Skip to content

How to work with PowerShell/CMD and scripts.

Basics

  • ?{} is the same as Where-Object { }
  • $_ is the same as $PSItem and is the variable for the current value in the pipe line.
Get-Process -IncludeUserName | ?{ $_.UserName -notmatch "^DOM\username$|^NT AUTHORITY\\" -and $_.ProcessName -notmatch "^fontdrvhost$|^dwm$|^Idle$|^MsMpEng&|^MsSense$" }

Find cmdlets

Find a cmdlet. gcm is an alias for Get-Command.

Get-Command *Item*
Get-Command -Name *process*
Get-Command -Noun Member
Get-Command -Verb Add
Get-Command Get-Process | Format-List *

Show properties and methods.

Get-Command Get-Process | Get-Member

Find an alias.

alias | findstr gm

Find

Recursively search for a string in the current directory

Source

findstr /S /C:"string" * | more
findstr /S /I /N /P /C:"string" * | more
findstr /S /C:"string" "*.*" | more

Open current directory in Explorer.exe

Powershell

ii .
Invoke-Item .

CMD

explorer .

Copy the output of a command

dir C:\ | clip

Download a file (wget)

Invoke-WebRequest https://... -OutFile C:\file.ext

BITS Source

Start-BitsTransfer -Source "http://server01/servertestdir/testfile1.txt" -Destination "c:\clienttestdir\testfile1.txt"

Diff

In CMD.

FC file1 file2

Show all properties and methods from an object

Get-Service -Name WinDefend | Get-Member
Get-Service -Name WinDefend | gm
Get-Process | Get-Member -MemberType Method
Get-AppPackage | Get-Member -MemberType Property

Use a property

Get-Service -Name WinDefend | Select -Property DisplayName
Get-Service -Name WinDefend | Format-Table -Property DisplayName,Name,Status

Use a method. When you create $s the service is Running, if you want to see if it changed status you have to query it again.

Get-Service -Name Spooler |
$s = Get-Service -Name Spooler
$s.Status
$s.Stop()
Get-Service -Name Spooler
$s.Start()

Use Command Prompt To Reveal Saved WiFi Passwords

Source

netsh wlan show profiles
netsh wlan show profile name=NAME key=clear

Toast notifications

Source

$ErrorActionPreference = "Stop"

$notificationTitle = "Notification: " + [DateTime]::Now.ToShortTimeString()

[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null
$template = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText01)

#Convert to .NET type for XML manipuration
$toastXml = [xml] $template.GetXml()
$toastXml.GetElementsByTagName("text").AppendChild($toastXml.CreateTextNode($notificationTitle)) > $null

#Convert back to WinRT type
$xml = New-Object Windows.Data.Xml.Dom.XmlDocument
$xml.LoadXml($toastXml.OuterXml)

$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
$toast.Tag = "PowerShell"
$toast.Group = "PowerShell"
$toast.ExpirationTime = [DateTimeOffset]::Now.AddMinutes(5)
#$toast.SuppressPopup = $true

$notifier = [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier("PowerShell")
$notifier.Show($toast);

Links