Class notes · Learn PowerShell in a Month of Lunches (Jeffery Hicks et al.) · Chapter 2

Quick reference: the short version of this chapter is the Chapter 2 cheat sheet.

Learning objectives

By the end of these notes you should be able to:

1. Explain the difference between the PowerShell engine and a host application.
2. Choose between the console, Windows Terminal and Visual Studio Code for a task.
3. Set up VS Code with the PowerShell extension, and run code from it.
4. Configure the console for readability.
5. Use tab completion, predictions and PSReadLine history search to type faster and more accurately.
6. Start PowerShell as administrator when needed, and recognise when you are.
7. Explain the security implications of command history and elevated sessions.

1. Engine and host

PowerShell is two things working together:

• The engine — the part that understands commands, runs them and produces results.
• A host — the application that gives you a window to type into and displays the output.

+——————+ +——————+ +——————+ | Console (pwsh in | | VS Code with | | Windows | | a terminal) | | PowerShell ext. | | PowerShell ISE | +––––+———+ +––––+———+ +––––+———+ | | | +————————+————————+ | +———v–––––+ | PowerShell engine | +––––––––––+Different hosts can behave slightly differently — for example in how they display output or which keyboard shortcuts work. Check which host you’re in:

$Host.Name \

ConsoleHost in a terminal; “Visual Studio Code Host” in VS Code

2. Choosing where to work

2.1 The options

Host

Best for

Notes

Console (pwsh in a terminal)

Running commands interactively — most of this book

Fast, lightweight, available everywhere, including over SSH

Windows Terminal

The modern way to host consoles on Windows

Tabs, split panes, profiles for PowerShell 7, Windows PowerShell, CMD and WSL

Visual Studio Code + PowerShell extension

Writing and debugging scripts

Free, cross-platform; syntax highlighting, IntelliSense, debugger, integrated console

Windows PowerShell ISE

Legacy script editing

Windows PowerShell 5.1 only; no longer developed. Doesn’t support PowerShell 7

Exam tip: “ISE” is the Integrated Scripting Environment. For PowerShell 7, VS Code with the PowerShell extension is Microsoft’s recommended replacement.

2.2 Worked example — making PowerShell 7 the default in Windows Terminal

1. Open Windows Terminal and press Ctrl+, to open Settings.
2. Under Startup → Default profile, choose PowerShell — the PowerShell 7 profile, not “Windows PowerShell”.
3. Save. New windows and tabs now open pwsh.
4. Verify: $PSVersionTable.PSEdition returns Core.

2.3 Worked example — setting up VS Code

1. Install VS Code (winget install –id Microsoft.VisualStudioCode, or from code.visualstudio.com).
2. Open the Extensions view (Ctrl+Shift+X), search for PowerShell and install Microsoft’s extension.
3. Create a file named test.ps1. The .ps1 extension tells VS Code it’s PowerShell.
4. Type: Get-Process | Sort-Object CPU -Descending | Select-Object -First 5
5. Run it:
   • F8 runs the current line or selection in the integrated console.
   • F5 runs the whole script.
6. Watch IntelliSense suggest command and parameter names as you type.

3. Making the console comfortable

A readable console reduces mistakes. In Windows Terminal (Settings → Profiles → PowerShell → Appearance) or your terminal’s preferences:

Setting

Recommendation

Why

Font

A monospaced coding font, such as Cascadia Mono

Distinguishes 0/O, 1/l, and backtick from apostrophe

Font size

Large enough to read without squinting

You’ll spend hours here

Colours

High contrast; keep errors clearly visible

Error messages are information — you need to read them

Window size

Wide enough that output doesn’t wrap

Tables are easier to read

The backtick (`) has special meaning in PowerShell, and in some fonts it’s nearly identical to an apostrophe (’). A good font prevents a class of confusing errors.

4. Typing tips

4.1 Tab completion

Press Tab while typing and PowerShell completes what it can:

You type

Tab completes

Get-Pro

Command names: Get-Process, then other matches on repeated presses

Get-Process -Na

Parameter names: -Name

Get-Process -Name pw

Parameter values, where PowerShell can work them out — here, running process names

Get-ChildItem C:\Pro

Paths: C:\Program Files, and so on

Behaviour differs slightly by platform. On Windows, Tab cycles through matches. On macOS and Linux, PowerShell uses a Bash-like style that completes as far as possible and lists the options. On Windows, Ctrl+Space shows all matches as a menu.

Tab completion is faster, and it also prevents typos: if Tab won’t complete a name, it probably doesn’t exist.

4.2 PSReadLine: history and predictions

PSReadLine is the module that handles line editing in the console. It gives PowerShell modern editing features:

Key

Does

Up / Down

Step through previous commands

Ctrl+R

Search history backwards — type part of an old command

Right arrow

Accept the greyed-out prediction shown after the cursor

F2

Switch predictions between inline and list view

Escape

Clear the current line (on Windows)

Ctrl+C

Cancel the running command, or abandon the line

Predictive IntelliSense: as you type, PSReadLine suggests a completion in grey, based on your history (and installed prediction plugins). Accept it with the Right arrow, or keep typing to ignore it.

4.3 Worked example — finding an old command with Ctrl+R

Yesterday you ran a long command to list the five busiest processes, and you want it again.

1. Press Ctrl+R. The prompt changes to a history search.
2. Type Sort-Object CPU. The most recent matching command appears.
3. Press Ctrl+R again to step to older matches.
4. Press Enter to run it, or an arrow key to edit it first.

4.4 Two kinds of history

Command or file

Contains

Get-History (alias h)

Commands from this session only

PSReadLine history file

Commands from every session, saved to disk

Find the file:

(Get-PSReadLineOption).HistorySavePath \

Windows: …\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

\

Linux/macOS: ~/.local/share/powershell/PSReadLine/ConsoleHost_history.txt

5. Running as administrator

Some tasks — managing services, changing system settings, installing modules for all users — need elevated rights.

Platform

How to elevate

How to tell

Windows

Right-click PowerShell or Terminal → Run as administrator

The window title starts with Administrator:

macOS / Linux

Run the specific command with sudo

You’re prompted for your password

Check elevation on Windows:

([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole( [Security.Principal.WindowsBuiltInRole]::Administrator)

This returns True in an elevated session.

Good practice: open an elevated window for the admin task, then close it. Do day-to-day exploration in a normal window.

6. Cross-platform differences to expect

Area

Windows

Linux / macOS

Path separator

\ (PowerShell also accepts /)

/

Case sensitivity of file names

Not case-sensitive

Case-sensitive

Some aliases (ls, cat, ps)

Point to PowerShell cmdlets

Not defined — they run the native Linux commands

Windows-only cmdlets (Get-Service, event logs)

Available

Not present

Chapter 4 looks at aliases in detail.

7. Security perspective

• History files are evidence — and a liability.
  • The PSReadLine history file keeps commands from every session, in plain text.
  • Investigators read it to reconstruct activity; attackers read it hunting for passwords, server names and credentials typed on the command line.
  • Recent PSReadLine versions try to avoid saving lines containing words like “password”, but don’t rely on that. Never type secrets as command arguments; use Get-Credential or a secret store instead.
• Elevate only when needed. An elevated session magnifies every mistake and every malicious script. Separate admin windows (and separate admin accounts in real organisations) limit the damage.
• Know which host and version you’re in. Security features, logging and module behaviour can differ between Windows PowerShell 5.1 and PowerShell 7, and between hosts. $PSVersionTable and $Host.Name answer this in seconds.
• Record your work. Start-Transcript writes a session’s commands and output to a file (Stop-Transcript ends it). It’s useful for change records and ticket evidence — but transcripts can capture sensitive output, so store them carefully.

Summary

• Engine vs host: the PowerShell engine runs commands; a host (console, VS Code, ISE) provides the window. Check with $Host.Name.
• Where to work:
  • The console, in Windows Terminal, for interactive work.
  • VS Code with the PowerShell extension for scripts (F8 runs a selection, F5 the file).
  • The ISE is legacy and 5.1-only.
• Console setup: a clear monospaced font, readable colours, a wide window.
• Typing: Tab completes commands, parameters, values and paths. PSReadLine adds Ctrl+R history search and grey predictions (Right arrow accepts; F2 switches view).
• History: Get-History covers this session; the PSReadLine file covers all sessions.
• Elevation: “Run as administrator” on Windows (title shows Administrator:); sudo on Linux and macOS.
• Cross-platform: paths and case sensitivity differ, and some aliases and cmdlets don’t exist off Windows.

Glossary

Term

Definition

Engine

The part of PowerShell that interprets and runs commands

Host

The application that presents PowerShell to the user

$Host.Name

Shows which host is running the session

Console host

PowerShell running in a terminal window

Windows Terminal

Microsoft’s modern tabbed terminal application

VS Code

Visual Studio Code — a free, cross-platform code editor

PowerShell extension

The VS Code extension adding PowerShell support

ISE

Integrated Scripting Environment — the legacy editor for Windows PowerShell

.ps1

The file extension for PowerShell scripts

Tab completion

Completing command, parameter, value and path names with Tab

PSReadLine

The module providing console line editing, history and predictions

Predictive IntelliSense

Greyed-out suggestions based on history and plugins

Ctrl+R

Reverse search through command history

Get-History

Lists commands from the current session

Elevated session

A session running with administrator rights

Transcript

A text file recording a session’s commands and output

Review questions

1. What’s the difference between the PowerShell engine and a host?
2. How do you find out which host you’re using?
3. Which editor does Microsoft recommend for writing PowerShell 7 scripts?
4. Can the Windows PowerShell ISE run PowerShell 7 code as PowerShell 7?
5. In VS Code, what do F8 and F5 do?
6. Why does font choice matter in PowerShell specifically?
7. Name three kinds of thing that Tab can complete.
8. How do you search your command history for an earlier command containing “Sort-Object”?
9. What’s the difference between Get-History and the PSReadLine history file?
10. How can you tell a Windows PowerShell window is elevated?
11. Why might ls -la behave differently in PowerShell on Linux than on Windows?
12. Why should you avoid typing passwords as command arguments in PowerShell?

Answer key

1. The engine interprets and runs commands; the host is the application that shows you a window and displays output.
2. $Host.Name.
3. Visual Studio Code with the PowerShell extension.
4. No — the ISE only works with Windows PowerShell 5.1.
5. F8 runs the current line or selection; F5 runs the whole script.
6. Some characters look alike — especially the backtick and apostrophe, which mean different things in PowerShell. A good coding font keeps them distinct.
7. Any three of: command names, parameter names, parameter values, file paths.
8. Press Ctrl+R, type Sort-Object, then press Ctrl+R again for older matches.
9. Get-History shows this session only; the PSReadLine file stores commands from all sessions on disk.
10. The window title begins with “Administrator:”.
11. On Linux, ls isn’t a PowerShell alias, so it runs the native ls program. On Windows, ls is an alias for Get-ChildItem, which doesn’t understand -la.
12. They’re saved in plain text in the PSReadLine history file (and may appear in logs and transcripts), where others could read them.