PowerShell automation for Windows Server admins

Start DC01, DC02 and SRV01. Work on DC01 as SAATLAB\adm.rahul (or Administrator) in PowerShell as administrator.

1Run one command on every server

On DC01, run this:

$servers = 'DC01','DC02','SRV01'
Test-WSMan SRV01 | Select-Object ProductVersion
Invoke-Command -ComputerName $servers -ScriptBlock {
    Get-CimInstance Win32_OperatingSystem | Select-Object Caption, LastBootUpTime
} | Select-Object PSComputerName, Caption, LastBootUpTime

You should see something like this:

ProductVersion
--------------
OS: 0.0.0 SP: 0.0 Stack: 3.0

PSComputerName Caption                                             LastBootUpTime
-------------- -------                                             --------------
DC01           Microsoft Windows Server 2025 Datacenter Evaluation 19/10/2026 14:02:11
SRV01          Microsoft Windows Server 2025 Datacenter Evaluation 19/10/2026 16:41:37
DC02           Microsoft Windows Server 2025 Datacenter Evaluation 19/10/2026 14:05:52

Results come back in whatever order servers answer, because they run in parallel. Test-WSMan answering proves WinRM is listening on SRV01.

✅ Checkpoint: All three servers return their OS and last boot time in one table.

2Reuse connections with sessions

On DC01:

$s = New-PSSession -ComputerName $servers
Invoke-Command -Session $s -ScriptBlock { Get-Service W32Time, Netlogon -ErrorAction SilentlyContinue | Select-Object Name, Status } |
    Sort-Object PSComputerName | Format-Table PSComputerName, Name, Status -AutoSize
Remove-PSSession $s

You should see something like this:

PSComputerName Name     Status
-------------- ----     ------
DC01           Netlogon Running
DC01           W32Time  Running
DC02           Netlogon Running
DC02           W32Time  Running
SRV01          Netlogon Running
SRV01          W32Time  Running

Sessions save the connection setup time when you send many commands, and they keep variables between calls. Always remove them when you’re done.

✅ Checkpoint: Netlogon and W32Time are Running on all three servers.

3Write Get-ServerReport.ps1

On DC01, create C:\Scripts\Get-ServerReport.ps1 with this content (in Notepad or VS Code):

[CmdletBinding()]
param(
    [Parameter(Mandatory)][string[]]$ComputerName,
    [string]$OutFile = "C:\Scripts\ServerReport-$(Get-Date -Format yyyyMMdd).csv"
)
$results = foreach ($c in $ComputerName) {
    try {
        Invoke-Command -ComputerName $c -ErrorAction Stop -ScriptBlock {
            $os  = Get-CimInstance Win32_OperatingSystem
            $cv  = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
            $disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"
            $lic = Get-CimInstance SoftwareLicensingProduct -Filter "Name LIKE 'Windows%' AND PartialProductKey IS NOT NULL"
            [pscustomobject]@{
                Build      = "$($cv.CurrentBuild).$($cv.UBR)"
                UptimeDays = [math]::Round(((Get-Date) - $os.LastBootUpTime).TotalDays, 1)
                CFreePct   = [math]::Round($disk.FreeSpace / $disk.Size * 100)
                Reboot     = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
                EvalDays   = [math]::Round($lic.GracePeriodRemaining / 1440)
                Status     = 'OK'
            }
        } | Select-Object @{n='Computer';e={$_.PSComputerName}}, Build, UptimeDays, CFreePct, Reboot, EvalDays, Status
    }
    catch {
        Write-Warning "$c : $($_.Exception.Message)"
        [pscustomobject]@{ Computer = $c; Build = $null; UptimeDays = $null; CFreePct = $null; Reboot = $null; EvalDays = $null; Status = 'Unreachable' }
    }
}
$results | Export-Csv $OutFile -NoTypeInformation
$results

Each server is wrapped in try/catch with -ErrorAction Stop, so a dead server becomes a row saying “Unreachable” instead of stopping the whole report. It brings together checks from earlier lessons: the build from Lesson 24, the evaluation days from Lesson 4, pending reboot from Lesson 24.

Run it, including a server that doesn’t exist:

New-Item -ItemType Directory C:\Scripts -Force | Out-Null
C:\Scripts\Get-ServerReport.ps1 -ComputerName DC01, DC02, SRV01, SRV99 | Format-Table -AutoSize

You should see something like this:

WARNING: SRV99 : WinRM cannot process the request. ... The specified computer name is not valid or ...

Computer Build      UptimeDays CFreePct Reboot EvalDays Status
-------- -----      ---------- -------- ------ -------- ------
DC01     26100.NNNN        0.3       71 False       172 OK
DC02     26100.NNNN        0.3       78 False       173 OK
SRV01    26100.NNNN        0.1       64 False       174 OK
SRV99                                                   Unreachable

✅ Checkpoint: The report lists the three real servers with Status OK, SRV99 as Unreachable, and a CSV in C:\Scripts.

4Schedule the nightly GPO backup

On DC01, register a task that runs as SYSTEM every night at 01:30:

$action  = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-NoProfile -Command "Backup-GPO -All -Path C:\GPOBackups | Out-Null"'
$trigger = New-ScheduledTaskTrigger -Daily -At 01:30
Register-ScheduledTask -TaskName 'Nightly GPO backup' -Action $action -Trigger $trigger -User 'SYSTEM' -RunLevel Highest | Out-Null
Start-ScheduledTask -TaskName 'Nightly GPO backup'
Start-Sleep -Seconds 20
Get-ScheduledTaskInfo -TaskName 'Nightly GPO backup' | Select-Object LastRunTime, LastTaskResult, NextRunTime

You should see something like this:

LastRunTime         LastTaskResult NextRunTime
-----------         -------------- -----------
19/10/2026 21:04:10              0 20/10/2026 01:30:00

LastTaskResult 0 means success. On a DC, SYSTEM acts as the DC’s computer account, which can read every GPO. For tasks that reach other servers, use a gMSA allowed on the task’s server, with only the rights the task needs, never a person’s account.

✅ Checkpoint: The task ran once with result 0 and is scheduled for 01:30.

5Keep a folder in place with DSC

On SRV01, define and apply a tiny configuration:

Configuration ServerBasics {
    Node 'localhost' {
        File ScriptsFolder {
            DestinationPath = 'C:\Scripts'
            Type            = 'Directory'
            Ensure          = 'Present'
        }
    }
}
ServerBasics -OutputPath C:\DSC\ServerBasics | Out-Null
Start-DscConfiguration -Path C:\DSC\ServerBasics -Wait -Force
Test-DscConfiguration

You should see this:

True

Delete C:\Scripts on SRV01 and run Test-DscConfiguration again: it says False. Start-DscConfiguration -UseExisting -Wait puts it back. Real configurations describe features, services, registry values and files, and are applied the same way.

✅ Checkpoint: Test-DscConfiguration returns True, then False after deleting the folder, then True after re-applying.