PowerShell

Introduction

A beginner might see PowerShell as just another command-line interface. In enterprise environments it's far more than that. PowerShell can create thousands of user accounts, query Active Directory, manage Microsoft Entra ID, investigate Windows computers, collect logs from servers, restart services remotely, call REST APIs, parse JSON, process CSV files, generate reports, administer Exchange Online and Microsoft 365, query Azure resources, perform incident-response investigations, and make bulk changes across hundreds or thousands of systems at once.

For IT Support, Systems Administration, IAM, SOC, Cybersecurity Engineering, Cloud Engineering, Microsoft 365 Administration, Windows Engineering, and DevOps roles alike, PowerShell is an extremely useful skill — and it directly connects nearly everything this course has already covered: APIs (Module 13), authentication and OAuth/JWT (Module 9), Active Directory (Module 4), logs (Module 14), and IAM (Module 10) all show up again here, now as things you can actually script against.

Learning Objectives

By the end of this module (all 6 lessons), you should be able to explain the difference between Windows PowerShell 5.1 and modern PowerShell 7; understand objects, the pipeline, variables, conditionals, loops and functions; process CSV and JSON data for bulk operations; call REST APIs with Invoke-RestMethod and work with Microsoft Graph; administer Active Directory, services, processes and disk space, and use PowerShell remoting; write production-quality automation with error handling, logging, and safe execution practices; and use PowerShell for cybersecurity investigations including file hashing, network connection analysis, and Windows Event Log queries.

1🖥️ What Is PowerShell?

PowerShell is both a command-line shell and a scripting/automation language, originally built by Microsoft for Windows administration. Two families matter today.

Don't assume "PowerShell 7 exists, so every company uses it." A real company might run Windows Server 2012 R2 through 2025, Windows 10/11, Linux servers, Azure workloads, Microsoft 365, Active Directory and Entra ID all at once — and therefore several generations of automation, some depending on Windows PowerShell 5.1, .NET Framework, WMI, old Exchange modules, or vendor-specific snap-ins. Understanding both current and legacy environments matters more than knowing only the newest one.

2🔍 Commands, Cmdlets & Getting Help

PowerShell commands follow a Verb-Noun structure — Get-Service, Get-Process, Get-ChildItem, Restart-Service, New-Item, Remove-Item. The verb describes the action; the noun describes the object. Get-Service means "get information about services."

Don't try to memorise thousands of commands — learn to discover them. Get-Command *Service* finds commands related to services. Get-Help Get-Service gives basic help; Get-Help Get-Service -Detailed gives more; Get-Help Get-Service -Examples gives worked examples. This is a genuinely important professional habit: good engineers don't memorise every command, they know how to find documentation quickly.

3📦 Understanding Objects

This is one of the most important concepts in PowerShell. Traditional shells pass text between commands. PowerShell passes objects. Get-Service doesn't return plain text — it returns service objects with properties like Name, DisplayName, Status, and StartType. Inspect them with Get-Service | Get-Member.

(Get-Service -Name Spooler).Status
# Running

Objects can also have methods, discoverable the same way via Get-Member. This concept becomes especially powerful when working with APIs, JSON, Active Directory, Microsoft Graph, Azure, event logs, processes and services — every one of them, in PowerShell, is just another kind of object with properties you can query and filter directly.

📚 Lessons in This Module

Work through these in order — each builds on ideas from the last. Every lesson has its own "Mark lesson complete" button; your progress across all six is tracked below.