PowerShell for Systems Engineers

Just some quick points about me:

• 20 Years of IT Experience

• Author of PowerShell for Systems Engineers: Leveraging Automation and ChatGPT to Solve Business Problems

• Former Amazon Engineer

• Current K12 Director of Technology

• I have a Master of Science in Information Systems & Technology Management

• PowerShell presenter at Michigan Association of Educational Data Systems (MAEDS) 2019, 2022, 2023

  
  

Too often we approach PowerShell with the question, “What can PowerShell do?” Perhaps a better question is, “What value can PowerShell create?” PowerShell can certainly do a myriad of things natively and through the thousands of modules from both Microsoft and third parties. But knowing that PowerShell can do these things is not enough to create value. That is why I hope for this book to not just be a reference for PowerShell, but rather, a roadmap to thinking about what PowerShell can do for your systems, network, and identity management.

PowerShell can check if a service is running. Could you automate a check on a really critical service every five minutes that emails you if it is not running? PowerShell can audit for users with administrative privileges - local or domain. Could you automate a daily report to run this audit? These are examples of how we can take what PowerShell can do and leverage it for value.

My approach to learning PowerShell is a little different than some other authors’ approaches. In devising the book, I have changed the chapter order, examples, and a lot more to make a cohesive deep dive into PowerShell automation that can be used in any organization.

PowerShell can be leveraged for value no matter what our role is. I have worked as a technician, systems administrator, and now a director in various technical departments and have used or written PowerShell scripts in each of these roles. Though the title says this book is for systems engineers, it is really for anyone who is looking to learn more about PowerShell. As anyone who works in technology can tell you, we all seem to have very diverse backgrounds. Some of us have gone to college, served in the military, or started our careers in different fields. No matter what your background is, PowerShell is for you.

If you have a Windows PC, you already have it and an amazing PowerShell ISE editor. It is my recommended language to learn for new programmers and software engineers because of its simplicity and ubiquity. If you are already familiar with my work, you may have seen the video I made with my nine-year-old daughter where I taught her how to use PowerShell to perform arithmetic operations and write her first script. For her, it was as easy as a little guidance when opening an application already installed on Play Room PC, the PC I wrote most of this book on. It’s this accessibility that makes me so passionate about PowerShell.

PowerShell is an automation and configuration engine. It is also both a command shell (or, command line interface) and a scripting language made by Microsoft. It is packaged with any modern version of Windows and is available for both macOS and Linux through PowerShell Core. PowerShell can be used to automate server provisioning, user creation, perform data calculations, and much more.

PowerShell was originally called Monad and was developed by its chief architect, Jeffrey Snover. He published a white paper in August 2002 called, “Monad Manifesto,” where he expressed the need for a Unix-like management console for Windows. Because of the fundamental incompatibilities of Unix and Windows systems architecturally, a straight port of Unix tools was not possible.

Beta versions of Monad were demoed in 2003 and by 2006 Microsoft had renamed it Windows PowerShell. From then until 2016, Windows PowerShell was a proprietary software owned and developed by Microsoft based on the .NET Framework. In 2016, Microsoft announced that PowerShell would be open-source and cross-platform, with the source code being published on GitHub. The open-source iteration of PowerShell was named “PowerShell Core,” which runs on .NET Core.

To open PowerShell on a Windows operating system, follow these steps:

1. Press the Windows key or click on the Start button in the bottom-left corner of the screen. This will open the Start menu.

2. Type "PowerShell" in the search bar. As you type, search results will appear.

3. In the search results, you should see "Windows PowerShell" listed. It may be labeled as an "App" or "Desktop App".

4. Click on "Windows PowerShell" to open it. A new window will appear with a blue background and a command prompt.

Alternatively, you can open PowerShell using the "Run" dialog:

1. Press the Windows key + R to open the "Run" dialog box.

2. Type "powershell" (without quotes) in the input field and press Enter or click "OK".

3. PowerShell should now open in a new window.

To run PowerShell as an administrator on a Windows operating system, follow these steps:

1. Press the Windows key or click on the Start button in the bottom-left corner of the screen. This will open the Start menu.

2. Type "PowerShell" in the search bar. As you type, search results will appear.

3. In the search results, you should see "Windows PowerShell" listed. It may be labeled as an "App" or "Desktop App".

4. Right-click on "Windows PowerShell" in the search results.

5. In the context menu that appears, click on "Run as administrator". You may be prompted to confirm your action or provide administrator credentials.

6. After confirmation, a new PowerShell window with administrative privileges will open. The window will have a blue background and a command prompt.

Alternatively, you can run PowerShell as an administrator using the "Run" dialog:

1. Press the Windows key + R to open the "Run" dialog box.

2. Type "powershell" (without quotes) in the input field.

3. Press CTRL + SHIFT + ENTER instead of just pressing Enter or clicking "OK". This will run the command with administrative privileges.

4. You may be prompted to confirm your action or provide administrator credentials. After confirmation, a new PowerShell window with administrative privileges will open.

PowerShell is a more powerful, flexible, and modern command-line interface and scripting environment compared to the classic Command Prompt. It offers more advanced features, better extensibility, and object-oriented scripting, making it the preferred choice for administrators and developers working with Windows systems.

PowerShell is backward compatible with most Command Prompt commands, meaning you can run Command Prompt commands within PowerShell. However, the reverse is not true, as you cannot run PowerShell cmdlets in the Command Prompt.

To set the PowerShell execution policy to unrestricted, follow these steps:

1. Open PowerShell as an administrator. You can do this by searching for PowerShell in the Start menu, right-clicking on Windows PowerShell, and selecting "Run as administrator."

2. Once PowerShell is open, type the following command:

   Set-ExecutionPolicy Unrestricted

3. Press Enter to run the command.

4. You will be prompted to confirm that you want to change the execution policy. Type Y and press Enter.

5. The execution policy will be changed to unrestricted, which means that any script can be run on the system without any restrictions.

Note: Setting the execution policy to unrestricted can be a security risk, as it allows any script to run on the system. It is recommended to set the execution policy to a more restricted level, such as RemoteSigned, when not required.

Tab completion is a feature in PowerShell that allows you to easily complete a command, parameter, or file path by pressing the "Tab" key on your keyboard.

For example, if you want to run the Get-Process cmdlet in PowerShell, you can type Get-Pro and then press the "Tab" key. PowerShell will automatically complete the command to Get-Process, assuming there are no other commands starting with "Get-Pro".

Tab completion is not limited to commands only. It can also be used for parameters and file paths. For instance, if you want to use the Get-ChildItem cmdlet to list the files in the C:\Windows directory, you can type Get-ChildItem C:\Win and then press the "Tab" key. PowerShell will complete the file path to C:\Windows.

Tab completion can save you a lot of time and effort when working with PowerShell. It can help you avoid typos and syntax errors by suggesting the correct command, parameter, or file path. Additionally, it can help you discover new commands that you may not have known about by showing you all available options.

PowerShell maintains a history of all the commands that you have executed in a session. The command history is stored in a buffer and can be accessed using the up and down arrow keys on your keyboard. This makes it easy to recall and re-run previously executed commands.

To access the command history in PowerShell, simply open a PowerShell session and execute some commands. Then, press the up arrow key on your keyboard to recall the last command that you executed. Press the up arrow key again to recall the second-to-last command, and so on. Press the down arrow key to move forward through the command history.

In addition to using the arrow keys, you can also use the Get-History cmdlet to display the entire command history. This cmdlet lists all of the commands that have been executed in the current session, along with a unique ID number for each command. You can then use the Invoke-History cmdlet to execute a specific command from the history by specifying its ID number.

Another useful feature of the PowerShell command history is the ability to search through it for specific commands. You can use the Get-History cmdlet along with the Select-String cmdlet to search the command history for a particular command or keyword. For example, to search for all commands that include the word "process", you could use the following command:

Get-History | Select-String -Pattern "process"

PowerShell ISE (Integrated Scripting Environment) is an integrated development environment (IDE) for PowerShell that allows you to create and edit PowerShell scripts. I love it because it is included with Windows entirely for free and works really well. Here are the steps to create a PowerShell script with PowerShell ISE:

1. Open PowerShell ISE by searching for it in the Start menu.

2. In the PowerShell ISE window, select "File" > "New" to create a new script.

3. Type your PowerShell commands into the script editor. You can use the PowerShell syntax to write your commands.

4. Save the script by selecting "File" > "Save As". Choose a location for the script file, give it a descriptive name, and make sure to save it with the .ps1 file extension (e.g., MyScript.ps1).

5. To run the script, open a PowerShell console and navigate to the directory where the script is located. Then, type the name of the script file (including the .ps1 file extension) and press Enter. Alternatively, you can use the "Run" button in the PowerShell ISE window to run the script.

You can also launch PowerShell ISE by simply typing ISE in an open PowerShell console.

PowerShell cmdlets are small, specialized commands that are used in PowerShell to perform specific tasks. Cmdlets are the primary way that PowerShell interacts with the Windows operating system and other software applications.

Cmdlets are designed to follow a consistent naming convention, with verbs and nouns separated by a hyphen (-). The verb indicates the action that the cmdlet performs (e.g., Get, Set, New, Remove, etc.), while the noun indicates the resource that the cmdlet acts upon (e.g., Process, Service, File, etc.).

Cmdlets are easy to use in PowerShell. You can simply type the name of the cmdlet followed by any required parameters, and press Enter to execute the cmdlet. For example, to list all of the processes running on your system, you can use the Get-Process cmdlet by typing Get-Process in PowerShell and pressing Enter.

Cmdlets are also highly flexible, with many options and parameters available to customize their behavior. This allows you to perform complex tasks with just a few cmdlets, instead of writing long, complex scripts.

In addition to the built-in cmdlets that come with PowerShell, you can also create your own custom cmdlets using PowerShell's scripting language. This allows you to extend the functionality of PowerShell and create your own specialized commands for performing specific tasks.

In PowerShell, splatting is a technique that allows you to pass a collection of named parameters to a command or function using a hashtable or a dictionary, instead of passing each parameter one-by-one on the command line.

To use splatting, you first create a hashtable with the parameter names and their corresponding values. For example:

$params = @{

Path = 'C:\Users\JohnDoe\Documents'

Recurse = $true

Include = '*.txt'

}

In this example, the hashtable contains three keys (Path, Recurse, and Include) and their corresponding values ('C:\Users\JohnDoe\Documents', $true, and '*.txt', respectively).

You can then use the splatting operator (@) to pass the hashtable to a command or function that accepts the same parameter names. For example:

Get-ChildItem @params

This is equivalent to running the command:

Get-ChildItem -Path 'C:\Users\JohnDoe\Documents' -Recurse $true -Include '*.txt'

Using splatting can make your code more readable and easier to maintain, especially when you need to pass a large number of parameters to a command or function. It can also make it easier to reuse and modify your code, since you can simply modify the hashtable instead of having to change each individual parameter.

In PowerShell, a module is a collection of functions, cmdlets, variables, and other resources that are packaged together for easy distribution, sharing, and reuse. A module can be thought of as a mini PowerShell environment that encapsulates a specific set of functionality.

PowerShell modules are typically stored in folders with a specific structure that includes a module manifest file (*.psd1) and one or more PowerShell script files (*.psm1). The manifest file contains metadata about the module, such as its name, version, author, and description, as well as a list of the functions, cmdlets, and other resources included in the module.

To use a PowerShell module, you first need to import it into your PowerShell session using the Import-Module cmdlet. Once the module is imported, you can use its functions, cmdlets, and other resources just like you would with any other PowerShell command. For example, if you had a module named MyModule that included a function called Get-MyData, you could use the function like this:

Import-Module MyModule

Get-MyData

PowerShell modules are a powerful way to organize and share PowerShell code, and they can make it easier to reuse code across different projects and teams. You can even publish your modules to the PowerShell Gallery, a public repository of PowerShell modules that can be easily installed and used by others.

The PowerShell pipeline is a mechanism that allows you to pass the output of one command as input to another command in a seamless and efficient manner. It enables you to string together multiple commands to perform complex operations without the need for temporary variables or intermediate steps.

To use the pipeline, you simply place a vertical bar (|) between two commands. The output of the first command is automatically sent down the pipeline to the input of the second command, which can then process the data further. This can be repeated with as many commands as needed, allowing you to build complex operations quickly and easily.

For example, let's say you want to retrieve a list of all the running processes on your system, filter the list to show only the ones that are using more than 50% of the CPU, and then sort the list by the amount of CPU usage. You can accomplish this with the following pipeline:

Get-Process | Where-Object { $_.CPU -gt 50 } | Sort-Object CPU -Descending

This pipeline consists of three commands separated by vertical bars:

• Get-Process retrieves a list of all the running processes on the system.

• Where-Object filters the list to show only the processes where the CPU usage is greater than 50%.

• Sort-Object sorts the filtered list by the CPU usage in descending order.

Each command in the pipeline processes the data passed to it by the previous command and then passes the output down the pipeline to the next command. The final result is a sorted list of processes with CPU usage greater than 50%.

The PowerShell pipeline is a powerful and flexible tool that can greatly simplify complex operations and automate repetitive tasks. It allows you to chain together commands in a natural and intuitive way, and it can help you streamline your workflow and improve your productivity.

$PSItem (or its alias $_) is an automatic variable in PowerShell that represents the current object in the pipeline. It is used to reference the object that is currently being processed by a cmdlet or function in a pipeline.

When you use a pipeline to pass data from one cmdlet or function to another, each object in the pipeline is processed by the cmdlets or functions in turn. $PSItem allows you to reference the current object at any point in the pipeline.

For example, let's say you want to retrieve a list of all the files in a folder and then display the file name and length for each file. You can accomplish this using the Get-ChildItem and ForEach-Object cmdlets, and referencing the current object with $PSItem:

Get-ChildItem C:\Temp | ForEach-Object {

    Write-Output "$($PSItem.Name): $($PSItem.Length) bytes"

}

In this example, the Get-ChildItem cmdlet retrieves a list of all the files in the C:\Temp folder and passes them down the pipeline to the ForEach-Object cmdlet. The ForEach-Object cmdlet processes each file in turn, and uses $PSItem to reference the current file. The Write-Output cmdlet then displays the file name and length for each file.

$PSItem can be used in any cmdlet or function that processes data in a pipeline. It is particularly useful in ForEach-Object loops, where it allows you to reference the current object without the need for a separate variable or parameter.