PowerShell for Windows and network administration

Network diagnostics

The NetTCPIP and NetAdapter modules replace many older tools such as ipconfig, netstat and telnet, and return objects you can filter and export.

Get-NetIPConfiguration                         # addresses, gateway, DNS per adapter
Get-NetAdapter | Where-Object Status -eq 'Up'  # active interfaces and link speed
Test-NetConnection fs01.example.com -Port 445  # TCP port test with ping
Resolve-DnsName intranet.example.com -Type A
Get-NetTCPConnection -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess

Test-NetConnection is especially helpful on a helpdesk call: it tells you whether name resolution, ping and the TCP port each succeed, which narrows down whether the problem is DNS, routing or a firewall.

Logs and services

# Failed logons (event 4625) in the last 24 hours
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625; StartTime = (Get-Date).AddDays(-1) } |
  Select-Object TimeCreated, @{ n = 'Account'; e = { $_.Properties[5].Value } }

# Restart the print spooler only if it has stopped
$svc = Get-Service -Name Spooler
if ($svc.Status -ne 'Running') { Start-Service -Name Spooler -Verbose }

-FilterHashtable filters on the server side, which is far faster than pulling every event and filtering afterwards. Reading the Security log needs an elevated session.

Remoting: one command, many servers

PowerShell remoting runs commands on other machines over WinRM (Windows Remote Management, HTTP 5985 or HTTPS 5986) or, in PowerShell 7, over SSH. Invoke-Command runs a script block on many computers in parallel and returns objects tagged with PSComputerName.

$servers = Get-Content .\servers.txt
$cred    = Get-Credential   # prompt; never hard-code passwords

Invoke-Command -ComputerName $servers -Credential $cred -ScriptBlock {
    Get-CimInstance Win32_OperatingSystem |
      Select-Object Caption, Version, LastBootUpTime
} | Export-Csv .\os-report.csv -NoTypeInformation

# Preview a change before making it
Invoke-Command -ComputerName $servers -Credential $cred -ScriptBlock {
    Get-ChildItem 'C:\Temp' -Filter *.log | Remove-Item -WhatIf
}

Most cmdlets that change things support -WhatIf (show what would happen) and -Confirm (ask first). Run with -WhatIf, read the output, then remove it.

Remoting is powerful, so it is also attractive to attackers who have stolen credentials. Limit who can use it: allow WinRM only from management subnets or jump hosts through the Windows firewall, keep remote access to members of a dedicated admin group, and prefer HTTPS or SSH transport outside a domain. Enable PowerShell script block logging and module logging through Group Policy so your security team can see which commands were run. A common mistake is to use -Credential with a domain admin account for routine checks; a read-only report should run with an account that can only read.

Another frequent problem is the "second hop". When you are connected to server A and try to reach a share on server B from inside the script block, the request usually fails, because your credentials are not passed on by default. Rather than weakening security with broad credential delegation, copy the files from your own session or run the command directly against server B.

Directory and cloud administration

The older MSOnline and AzureAD modules are retired, so new Microsoft 365 scripts should use the Microsoft Graph PowerShell SDK, connecting with Connect-MgGraph -Scopes "User.Read.All" and requesting only the permissions the script needs.

Tip: run admin scripts from a dedicated admin account or privileged access workstation, and use Start-Transcript so there is a record of what the script did.