PowerShell 4: Running Commands

2026-09-20 · powershell, class-notes

Many people avoid PowerShell because they think it means "programming". But most day-to-day PowerShell is simply typing commands and pressing Enter, just as you would in CMD or Bash. A script is only a text file of…

Class notes · Learn PowerShell in a Month of Lunches (Jeffery Hicks et al.) · Chapter 4

Quick reference: the short version of this chapter is the Chapter 4 cheat sheet.

Learning objectives

By the end of these notes you should be able to:

1. Explain why running commands interactively is not the same as scripting — and why that matters for learning.
2. Break a command into its parts: command name, parameters, values and switches.
3. Use the Verb-Noun naming convention to predict and find command names.
4. Distinguish cmdlets, functions, aliases and external applications.
5. Use and create aliases, and explain how they behave differently on Linux and macOS.
6. Shorten commands with truncated parameter names, parameter aliases and positional parameters — and know when not to.
7. Run external commands, and read PowerShell error messages to fix mistakes.
8. Explain execution policy, and what it does and doesn't protect against.

1. Running commands, not scripting

Many people avoid PowerShell because they think it means "programming". But most day-to-day PowerShell is simply typing commands and pressing Enter, just as you would in CMD or Bash. A script is only a text file of commands you've already learned to run interactively.

That's why the book spends so long at the prompt before it reaches scripting: if you can run a command, you can later automate it.

2. The anatomy of a command

Get-ChildItem -Path C:\Logs -Filter *.log -Recurse \___________/ \___/ \_____/ \_____/ \___/ \______/ command name value name value switch \___________/ \____________/ parameter parameter

Part

Rules

Command name

Usually a cmdlet in Verb-Noun form. Not case-sensitive

Parameter name

Always begins with a dash: -Path

Value

Follows the parameter name after a space. Use quotes if it contains spaces: -Path "C:\My Files"

Switch

A parameter with no value. Its presence turns it on: -Recurse

Multiple values

Separate with commas: -Name notepad, calc

Note: a space goes between the parameter name and its value (-Path C:\Logs), and there's no space inside the name. - Path and -Path:C:\Logs are common beginner confusions. (The colon form is legal but rarely needed; stick to a space.)

3. The cmdlet naming convention

3.1 Verb-Noun

Cmdlets (pronounced "command-lets") are PowerShell's native commands. They're named Verb-Noun:

• The verb says what to do: Get, Set, New, Remove, Start, Stop.
• The noun says what to do it to, and is singular: Process, Service, Item.
• Module authors often add a prefix to the noun to avoid clashes: Get-ADUser (Active Directory), Get-MgUser (Microsoft Graph).

3.2 Approved verbs

Microsoft publishes a list of approved verbs, so the same verb means the same thing everywhere:

Get-Verb \

100 approved verbs in PowerShell 7.4

Get-Verb -Verb Stop \

Stop Lifecycle

Verb

Means

Example

Get

Retrieve information; changes nothing

Get-Process

Set

Change something that exists

Set-Location

New

Create something

New-Item

Remove

Delete something

Remove-Item

Start / Stop

Begin / end an operation or process

Start-Service

3.3 Worked example — guessing command names

Because naming is consistent, you can often guess a command before looking it up.

You want to

Guess

Check

See the running services

Get-Service

Get-Command Get-Service (Windows)

Create a folder

New-Item

help New-Item -Examples

Delete a file

Remove-Item

Remove-Item -Path x.txt -WhatIf

See your current location

Get-Location

Run it

List every command for "Item"

—

Get-Command -Noun Item

Get verbs are safe to explore — they only read. The other verbs change things, so read their help first.

4. Kinds of command

Get-Command reports a CommandType:

Type

What it is

Example

Cmdlet

Compiled .NET command built into PowerShell or a module

Get-ChildItem

Function

A command written in PowerShell itself

help is a function

Alias

A nickname for another command

gci → Get-ChildItem

Application

An external program (an .exe or native binary)

ping, ipconfig, ssh

Get-Command Get-ChildItem, help, gci | Select-Object Name, CommandType

5. Aliases

5.1 Nicknames for commands

An alias is a short or familiar name for a command. Many exist to make CMD and Bash users feel at home:

Alias

Runs

Familiar from

dir, gci

Get-ChildItem

CMD, PowerShell shorthand

cd

Set-Location

CMD and Bash

cls

Clear-Host

CMD

gps

Get-Process

PowerShell shorthand

ls, cat, ps

Get-ChildItem, Get-Content, Get-Process

Bash — Windows only (see 5.3)

Get-Alias gci \

what does this alias run?

Get-Alias -Definition Get-ChildItem \

what aliases exist for this command?

5.2 Creating aliases

New-Alias -Name np -Value notepad \

np now starts Notepad- Aliases point to a command only — they can't include parameters. For that you need a function (covered later).

• Aliases you create last only for the current session, unless added to your profile script.

5.3 Aliases and cross-platform PowerShell

On Linux and macOS, PowerShell 7 doesn't define aliases that clash with real native commands: ls, cat, ps, cp, mv, rm, man and others.

Typed on Linux

What runs

ls

The native Linux ls — text output, Linux options like -la

Get-ChildItem or gci

The PowerShell cmdlet — objects

dir

Still an alias for Get-ChildItem

This trips people up when moving scripts between systems.

Caution: in scripts and anything you share, use full command names. Aliases save typing at the prompt but make scripts harder to read — and, as above, they don't behave the same on every platform.

6. Taking shortcuts

6.1 Truncated parameter names

You only need to type enough of a parameter name to make it unique for that command:

Get-ChildItem -Pa C:\Logs -Fi *.log \

-Pa = -Path, -Fi = -FilterIf the prefix matches more than one parameter, PowerShell tells you:

Parameter cannot be processed because the parameter name 'F' is ambiguous. Possible matches include: -Filter -Force.

6.2 Parameter aliases

Some parameters have alternative names. Get-Process -Id also answers to -PID. Find them in help (the Aliases field) or with:

(Get-Command Get-Process).Parameters['Id'].Aliases \

PID

6.3 Positional parameters

Positional parameters can be given without their names, in order (chapter 3):

Get-ChildItem C:\Logs *.log \

Path, then Filter

6.4 Worked example — full form to shortcut, and back

Stage

Command

Full, as you'd write in a script

Get-ChildItem -Path C:\Logs -Filter *.log -Recurse

Alias for the command

gci -Path C:\Logs -Filter *.log -Recurse

Positional parameters

gci C:\Logs *.log -Recurse

Truncated switch

gci C:\Logs *.log -r

The last line is quick to type but hard to read. Rule of thumb: use shortcuts at the prompt; write the full form in scripts, documentation, tickets and your blog.

7. External commands

PowerShell runs ordinary programs too:

ping 8.8.8.8 ipconfig /all ssh andrew@server01

Key differences from cmdlets:

• External commands return text, not objects. You can't sort or filter their output by property the way you can with cmdlet output (a big theme of later chapters).
• PowerShell parses the line first. Characters that are special to PowerShell — such as @, $, ; or { } — can change the arguments an external program receives. When arguments get mangled, the stop-parsing token --% passes the rest of the line as-is (mainly useful on Windows):

icacls C:\Data --% /grant Users:(OI)(CI)

R

8. Dealing with errors

PowerShell's error messages are usually specific and helpful — the red text is information, not a failure. Read the first line carefully.

8.1 Worked example — decoding common errors

Error message (first line)

Cause

Fix

The term 'Get-Proces' is not recognized as a name of a cmdlet, function, script file, or executable program.

Typo in the command name, or the command doesn't exist here

Use Tab completion; check with Get-Command

A parameter cannot be found that matches parameter name 'Nme'.

Misspelled or non-existent parameter

Check the syntax with Get-Command -Syntax

Parameter cannot be processed because the parameter name 'F' is ambiguous.

Truncated name matches more than one parameter

Type more of the name

Cannot find path '/nope' because it does not exist.

Wrong path

Check spelling, case (on Linux) and current location

Cannot process command because of one or more missing mandatory parameters: Id.

A required value was left out

Supply it — interactively, PowerShell prompts you for it

8.2 Missing mandatory parameters

If you run a command without a mandatory parameter in an interactive session, PowerShell prompts for the value rather than failing:

PS> Stop-Process cmdlet Stop-Process at command pipeline position 1 Supply values for the following parameters: Id[0]:Id[0] means it's asking for the first value of an array. Press Enter on an empty line to finish, or Ctrl+C to cancel.

9. Execution policy

9.1 What it is

Execution policy controls whether PowerShell will run script files (.ps1). It doesn't affect typing commands at the prompt.

Policy

Allows

Restricted

No scripts at all — the default on Windows client editions

AllSigned

Only scripts signed by a trusted publisher

RemoteSigned

Local scripts run; scripts downloaded from the internet must be signed. The default on Windows Server

Unrestricted

All scripts run; downloaded scripts trigger a warning

Bypass

Nothing is blocked and nothing warns

Get-ExecutionPolicy Get-ExecutionPolicy -List \

the policy at each scope

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

On Linux and macOS, execution policy isn't enforced: Get-ExecutionPolicy returns Unrestricted, and it can't be changed.

9.2 What it isn't

Microsoft is explicit that execution policy is not a security boundary. It's a safety feature to stop users running scripts by accident. Anyone can bypass it — by starting PowerShell with -ExecutionPolicy Bypass, or by pasting a script's contents into the console. Real protection comes from application control (such as AppLocker or WDAC), logging and least privilege.

10. Security perspective

• Attackers use the same shortcuts — plus aliases, truncated parameters and encoding — to obfuscate commands. Knowing how iex, iwr or -enc expand is part of reading suspicious PowerShell in logs:
  • iex → Invoke-Expression
  • iwr → Invoke-WebRequest
  • -enc → -EncodedCommand
• -ExecutionPolicy Bypass in a process command line is a classic red flag in endpoint logs, because legitimate admin work rarely needs it.
• External commands are part of the attack surface. Built-in Windows programs (certutil, bitsadmin, mshta and others) are often run from PowerShell by attackers. Knowing that PowerShell happily runs them is part of understanding "living off the land".
• Test before changing. Combine the habits from chapter 3: a Get- command first to see what's there; -WhatIf before the change; full command names in anything saved.

Summary

• Most PowerShell is running commands. Scripts are just saved commands.
• Anatomy: command, -Parameter value, switches (no value), commas for multiple values, quotes for spaces.
• Cmdlets use Verb-Noun with approved verbs (Get-Verb) and singular nouns, sometimes with a module prefix. Get commands only read.
• Command types: cmdlet, function, alias, application — Get-Command shows which.
• Aliases (Get-Alias, New-Alias) are nicknames without parameters, lasting for the session only. On Linux and macOS, ls, cat, ps and similar run native programs. Use full names in scripts.
• Shortcuts: truncated parameter names (must be unique), parameter aliases, positional parameters. Fine at the prompt; avoid in scripts.
• External programs return text; --% stops PowerShell parsing the rest of the line.
• Errors: read the first line — they name the problem. Missing mandatory values trigger a prompt.
• Execution policy governs script files — Restricted on Windows clients, RemoteSigned on servers, Unrestricted off Windows — and is not a security boundary.

Glossary

Term

Definition

Cmdlet

A compiled PowerShell command named Verb-Noun

Parameter

A named input to a command, written with a leading dash

Value

The data given to a parameter

Switch parameter

A parameter with no value, turned on by its presence

Verb-Noun

The naming convention for PowerShell commands

Approved verbs

Microsoft's standard list of verbs, shown by Get-Verb

Noun prefix

A module-specific prefix on a noun, e.g. AD in Get-ADUser

CommandType

Cmdlet, Function, Alias or Application

Alias

A nickname for a command

Parameter alias

An alternative name for a parameter, e.g. -PID for -Id

Truncated parameter

A shortened parameter name that is still unique

Positional parameter

A parameter whose name can be omitted

External command / application

A program outside PowerShell, such as ping

Stop-parsing token (--%)

Tells PowerShell to pass the rest of the line unchanged

Mandatory parameter prompt

PowerShell asking for a required value that was omitted

Execution policy

A setting controlling whether script files may run

RemoteSigned

Policy requiring downloaded scripts to be signed

Profile

A script that runs when PowerShell starts, used to keep aliases and settings

Review questions

1. Label the parts of: Get-ChildItem -Path "C:\My Files" -Recurse.
2. Why do values containing spaces need quotes?
3. What does the verb in a cmdlet name tell you? Which verb is always safe to explore with?
4. Why do some nouns have prefixes, such as Get-ADUser?
5. Name the four CommandTypes you'll commonly see.
6. Can an alias include parameters? What would you use instead?
7. What happens when you type ls -la in PowerShell 7 on Linux? And on Windows?
8. Get-ChildItem -F *.log fails. Why, and how do you fix it?
9. Rewrite gci C:\Temp *.txt -r in full form.
10. What's the main difference between the output of ipconfig and of Get-NetIPConfiguration?
11. Read this error: A parameter cannot be found that matches parameter name 'Nmae'. What's wrong?
12. What's the default execution policy on Windows 11, on Windows Server, and on Linux?
13. Is execution policy a security boundary? Explain.
14. Why is -ExecutionPolicy Bypass in a process command line worth investigating?

Answer key

1. Get-ChildItem is the command; -Path a parameter with the value "C:\My Files"; -Recurse a switch.
2. Otherwise PowerShell treats the space as a separator, so C:\My and Files become separate arguments.
3. The action the command takes. Get only retrieves information, so it's safe to explore with.
4. To avoid name clashes between modules — the prefix identifies the product (AD = Active Directory).
5. Cmdlet, Function, Alias, Application.
6. No. Use a function (covered later) to wrap a command with parameters.
7. On Linux, ls is the native Linux program, so -la works as in Bash. On Windows, ls is an alias for Get-ChildItem, which errors because it has no -la parameter.
8. -F is ambiguous (it matches -Filter and -Force). Type more of the name, e.g. -Fi or -Filter.
9. Get-ChildItem -Path C:\Temp -Filter *.txt -Recurse.
10. ipconfig returns plain text; Get-NetIPConfiguration returns objects with properties you can filter and sort.
11. The parameter name is misspelled — it should be -Name.
12. Restricted on Windows 11 (client); RemoteSigned on Windows Server; Unrestricted on Linux, where it can't be changed.
13. No. It prevents accidental script execution but is easily bypassed. Real protection needs application control, logging and least privilege.
14. Legitimate use is rare, and attackers commonly add it to run scripts without restriction — so it's a common indicator of suspicious activity.