PowerShell basics: cmdlets, objects and the pipeline

PowerShell looks like a terminal, but it behaves differently from bash or cmd.exe. Commands follow a strict naming pattern, their output is structured data rather than lines of text, and the pipeline lets you filter, sort and reshape that data without parsing anything. This article covers the three ideas that make everything else make sense.

There are two PowerShells on a typical Windows machine. Windows PowerShell 5.1 (powershell.exe, blue icon) ships with Windows and no longer gets new features. PowerShell 7 (pwsh.exe, black icon) is the current, cross-platform version that also runs on Linux and macOS. Everything here works in both unless noted.

Cmdlets: Verb-Noun

A cmdlet (pronounced command-let) is always named Verb-Noun: Get-Process, Stop-Service, New-Item, Set-Location. The verbs come from an approved list, so once you know a few you can guess commands you have never seen. Names are not case sensitive.

Get-Process                 # running processes
Get-Service                 # Windows services
Get-ChildItem               # files and folders, like ls or dir
Get-Content .\notes.txt     # read a file, like cat
Get-Date                    # current date and time
Get-Verb                    # the list of approved verbs

Parameters start with a single dash and have full names: Get-ChildItem -Path C:\Users -Recurse. You can shorten a parameter name as long as it stays unambiguous (-Rec), and tab completion fills in both cmdlet and parameter names.

Finding and reading help

Get-Command *service*             # which cmdlets mention 'service'?
Get-Command -Verb Stop            # every Stop-* cmdlet
Get-Help Get-Process              # syntax and description
Get-Help Get-Process -Examples    # worked examples
Get-Help Get-Process -Online      # open the web page
Update-Help                       # download full help text (run once, as administrator)

Familiar names such as ls, dir, cd, cat, pwd and rm work because they are aliases for cmdlets. Get-Alias ls shows what they point to. Aliases are fine at the prompt but spell out the real cmdlet in scripts so others can read them.

Objects, not text

In bash, ps prints text and you cut columns out of it with awk. In PowerShell, Get-Process returns process objects with named properties such as Name, Id and CPU. What you see on screen is just a default view of those objects. To find out what an object really contains, pipe it to Get-Member.

Get-Process | Get-Member               # properties and methods of a process object
(Get-Process)[0].Name                  # one property of the first object
Get-Process | Select-Object Name, Id, CPU
Get-Process | Select-Object -First 3
Get-Process | Format-List *            # every property, one per line

This is why PowerShell output lines up in neat tables and why you rarely need regular expressions to pull a value out of a command’s result.

The pipeline

The | character passes the objects from one cmdlet to the next. The most used stages are Where-Object (filter), Sort-Object (sort), Select-Object (choose properties or take the first few), ForEach-Object (run code per object) and Measure-Object (count or sum). Inside a script block, $_ is the current object.

# The 5 processes using the most CPU
Get-Process | Sort-Object CPU -Descending | Select-Object -First 5 Name, CPU

# Services that are stopped but set to start automatically
Get-Service | Where-Object { $_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic' }

# Total size of the .log files in a folder
Get-ChildItem C:\Logs -Filter *.log -Recurse | Measure-Object -Property Length -Sum

# Do something with each file name
Get-ChildItem *.txt | ForEach-Object { "Found $($_.Name)" }

Comparison operators are words, not symbols: -eq, -ne, -gt, -lt, -like (wildcards), -match (regex), -contains. Because > means redirection, $a > 5 would write to a file called 5, which surprises everyone once.

Variables and strings

$name = 'Ana'
$count = 3
$files = Get-ChildItem                 # a variable can hold a whole collection
"Hello $name, you have $count files"    # double quotes expand variables
'Literal $name'                         # single quotes do not
"First file: $($files[0].Name)"         # $( ) for expressions inside strings
$files.Count

Getting data out

Because the data is already structured, exporting it is one more pipeline stage: Export-Csv writes a spreadsheet-friendly file, ConvertTo-Json produces JSON, and Out-File saves the text view. The reverse cmdlets Import-Csv and ConvertFrom-Json turn files back into objects.

Get-Service | Select-Object Name, Status, StartType | Export-Csv services.csv -NoTypeInformation
Get-Process | Select-Object -First 2 Name, Id | ConvertTo-Json
Import-Csv services.csv | Where-Object Status -eq 'Running'

Where to go next

• Save a sequence of commands in a .ps1 file and run it with .\script.ps1. If Windows refuses, see the entry on execution policy.
• Learn Get-Member well. It answers most “how do I get X out of this” questions.
• Prefer full cmdlet and parameter names in scripts, aliases at the prompt.
• PowerShell 7 runs on Linux and macOS too, so the same scripts can manage mixed environments.

Official documentation

• PowerShell 101 on Microsoft Learn
• One-liners and the pipeline
• Installing PowerShell 7