What is PowerShell?

PowerShell is a command-line shell and scripting language developed by Microsoft to automate administrative tasks, manage system configurations, and orchestrate complex workflows. Originally released in 2006 as Windows PowerShell (built on the .NET Framework), it evolved into PowerShell Core and later simply PowerShell (version 6 and beyond), which is open-source and runs cross-platform on Windows, macOS, and Linux via .NET.

Unlike traditional shells such as cmd.exe or Bash that pass plain text between commands, PowerShell passes structured objects. This object-oriented pipeline is what makes PowerShell uniquely powerful for administrators and developers, as it eliminates much of the fragile text-parsing required in older scripting environments.

Why It Matters

PowerShell is a foundational tool for IT professionals, particularly in Windows and hybrid cloud environments. It underpins automation for Active Directory, Microsoft 365, Azure, Exchange, and countless server roles. For certification tracks like CompTIA, Microsoft (MCSA/Azure Administrator), and various security exams, understanding PowerShell fundamentals is essential.

How PowerShell Works

Cmdlets

The core building blocks of PowerShell are cmdlets (pronounced "command-lets"). Cmdlets follow a consistent Verb-Noun naming convention, such as Get-Process, Set-Item, or Stop-Service. This predictable syntax makes commands discoverable and easy to learn.

The Object Pipeline

PowerShell's pipeline (|) passes .NET objects from one cmdlet to the next rather than raw text. For example:

Get-Process | Where-Object {$_.CPU -gt 100} | Sort-Object CPU

Here, process objects are filtered and sorted based on their actual properties, without any text parsing.

Providers

PowerShell exposes data stores such as the file system, registry, and certificate store as navigable drives through providers. You can navigate the registry just like a folder using cd HKLM:\.

Modules

Functionality is packaged into modules that can be imported to extend capabilities. Modules like ActiveDirectory, Az (Azure), and ExchangeOnlineManagement add hundreds of specialized cmdlets. The PowerShell Gallery is the central repository for community and Microsoft modules, installable via Install-Module.

Key Concepts

Variables: Prefixed with $, e.g., $name = "Server01"
Aliases: Short forms of cmdlets, e.g., ls and dir map to Get-ChildItem
Scripts: Saved as .ps1 files for reuse
Functions: Reusable blocks of code within scripts
Execution Policy: A safety feature controlling whether scripts can run (Restricted, RemoteSigned, Unrestricted)

Common Use Cases

System Administration: Managing users, groups, services, and processes across servers.
Cloud Management: Provisioning and controlling Azure or AWS resources through modules like Az or AWS.Tools.
Bulk Operations: Creating hundreds of user accounts in Active Directory from a CSV file.
Configuration Management: Using Desired State Configuration (DSC) to enforce consistent server states.
Reporting: Extracting and formatting system data into HTML, CSV, or JSON reports.
Remoting: Executing commands on remote machines using Invoke-Command and PowerShell Remoting (WS-Management/WinRM).

Best Practices

Use approved verbs: Follow Get-Verb conventions when writing functions for consistency.
Set a sensible execution policy: RemoteSigned is a common balance of security and usability.
Leverage built-in help: Use Get-Help and Get-Command to discover functionality.
Handle errors gracefully: Use try/catch blocks and the -ErrorAction parameter.
Avoid hardcoding credentials: Use Get-Credential or secure secret management like the SecretManagement module.
Comment and modularize: Write reusable functions and document scripts.

Security note: Because PowerShell is so powerful, attackers frequently abuse it in "living off the land" attacks. Enabling script block logging, module logging, and Constrained Language Mode helps defenders detect and limit malicious usage.

Real-World Example

Imagine an administrator who needs to find all stopped services on a server and restart those set to start automatically:

Get-Service | Where-Object {$_.Status -eq 'Stopped' -and $_.StartType -eq 'Automatic'} | Start-Service

This single line demonstrates the object pipeline, filtering, and action in a way that would require far more complex scripting in traditional shells.

Windows PowerShell vs. PowerShell (Core)

Windows PowerShell 5.1 ships with Windows and is built on the full .NET Framework. PowerShell 7+ is the modern, open-source, cross-platform successor built on .NET Core. New development targets PowerShell 7, though many enterprise environments still rely on 5.1 for legacy compatibility.