PowerShell Basics for Windows Server Administration

PowerShell is how Windows Server is administered from the command line — the counterpart of bash over SSH on Linux. This guide covers the commands a Windows VPS administrator uses most: checking the system, managing services and processes, the firewall, users, roles, logs and scheduled tasks, and keeping Remote Desktop secure.

Windows PowerShell or PowerShell 7?

Windows Server includes Windows PowerShell 5.1 (powershell.exe). PowerShell 7 (pwsh.exe) is the newer, cross-platform version and installs alongside it. Everything below works in both, except where noted. Check your version with $PSVersionTable.PSVersion.

Run as Administrator

Right-click Start and choose Terminal (Admin) or Windows PowerShell (Admin). Most commands that change the system fail with “Access is denied” in a normal window.

System, Disk, Memory and CPU

Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, CsNumberOfLogicalProcessors, OsTotalVisibleMemorySize
Get-Volume | Select-Object DriveLetter, SizeRemaining, Size
Get-Counter '\Processor(_Total)\% Processor Time','\Memory\Available MBytes'
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPU, WS

Services

Get-Service | Where-Object Status -eq Running
Get-Service -Name W3SVC
Restart-Service -Name W3SVC
Set-Service -Name Spooler -StartupType Disabled   # stop a service you do not need from starting

Processes

Get-Process -Name notepad
Stop-Process -Name notepad -Force
Get-CimInstance Win32_Process -Filter "Name='node.exe'" | Select-Object ProcessId, CommandLine

Firewall

Get-NetFirewallRule -Enabled True -Direction Inbound | Select-Object DisplayName, Action
New-NetFirewallRule -DisplayName "Allow HTTPS" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow
New-NetFirewallRule -DisplayName "RDP from office" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 198.51.100.20 -Action Allow

The last rule is worth copying: limiting Remote Desktop to the addresses you connect from removes most brute-force attempts.

Users

Get-LocalUser
$pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name deploy -Password $pw -PasswordNeverExpires
Add-LocalGroupMember -Group "Remote Desktop Users" -Member deploy
Add-LocalGroupMember -Group "Administrators" -Member deploy   # only if they really need it

Roles and Features

Get-WindowsFeature | Where-Object Installed
Install-WindowsFeature -Name Web-Server -IncludeManagementTools
Uninstall-WindowsFeature -Name Web-Server

Networking

Get-NetIPAddress -AddressFamily IPv4
Test-NetConnection example.com -Port 443
Get-NetTCPConnection -State Listen | Sort-Object LocalPort | Select-Object LocalAddress, LocalPort, OwningProcess
Resolve-DnsName example.com

Event Logs

Use Get-WinEvent; the older Get-EventLog does not exist in PowerShell 7.

Get-WinEvent -LogName System -MaxEvents 20
# failed sign-ins (Event ID 4625) in the last 24 hours
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='FromIP';e={$_.Properties[19].Value}}

Hundreds of 4625 events from unfamiliar addresses mean Remote Desktop is being brute-forced — restrict it in the firewall and enable account lockout.

Windows Updates

Install-Module PSWindowsUpdate -Scope CurrentUser
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

PSWindowsUpdate is a community module from the PowerShell Gallery. Without it, use Settings → Windows Update, or sconfig on Server Core.

Scheduled Tasks (the Windows Cron)

$action  = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -File C:\Scripts\backup.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At 2am
Register-ScheduledTask -TaskName "Daily Backup" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest
Get-ScheduledTask -TaskName "Daily Backup" | Get-ScheduledTaskInfo

Running Scripts

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
.\myscript.ps1
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\myscript.ps1   # one-off, without changing policy

A script downloaded from the internet is blocked under RemoteSigned until you unblock it: Unblock-File .\myscript.ps1.

Restarting

Restart-Computer -Force
shutdown /r /t 300 /c "Maintenance reboot in 5 minutes"

Help That Matches Your System

Update-Help
Get-Help Get-Service -Examples
Get-Command *firewall*

Common Problems

“Running scripts is disabled on this system” — set the execution policy as above.

“Access is denied” — the window is not elevated; reopen it as Administrator.

“The term 'Get-EventLog' is not recognized” — you are in PowerShell 7; use Get-WinEvent.

Locked out after a firewall change — open a ticket; always add your own address to a new RDP rule before removing the old one.

Running Windows on a VPS

Windows Server needs at least 2 GB of memory, and is happier with more if you run IIS, SQL Server or several RDP sessions. Every Windows VPS comes with full Administrator access and a dedicated IPv4 address; RDP VPS explains what you get over Remote Desktop.

Continue Reading

• How to Configure Windows Firewall on a Windows VPS
• How to Create a New Administrator User on Windows Server
• How to Install Windows Updates on a Windows VPS
• Linux VPS vs Windows VPS

Browse more articles in Windows Server Administration.