Build readable update log | Get-WindowsUpdateLog -LogPath (Join-Path $PWD `
'WindowsUpdate.log') | View examples |
| Scan component-store health | dism.exe /Online /Cleanup-Image /ScanHealth | View examples |
| Hash a staged package | Get-FileHash -LiteralPath 'C:\Staging\KB0000000.msu' `
-Algorithm SHA256 | View examples |
| Install a staged MSU | dism.exe /Online /Add-Package `
/PackagePath:"C:\Staging\KB0000000.msu" `
/PreventPending /NoRestart | View examples |
| Schedule controlled restart | shutdown.exe /r /t 900 /d p:2:17 /c `
"Approved Windows Update maintenance" | View examples |
| Cancel scheduled restart | shutdown.exe /a | View examples |