PowerShell

The importance of system administrators in companies should not be underestimated because only by having a reliable and continuously functioning IT infrastructure can a company achieve maximum economic efficiency. Depending on the size of the organization, this requires the monitoring and control of dozens, if not hundreds, of computers simultaneously. A mammoth task that can only be mastered by trained specialists with a deep insight into intrasystem connections.

In 2016, the decision was made to offer the shell independently of the platform. Microsoft’s intention: PowerShell should become a universal tool for system administrators outside of Windows i.e. on Linux and macOS. Since then, the shell has spread more and more, and is constantly receiving new supporters. To summarize, PowerShell is the long overdue successor of the command prompt.

What exactly sets the new Microsoft framework apart from the familiar command prompt? To put it simply: PowerShell has all the features of cmd.exe, can do a lot of it much better, and also performs other tasks that were previously unthinkable with Windows.

PowerShell basically provides the same range of commands as cmd.exe. With sufficient knowledge of the common standard commands, PowerShell can be used in the same way as the command prompt. However, it also enables access to subjacent Windows internals that were previously not accessible with cmd.exe. e.g. the Windows Registry and the Windows Management Instrumentation (WMI). The command line of Windows PowerShell also follows the clear logic of a consistent command structure and syntax and makes more sense than cmd.exe in this respect.

Another feature that makes Windows PowerShell stand out: Unlike the command prompt and Unix-like systems, the program works completely object-based instead of issuing the results of commands in text form (strings). Each object has both properties and methods that define how it can be used. This is how the Windows process object represents properties such as process names and IDs, and methods for pausing and terminating processes.

Because the results of commands are always issued as .NET objects, pipelining in PowerShell enables you to perform much more complex tasks than cmd.exe. This works by using the output of one object in the pipe as input for the next object. For example, large and complex amounts of data can be filtered by file extensions and formatted as a clear list.

Windows PowerShell is not just a command line, it also acts as a rich and powerful scripting environment. In it, you can write your own commands or combine several commands into complex scripts to simplify system management tasks. Remoting also makes it possible to run scripts on any number of systems simultaneously, regardless of their location, and thereby manage, set up, record, and repair them.

This variety of options and features also reveals what Windows PowerShell’s primary target group is: IT professionals and system administrators who have a deep understanding of shells and are willing to familiarize themselves with Windows PowerShell for increased efficiency. Users who mainly work with Windows’ graphical user interface and only use the command prompt sporadically, however, will notice that PowerShell does not offer any particular added value, especially since it takes a while to get used to the framework.

Here’s a quick summary of the advantages and disadvantages of Windows PowerShell compared to the command prompt:

PowerShell basically consists of two components, namely the PowerShell Engine and the PowerShell scripting language. Both can be used separately or together to get the maximum functionality out of the program.

PowerShell’s command-line interpreter (CLI) gives the user access to internal operating system functions via keyboard entries. The program’s commands are called “cmdlets” (pronounced “commandlets”). According to a consistent syntax, they are always composed of a verb and a noun in the singular form e.g. “stop process” or “sort object”. Parameters are specified in a cmdlet according to the – Parameter [value] formula, for example:

The more than 100 core cmdlets also include frequently used standard commands from the command prompt, which are available as “aliases”, among other things, to help users get started with the new shell. For example, the cd command intended to change a directory has the equivalent “set location”, which performs exactly the same function. To view all pre-built aliases, use the “Get-Alias” cmdlet. You can also use the Set-Alias cmdlet to create your own aliases. For example, you can use the following pipeline to assign the alias “ed” to the command “notepad” (for the Notepad program), so that fewer keystrokes are required to execute the program:

The following table contains some examples of frequently used cmdlets and their related aliases:

PowerShell’s strict and easy-to-understand command structure allows you to work more efficiently than in the command prompt. To save even more time, you can use the [Tab] key to automatically complete half-written cmdlets. In many cases, the program even recognizes incompletely typed commands.

Cmdlets can be executed individually or pipelined together so that the output of an object can be read and reused by the following object. To add two cmdlets to the same pipeline, simply use the “|” icon. This way you can, for example, list all available processes and at the same time sort them by their ID:

Variables are defined with the $ symbol. As usual, they can be used to store outputs so that they can be accessed again at a later point during pipelining. PowerShell is even able to store the results of multiple pipelined commands at once, for example:

Much of PowerShell’s scripting language may seem familiar to C# and other scripting languages. Not only can you use it to write your own cmdlets (and share them with other users if necessary), you can also package multiple commands in sequence in a script file with the .ps1 format to extend the functionality of the shell. Numerous application examples are conceivable: from the execution of simple routine tasks to the almost complete automation of monitoring and control processes. Scripts always contain an application description and are executed with the prefix “.” followed by the complete file path. An example:

With sufficient practice and expertise, PowerShell can make many system management tasks much more efficient. In the following paragraph, we explain four typical application examples.

If, hypothetically, you need to rename about 1,000 documents of the “Text (1).docx”, “Text (2).docx” etc. scheme so that the spaces in the file name are replaced by underscores: It would not be advisable to change each document individually. Instead, you would probably use cmd.exe or – even better – an external tool. Pipelining in PowerShell allows even more flexibility when renaming large amounts of data.

To do this, first go to the directory in which the documents are located. This can easily be done using the “Set-Location” cmdlet in combination with the full file path. Here is an example:

Alternatively, you can navigate the directory using Windows Explorer: Simply click in the path list and enter “powershell” to open the PowerShell window for the directory. You can change the name of the selected document with the following cmdlet:

Before implementing a new security solution on the network, you should check which services are already installed on a particular PC. The basic tool is the “Get-Service” cmdlet, which lists all services. You can also use the filter functions in PowerShell to display only a partial amount of the results – for example, all running services. This works with the following cmdlet:

The output of “Get-Service” is forwarded to the “Where-Object” by the pipeline. “Where-Object” filters all services by their status (represented by the variable “$_.status” and the parameter -eq "running") and lists the running services. If necessary, you can also sort the prefiltered list by display name by adding another cmdlet to the pipeline:

Event logs provide system administrators with information about error messages in applications, in the operating system, or in the security functions of a device. Use the “Get-EventLog” command to view and manage these logs. For example, if you want to take a look at the error messages in the “System” event display, enter the following:

If PowerShell outputs too many results, you can use the “Newest 100” parameter to restrict the list to the 100 most recent system log entries that are then filtered for errors:

You can get detailed information about individual error messages if you forward the output of this pipeline to the “Format-List” cmdlet:

Windows Management Instrumentation (WMI) provides access to almost all settings and functions of Windows computers, making it the most important tool for process automation and remote management of digital workstations. You can also apply the associated “Get-WmiObject” cmdlet to remote computers, so you can also use the Windows PowerShell as a system management tool. For example, if you need information of the Win32_BIOS class on a computer in the network (represented by the parameter “–Computername”), the following command will help you:

Alternatively, you can work with the parameter “–Class” followed by the complete path of the class:

You can now access the internal system settings of the third-party computer remotely. The following example shows how to retrieve the methods of the Windows Update Client service to find out which cmdlets can be used to start, stop, and restart it:

As you can see, the “Get-WmiObject –Computername” first locates the desired host and then selects the “Win32_Service” class using the “–Class” parameter. The Windows Update Client with the abbreviation “wuauserv” is then filtered out of the existing services. The well-known “Get-Member” cmdlet and the “-Type Method” parameter give you an overview of all methods for “wuauserv” that enable you to fully control the client remotely: