PowerShell basics for Windows Server admins

Start DC01, sign in and open Windows PowerShell as administrator. Your exact lists will differ a little from the examples, but the shape will be the same.

1Find commands by guessing their names

Run this:

Get-Command -Verb Get -Noun *Service*

You should see something like this (the list may be longer):

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Get-NetFirewallServiceFilter                       2.0.0.0    NetSecurity
Cmdlet          Get-Service                                        3.1.0.0    Microsoft.PowerShell.Management

You guessed the verb (Get) and part of the noun (Service), and PowerShell found the commands. Try Get-Command -Noun *DnsClient* or Get-Command *TimeZone* the same way.

✅ Checkpoint: Get-Service appears in your list.

2Get help with real examples

Run these (the first one downloads help and takes a minute):

Update-Help -ErrorAction SilentlyContinue
Get-Help Get-Service -Examples

You’ll see numbered examples with an explanation under each. Help works for every cmdlet, and Get-Help about_Pipelines explains concepts. -ErrorAction SilentlyContinue hides the warnings for the few modules whose help can’t be downloaded.

✅ Checkpoint: Get-Help shows several examples for Get-Service.

3Look inside an object

Run this:

Get-Service -Name Spooler | Get-Member -MemberType Property

You should see something like this:

   TypeName: System.ServiceProcess.ServiceController

Name                MemberType Definition
----                ---------- ----------
CanPauseAndContinue Property   bool CanPauseAndContinue {get;}
CanShutdown         Property   bool CanShutdown {get;}
CanStop             Property   bool CanStop {get;}
Container           Property   System.ComponentModel.IContainer Container {get;}
DependentServices   Property   System.ServiceProcess.ServiceController[] DependentServices {get;}
DisplayName         Property   string DisplayName {get;set;}
MachineName         Property   string MachineName {get;set;}
ServiceHandle       Property   System.Runtime.InteropServices.SafeHandle ServiceHandle {get;}
ServiceName         Property   string ServiceName {get;set;}
ServicesDependedOn  Property   System.ServiceProcess.ServiceController[] ServicesDependedOn {get;}
ServiceType         Property   System.ServiceProcess.ServiceType ServiceType {get;}
Site                Property   System.ComponentModel.ISite Site {get;set;}
StartType           Property   System.ServiceProcess.ServiceStartMode StartType {get;}
Status              Property   System.ServiceProcess.ServiceControllerStatus Status {get;}

Normally Get-Service shows only Status, Name and DisplayName. The object has much more, including StartType and DependentServices, the services that stop if this one stops. Whenever you wonder “what can I filter on?”, pipe it to Get-Member.

✅ Checkpoint: You can see StartType and Status in the property list.

4Filter, sort and select

Find services set to start automatically that are not running:

Get-Service |
    Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' } |
    Sort-Object Name |
    Select-Object Name, Status, StartType

You should see something like this:

Name        Status StartType
----        ------ ---------
edgeupdate Stopped Automatic
sppsvc     Stopped Automatic

$_ means “the object currently passing through”. This is a real admin check: automatic services that aren’t running are the first thing to look at when a server “isn’t working”. Some, like the update services above, are set to start automatically and then stop by design, so read the list rather than restarting everything.

✅ Checkpoint: You got a short list of automatic services that are stopped.

5Count and measure

Run these one at a time:

(Get-Service | Where-Object Status -eq 'Running').Count
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 3 Name, @{n='MemMB';e={[math]::Round($_.WorkingSet/1MB)}}

You should see something like this:

112

Name          MemMB
----          -----
MsMpEng         212
ServerManager   189
svchost         104

The first line counts running services. The second shows the three processes using the most memory, with a calculated column in MB. You’ll use both patterns in Lesson 47 when a server is slow.

✅ Checkpoint: You can see the number of running services and the top three memory users.

6Export to CSV and read it back

Run this:

New-Item -ItemType Directory -Path C:\Lab -Force | Out-Null
Get-Service | Select-Object Name, Status, StartType | Export-Csv C:\Lab\services.csv -NoTypeInformation
Import-Csv C:\Lab\services.csv | Select-Object -First 3

You should see something like this:

Name                Status  StartType
----                ------  ---------
AppIDSvc            Stopped Manual
Appinfo             Running Manual
AppMgmt             Stopped Manual

The CSV opens in Excel, and Import-Csv turns it back into objects. This is how you hand a list to a manager, or compare a server today with the same list from last month.

✅ Checkpoint: C:\Lab\services.csv exists and Import-Csv shows the first three services.

7Write and run a small script

Create the script:

notepad C:\Lab\check.ps1

Paste this into Notepad, save and close:

# check.ps1: a quick health summary for this server
$os = Get-CimInstance Win32_OperatingSystem
$stopped = Get-Service | Where-Object { $_.StartType -eq 'Automatic' -and $_.Status -ne 'Running' }
"Server:          $env:COMPUTERNAME"
"Uptime (hours):  {0:N1}" -f ((Get-Date) - $os.LastBootUpTime).TotalHours
"Free C: (GB):    {0:N1}" -f ((Get-Volume -DriveLetter C).SizeRemaining / 1GB)
"Auto but stopped: $($stopped.Count)"

Run it:

C:\Lab\check.ps1

You should see something like this:

Server:          DC01
Uptime (hours):  1.4
Free C: (GB):    44.8
Auto but stopped: 2

Four lines that sum up a server, in a file you can run anywhere. -f is the format operator: {0:N1} means “first value, one decimal place”. In Lesson 27 you’ll run scripts like this on many servers at once.

✅ Checkpoint: Your script prints the server name, uptime, free space and the count of stopped automatic services.