Advanced PowerShell and CMD Commands

Unlock the full potential of your Windows environment with these powerful and niche commands.

Key Takeaways

Enhanced System Monitoring: Utilize commands that provide deep insights into system performance and security.
Advanced Automation: Automate complex tasks and streamline administrative workflows efficiently.
Robust Network Management: Manage and troubleshoot network configurations with precision using specialized commands.

PowerShell Advanced Commands

1. System Diagnostics and Information Gathering

Get-WmiObject and Get-CimInstance

Retrieve detailed hardware and system information beyond basic configurations.

Get-WmiObject -Class Win32_OperatingSystem -Property TotalVisibleMemorySize, FreePhysicalMemory

This command fetches comprehensive details about the system's memory, aiding in resource management.

Get-Process with Advanced Filtering

Identify processes consuming significant CPU resources across multiple machines.

Invoke-Command -ComputerName Server01, Server02 -ScriptBlock {Get-Process | Where-Object {$_.CPU -gt 100}}

Remote execution of this command helps in monitoring and managing high CPU usage processes effectively.

2. Network and Security Analysis

Get-NetTCPConnection

Display all active TCP connections, essential for network monitoring and security assessments.

Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}

Get-NetFirewallRule

List all enabled inbound firewall rules to ensure network security policies are enforced.

Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True" -and $_.Direction -eq "Inbound"}

3. Advanced File and Registry Manipulation

Get-ChildItem with Recursion and Filtering

Search for large files or specific registry keys across the system efficiently.

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 1GB}

Search Registry for Sensitive Information

Identify potential security vulnerabilities by searching for sensitive data in the registry.

Get-ChildItem -Path HKLM:\SOFTWARE -Recurse | Where-Object {$_.Name -like "*password*"}

4. Complex System Automation

Automate Active Directory User Management

Streamline the management of user accounts within Active Directory.

Get-ADUser -Filter * | Where-Object {$_.Enabled -eq $false} | Remove-ADUser -Confirm:$false

Invoke-Command Across Active Directory

Execute commands on multiple machines within an Active Directory domain simultaneously.

Invoke-Command -ComputerName (Get-ADComputer -Filter *).Name -ScriptBlock {Get-Process}

5. Sophisticated Logging and Monitoring

Export System Event Logs

Capture and export system errors for detailed analysis and auditing.

Get-EventLog -LogName System -EntryType Error | Export-Csv -Path C:\ErrorLog.csv

Detailed Login Attempt Tracking

Monitor and track login attempts to enhance security measures.

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Select-Object TimeCreated, Properties

CMD Advanced Commands

1. Advanced System Information

WMIC for Detailed CPU Specifications

Fetch comprehensive CPU details to evaluate system capabilities.

wmic cpu get name,maxclockspeed,numberofcores

Systeminfo with Specific Filtering

Extract essential OS details quickly for system audits.

systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

2. Network Diagnostics

Netstat for Active Listening Ports

Identify all listening ports along with their associated process IDs for network security.

netstat -ano | findstr LISTENING

Tracert Without DNS Resolution

Trace network routes efficiently by bypassing DNS lookups.

tracert -d www.example.com

3. System Management

SC Query with Extended Information

List all services with detailed status information for effective service management.

sc queryex type= service

WMIC for Comprehensive Disk Analysis

Analyze disk space and volumes comprehensively for storage management.

wmic logicaldisk get deviceid, volumename, size, freespace

4. Security and Forensics

Cipher for Secure Disk Wiping

Securely erase unused disk space to prevent data recovery.

cipher /w:C:\

Net User for Domain Account Listing

Retrieve a list of all domain user accounts, essential for audits.

net user /domain

5. Advanced Scripting and Automation

Dynamic Process ID Extraction

Extract process IDs dynamically for targeted task management.

for /f "tokens=*" %i in ('wmic process where name^="chrome.exe" get processid') do @echo %i

Robocopy for Directory Mirroring

Mirror directories efficiently while replacing outdated files.

robocopy C:\SourceFolder C:\TargetFolder /MIR /NFL /NDL /NJH /NJS

Comparative Analysis of PowerShell and CMD Commands

Category	PowerShell Commands	CMD Commands
System Information	Get-WmiObject, Get-CimInstance	wmic, systeminfo
Network Management	Get-NetTCPConnection, Get-NetFirewallRule	netstat, tracert, netsh
File Manipulation	Get-ChildItem, Move-Item, Remove-Item	robocopy, fsutil, cipher
Active Directory	Get-ADUser, New-ADGroup	net user, net group
Automation	Invoke-Command, Register-ScheduledJob	schtasks, for loops

Conclusion

Mastering advanced PowerShell and CMD commands empowers system administrators and power users to perform complex tasks efficiently, enhance system security, and streamline operations. These niche commands offer deeper insights and greater control over the Windows environment, making them indispensable tools for effective system management and automation.