CyberStack

Guides / PowerShell is the admin surface

Windows commands

Files, ACLs, archives, and processes from PowerShell first. A few cmd.exe verbs remain common. Execution policy is a guardrail, not a suggestion to switch off.

Windows commands: files, ACL, processPowerShell is the primary admin surface on modern Windows. Files, ACLs, and processes share the same pipeline habits.ACLRUNITEMFilesGet-ChildItemDACLACLGet-Acl · icaclsPIDProcessGet-ProcessPOWERSHELL IS THE ADMIN SURFACEVerb-Noun for files and ACLs. Stop-Process when you mean it. Policy stays on.Unrestricted is not a convenience switch. Groups own the ACL, not Everyone.

Windows admin at a keyboard is mostly PowerShell. Verb-Noun cmdlets are discoverable, pipeable, and scriptable. cmd.exe still appears in older docs and muscle memory — dir and cd work — but prefer the PowerShell forms below when you are writing something that will be shared or repeated.

First principles

PowerShell objects travel down the pipeline, not just text. Get-ChildItem returns items you can filter; Format-* is for display at the end. Paths may be case-insensitive on NTFS, but do not rely on that in scripts you might port. Execution policy controls which scripts run; RemoteSigned is a common workstation default. Unrestricted for convenience is how unsigned scripts become routine.

Navigate and move files

Get-Location
Set-Location C:\Logs
Get-ChildItem -Force
Copy-Item .\src .\dest -Recurse
Move-Item .\old.txt .\new.txt
Remove-Item .\file.txt
Get-Content .\notes.txt -Tail 50
Get-PSDrive

Aliases exist: ls, cd, cat, pwd map to these cmdlets. In scripts, write the full names. Get-PSDrive shows drives and providers — useful when a letter is missing or a PSDrive is a network share. cmd.exe still uses dir, cd, copy, move, del, type; fine interactively, weaker for structured output.

Permissions (ACL)

Get-Acl .\file.txt | Format-List
(Get-Acl .\file.txt).Access
icacls .\folder
icacls .\folder /grant DOMAIN\User:(OI)(CI)M

Get-Acl / Set-Acl are the PowerShell objects. icacls remains the common CLI for inheritance-aware grants and inheritance repair. Prefer a named group over a personal account on shared folders. Do not grant Everyone Full Control to clear an error.

Archives

Compress-Archive -Path .\folder -DestinationPath .\bundle.zip
Expand-Archive -Path .\bundle.zip -DestinationPath .\out

Compress-Archive cannot set a password. For a password wrap, use 7-Zip AES as in the password-protected zip guide. Expand-Archive is for simple zip trees.

Processes

Get-Process
Get-Process | Sort-Object CPU -Descending | Select-Object -First 15
Stop-Process -Id 1234
Stop-Process -Name notepad -WhatIf

Stop-Process ends the process. -WhatIf shows what would happen. Task Manager and Resource Monitor are the GUI peers; the cmdlets above are what you put in a script.

Execution policy and the Terminal

Get-ExecutionPolicy -List
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
# Win+X then Windows Terminal, or:
wt.exe

Do not set Unrestricted machine-wide to make one script run. Prefer RemoteSigned for CurrentUser, or unblock a single downloaded script with Unblock-File. Windows Terminal (Win+X on current builds) is the preferred host over legacy consoles when it is installed.

House rules

  • Write full cmdlet names in shared scripts. Aliases are for interactive typing.
  • Do not Set-ExecutionPolicy Unrestricted casually. Scope the change and prefer RemoteSigned.
  • ACL changes belong to groups and inheritance you can explain. Everyone:Full is a failure mode.
  • Remove-Item -Recurse deletes for real. Confirm the path. Recycle Bin is Explorer behaviour, not the default for every CLI delete.

Informed by Microsoft Learn — PowerShell.