PowerShell 7 Advanced System Administration Commands

PowerShell 7 Core Concepts

PowerShell 7 is cross-platform and packed with powerful cmdlets for system administration. These snippets work on Windows, Linux, and macOS.

1. System Information Gathering

Get comprehensive system information:

# Detailed system info
Get-ComputerInfo | Select-Object CsName, OsArchitecture, OsVersion, CsTotalPhysicalMemory

# CPU and memory usage
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WorkingSet

# Disk space analysis
Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{N="Used(GB)";E={[math]::Round($_.Used/1GB,2)}}, @{N="Free(GB)";E={[math]::Round($_.Free/1GB,2)}}

2. Service Management

Manage Windows services with filtering and automation:

# List all running services
Get-Service | Where-Object {$_.Status -eq "Running"} | Select-Object Name, DisplayName, StartType

# Stop and disable a service
Stop-Service -Name "ServiceName" -Force
Set-Service -Name "ServiceName" -StartupType Disabled

# Restart multiple services
$services = @("Service1", "Service2", "Service3")
$services | ForEach-Object { Restart-Service -Name $_ -Force }

Network Administration

3. Advanced Network Diagnostics

PowerShell network troubleshooting commands:

# Get all network adapters with IP config
Get-NetIPAddress | Select-Object InterfaceAlias, IPAddress, PrefixLength

# Test connectivity with detailed output
Test-NetConnection -ComputerName google.com -InformationLevel Detailed

# Get active TCP connections
Get-NetTCPConnection | Where-Object {$_.State -eq "Established"} | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State

Automation Tips

• Save frequently used scripts as .ps1 files in your scripts directory
• Use PowerShell profiles to load custom functions on startup
• Leverage -WhatIf parameter to test commands before execution
• Create scheduled tasks with Register-ScheduledTask for automation
• Use error handling with try/catch blocks in production scripts

File System Operations at Scale

PowerShell's pipeline makes bulk file operations far more powerful than anything you can do in File Explorer. Get-ChildItem, combined with Where-Object and ForEach-Object, handles thousands of files cleanly:

# Find files over 500 MB modified in the last 30 days
Get-ChildItem C:\Data -Recurse -File |
    Where-Object { $_.Length -gt 500MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, @{n='SizeMB';e={[math]::Round($_.Length/1MB,1)}} |
    Sort-Object SizeMB -Descending

# Bulk rename — add date prefix
Get-ChildItem C:\Reports\*.pdf | Rename-Item -NewName { "2026_$($_.Name)" }

Querying the Windows Event Log

The Windows Event Viewer GUI is slow for bulk analysis. PowerShell's Get-WinEvent is orders of magnitude faster and scriptable:

# Last 50 critical and error events from System log
Get-WinEvent -LogName System -MaxEvents 200 |
    Where-Object { $_.LevelDisplayName -in 'Critical','Error' } |
    Select-Object TimeCreated, Id, Message |
    Format-Table -AutoSize

# Failed logon attempts (Security log, Event ID 4625)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} |
    Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}},
                  @{n='IP';e={$_.Properties[19].Value}}

Local User and Group Management

Managing local accounts without leaving the terminal keeps workflows scriptable and auditable:

# List local users and whether they're enabled
Get-LocalUser | Select-Object Name, Enabled, LastLogon, PasswordLastSet

# Create a restricted service account
$pw = ConvertTo-SecureString "Str0ng!Pass" -AsPlainText -Force
New-LocalUser "svc_backup" -Password $pw -FullName "Backup Service" -Description "Runs nightly backup"
Add-LocalGroupMember -Group "Backup Operators" -Member "svc_backup"

# Disable a stale account
Disable-LocalUser -Name "old.employee"

Scheduled Tasks via PowerShell

The ScheduledTasks module provides full control over the Task Scheduler from the command line — no GUI needed:

# List all tasks and their last run result
Get-ScheduledTask | Get-ScheduledTaskInfo |
    Select-Object TaskName, LastRunTime, LastTaskResult |
    Where-Object { $_.LastTaskResult -ne 0 }   # non-zero = error

# Create a daily maintenance task
$action  = New-ScheduledTaskAction -Execute "pwsh.exe" -Argument "-File C:\Scripts\cleanup.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At 2am
$settings = New-ScheduledTaskSettingsSet -RunOnlyIfIdle:$false -StartWhenAvailable
Register-ScheduledTask "DailyCleanup" -Action $action -Trigger $trigger -Settings $settings -RunLevel Highest

Registry Operations

PowerShell treats the registry as a drive — you can navigate and modify it with the same verbs used for files:

# Read a value
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion" -Name ProgramFilesDir

# Set a DWORD to disable a feature
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
    -Name "HideFileExt" -Value 0 -Type DWord

# Export a key subtree for backup before editing
reg export "HKCU\Software\MyApp" C:\Backups\myapp_reg_$(Get-Date -f yyyyMMdd).reg

Always export the key before modifying it in production. Registry mistakes can prevent Windows from booting — treat it with the same respect you would a production database.