PowerShell for IT Admins: 50+ Essential One-Liners & Scripts
Liladhar Sapkota•February 15, 2026
Getting Started with PowerShell
Execution Policy
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Install Modules
Install-Module -Name ActiveDirectory -Force
Active Directory One-Liners
| Task | PowerShell Command |
|---|---|
| Get all users | Get-ADUser -Filter * -Properties LastLogonDate,Department | Select Name,SamAccountName,Enabled,LastLogonDate,Department |
| Get disabled users | Get-ADUser -Filter {Enabled -eq $false} -Properties LastLogonDate | Select Name,SamAccountName,LastLogonDate |
| Create new user | New-ADUser -Name "John Smith" -SamAccountName "jsmith" -UserPrincipalName "jsmith@domain.com" -GivenName "John" -Surname "Smith" -Enabled $true -AccountPassword (ConvertTo-SecureString "TempP@ss123" -AsPlainText -Force) |
| Disable user | Disable-ADAccount -Identity "jsmith" |
| Unlock user account | Unlock-ADAccount -Identity "jsmith" |
| Get user group memberships | Get-ADUser -Identity "jsmith" -Properties MemberOf | Select -ExpandProperty MemberOf |
| Add user to group | Add-ADGroupMember -Identity "VPN Users" -Members "jsmith" |
| Get all groups | Get-ADGroup -Filter * | Select Name,GroupCategory |
| Get computers in AD | Get-ADComputer -Filter * -Properties OperatingSystem,LastLogonDate | Select Name,OperatingSystem,LastLogonDate |
| Find inactive computers (90 days) | Get-ADComputer -Filter {LastLogonTimeStamp -lt (Get-Date).AddDays(-90)} -Properties LastLogonTimeStamp |
Microsoft 365 (Graph) One-Liners
First, connect to Microsoft Graph:
Connect-MgGraph -Scopes "User.Read.All","Group.Read.All","User.ReadWrite.All"
| Task | PowerShell Command |
|---|---|
| Get all users | Get-MgUser -All | Select DisplayName,UserPrincipalName,Department |
| Get user by UPN | Get-MgUser -UserId "user@domain.com" | Select DisplayName,UserPrincipalName,Department |
| Create new user | New-MgUser -DisplayName "John Smith" -UserPrincipalName "jsmith@domain.com" -MailNickname "jsmith" -PasswordProfile @{Password = "TempP@ss123"; ForceChangePasswordNextSignIn = $true} -AccountEnabled $true |
| Disable user (block sign-in) | Update-MgUser -UserId "jsmith@domain.com" -AccountEnabled:$false |
| Get all groups | Get-MgGroup -All | Select DisplayName,Description |
| Get group members | Get-MgGroupMember -GroupId "group-id" | Select DisplayName,UserPrincipalName |
| Add user to group | New-MgGroupMember -GroupId "group-id" -DirectoryObjectId "user-id" |
| Get user's licenses | Get-MgUserLicenseDetail -UserId "jsmith@domain.com" | Select SkuPartNumber |
| Assign license to user | Set-MgUserLicense -UserId "jsmith@domain.com" -AddLicenses @(@{SkuId = "sku-id-here"}) -RemoveLicenses @() |
File Server & NTFS Permissions
| Task | PowerShell Command |
|---|---|
| Get folder size | Get-ChildItem "C:\Shares" -Recurse | Measure-Object -Property Length -Sum | Select @{Name="SizeGB";Expression={[math]::Round($_.Sum/1GB,2)}} |
| Find files older than 30 days | Get-ChildItem "C:\Shares" -Recurse | Where LastWriteTime -lt (Get-Date).AddDays(-30) |
| Get folder permissions | Get-Acl "C:\Shares" | Format-List |
| Add folder permission | $acl = Get-Acl "C:\Shares"; $access = New-Object System.Security.AccessControl.FileSystemAccessRule("DOMAIN\Group","Read","Allow"); $acl.SetAccessRule($access); Set-Acl "C:\Shares" $acl |
| Create network share | New-SmbShare -Name "ShareName" -Path "C:\Shares\Folder" -FullAccess "DOMAIN\Group" |
CSV Processing & Bulk Operations
| Task | PowerShell Command |
|---|---|
| Import CSV | $users = Import-Csv "C:\users.csv" |
| Export to CSV | Get-ADUser -Filter * | Select Name,SamAccountName | Export-Csv "C:\users.csv" -NoTypeInformation |
| Loop through CSV rows | $users = Import-Csv "C:\users.csv"; foreach ($user in $users) { Get-ADUser -Identity $user.SamAccountName } |
| Bulk create users from CSV | Import-Csv "C:\newusers.csv" | ForEach-Object { New-ADUser -Name $_.Name -SamAccountName $_.SamAccountName -UserPrincipalName $_.UPN -GivenName $_.FirstName -Surname $_.LastName -Enabled $true -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) } |
Error Handling & Best Practices
Try/Catch
try {
Get-ADUser -Identity "nonexistent" -ErrorAction Stop
Write-Host "User found"
}
catch {
Write-Warning "User not found: $_"
}
WhatIf (Preview changes)
# Shows what would happen without executing Disable-ADAccount -Identity "jsmith" -WhatIf # Force execution after review Disable-ADAccount -Identity "jsmith" -Confirm:$false