Top PowerShell Commands for Windows Server Sysadmins

List every service and filter by state:

Get-Service | Where-Object Status -eq 'Running'
Get-Service | Where-Object Status -eq 'Stopped' | Where-Object StartType -eq 'Automatic'

The second line shows services that should be running but are stopped — one of the most useful diagnostics after a troubled boot.

Start, stop, or restart a service:

Start-Service -Name "Spooler"
Stop-Service -Name "Spooler" -Force
Restart-Service -Name "W3SVC" -Force

The -Force flag also takes down dependent services. To check dependencies first, use Get-Service -Name "W3SVC" -DependentServices.

List processes consuming the most CPU or memory:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 | Format-Table Name, Id, @{N='RAM(MB)';E={[math]::Round($_.WorkingSet/1MB,1)}}

The second command formats the WorkingSet column (resident memory) in rounded MB, avoiding the need to read raw bytes.

Kill a stuck process by PID or name:

Stop-Process -Id 4528 -Force
Stop-Process -Name "notepad" -Force

Local account management:

New-LocalUser -Name "operator" -Password (Read-Host -AsSecureString "Password") -FullName "NOC Operator"
Add-LocalGroupMember -Group "Administrators" -Member "operator"
Get-LocalUser | Where-Object Enabled -eq $true
Disable-LocalUser -Name "former-employee"

Read-Host -AsSecureString prevents the password from appearing in history or transcripts.

Common Active Directory operations:

Import-Module ActiveDirectory

Get-ADUser -Filter "Enabled -eq \$true" -Properties LastLogonDate | Sort LastLogonDate
Get-ADUser -Filter "PasswordLastSet -lt (Get-Date).AddDays(-90)" -Properties PasswordLastSet
Unlock-ADAccount -Identity "jsmith"
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (Read-Host -AsSecureString)

The first filter identifies active users by last logon date — useful for cleaning up orphaned accounts. The second lists who has had a password unchanged for over 90 days.

List the 50 most recent errors from the system log:

Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 50 |
  Format-Table TimeCreated, Id, ProviderName, Message -AutoSize -Wrap

Level=2 is Error, Level=3 is Warning, Level=4 is Information. Always prefer hashtable over Get-WinEvent -LogName System | Where Level -eq 2.

Find logon failures (event 4625) in the last 24 hours:

Get-WinEvent -FilterHashtable @{
  LogName   = 'Security'
  Id        = 4625
  StartTime = (Get-Date).AddDays(-1)
} | Select-Object TimeCreated, @{N='Account';E={$_.Properties[5].Value}}, @{N='IP';E={$_.Properties[19].Value}}

Indexed properties depend on the event — for 4625, index 5 is the attempted account name and index 19 is the source IP.

Export a log to an .evtx file for offline analysis:

wevtutil epl Security C:\backup\security-2026-05-29.evtx
wevtutil cl Security

The second line clears the log after the backup. On servers with aggressive auditing, this rotation prevents the log from filling up and silently dropping records.

Interface and routing inspection:

Get-NetIPAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, IPAddress, PrefixLength
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric | Select -First 10
Get-DnsClientServerAddress -AddressFamily IPv4

To change the IP, use New-NetIPAddress combined with Remove-NetIPAddress on the old address in the same session — doing this through the GUI during RDP silently drops your connection.

Test connectivity and ports with Test-NetConnection:

Test-NetConnection -ComputerName "8.8.8.8" -Port 443
Test-NetConnection -ComputerName "dc.domain.local" -Port 389 -InformationLevel Detailed

This is the direct replacement for ping + telnet. The -Detailed flag shows latency, route, and DNS resolution in the same output.

List active TCP connections (netstat replacement):

Get-NetTCPConnection -State Established |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
                @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}}

Cross-referencing OwningProcess with Get-Process is the kind of operation that netstat does not do natively without -b and elevated privilege.

Find large or recent files:

Get-ChildItem C:\ -Recurse -ErrorAction SilentlyContinue |
  Where-Object Length -gt 500MB |
  Sort-Object Length -Descending |
  Select-Object FullName, @{N='SizeGB';E={[math]::Round($_.Length/1GB,2)}} -First 20

-ErrorAction SilentlyContinue ignores protected folders (System Volume Information, $Recycle.Bin) without flooding the terminal with errors.

Compress a folder for backup with a checksum:

Compress-Archive -Path C:\inetpub\wwwroot -DestinationPath D:\backup\web-2026-05-29.zip -CompressionLevel Optimal
Get-FileHash D:\backup\web-2026-05-29.zip -Algorithm SHA256

The SHA-256 hash confirms integrity when the file is transferred to remote storage.