Retrieve list of services.
PS C:\>get-service | format-table Name,
Status, DependentServices –auto
| The output of the get-service cmdlet is used as the input for the format-table cmdlet. The format-table cmdlet gives you the ability to format the output. |
Retrieve list of processes and send to file.
PS C:\>get-process | out-file
processes.txt
| The output of get-process is piped to out-file to send the data to a file. |
Count commands.
PS C:\>get-command | measure-object
PS C:\>get-command -type cmdlet |
measure-object
| The measure-object cmdlet counts the number of commands retrieved by get-command. In the second example, the get-command cmdlet looks only for cmdlets with the -type switch. |
Learn properties and methods for commands.
PS C:\>get-service | get-member
| The get-member cmdlet is used to retrieve all the members of the get-service cmdlet. |
Identify running services.
PS C:\> get-service | where {$_.status
-eq "running" }
| The $_ combination is a special pipeline variable that allows you to use dot notation with pipelines. The $_. refers to the cmdlet being piped (get-service).
This example retrieves a list of running services.
Note
The get-service cmdlet by itself returns a list of all services whether they are running or not.
|
Count list of running services.
PS C:\> get-service | where {$_.status
-eq "running" } | measure-object
| Pipes all the services to the where filter to restrict the result to only running services. It then pipes this result to the measure-object command to count the result. It returns an integer that indicates the number of services that are running. |
Sort a list of running processes.
PS C:\> get-process | sort-object
-property handles
| Retrieves a listing of running processes and sorts the output on the property “handles.” |
Retrieve verbose details on any running process.
PS C:\> get-process | where-object {
$_.processname -eq "powershell" } |
format-list *
| Lists all data (the * wildcard in the format-list * indicates all the data) on any running process (get-process) identified by the process name ($_.processname -eq “name”). |
Retrieve top 10 list of memory consuming processes.
PS C:\> get-process | sort-object
workingset -descending | select-object
-first 10
| Uses two pipelines. It starts by getting a listing of all processes. It then uses the sort-object cmdlet with descending sort order to list the processes using the most memory (workingset). It then limits the output to only the top 10 with the select-object cmdlet. |
PS C:\> get-process | where-object
{$_.workingset -gt 30000000}
| This uses the where-object to list only the processes that use more than 30 MB of memory (working set -gt 30000000). |
PS C:\> get-eventlog system -newest 10
| Format-List *
| The format-list * cmdlet formats the last 10 system event log entries in a list format. The * ensures that all items are listed. |
Get a listing of files and folders in a wide format.
PS C:\> get-childitem | format-wide
| Retrieves a directory listing of the current folder and uses the format-wide cmdlet to format the output. |
Get a listing of folders only.
PS C:\> get-childitem | where-object
{ $_.psiscontainer }
| Gets a listing of folders in the current directory using the psiscontainer (PowerShell is container) value. |
Get a listing of files only.
PS C:\> get-childitem | where-object
{ !$_.psiscontainer }
| Gets a listing of files in the current directory. This uses the not operator (!) looking for all items that aren’t folders using the psiscontainer (PowerShell is a container) value. |
List drives including type, capacity, and freespace.
PS C:\> get-wmiobject win32_volume
| select name,drivetype, capacity,
freespace | export-csv drivelist.csv
| Uses the Windows Management Instrumentation (WMI) cmdlet to retrieve a list of volumes with specific columns. The export-csv cmdlet formats the output as a comma-separated value file. |
