Managing Windows and the Cloud

Prerequisites: Remoting

PowerShell's real power comes from the modules for the platforms you manage. The patterns are the same everywhere: Get- to find, Where-Object to filter, Set-/New-/Remove- to change, -WhatIf first.

Windows: CIM

CIM (the successor to WMI) exposes hardware and OS information:

# illustrative
Get-CimInstance Win32_OperatingSystem |
  Select-Object Caption, LastBootUpTime,
    @{ n = 'FreeMemoryGB'; e = { [math]::Round($_.FreePhysicalMemory / 1MB, 1) } }

Get-CimInstance Win32_LogicalDisk -Filter 'DriveType = 3' -ComputerName web01, web02 |
  Select-Object PSComputerName, DeviceID,
    @{ n = 'FreePct'; e = { [math]::Round($_.FreeSpace / $_.Size * 100) } }

Active Directory

# illustrative
Import-Module ActiveDirectory
Get-ADUser -Filter 'Enabled -eq $true' -Properties LastLogonDate |
  Where-Object LastLogonDate -lt (Get-Date).AddDays(-90) |
  Select-Object SamAccountName, LastLogonDate

New-ADUser -Name 'Ada Lovelace' -SamAccountName alovelace -Enabled $true `
  -AccountPassword (Read-Host -AsSecureString 'Password') -WhatIf

Use the -Filter parameter (server-side) instead of getting every user and piping to Where-Object.

Microsoft 365 with Microsoft Graph

# illustrative
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -Filter "department eq 'Sales'" -All | Select-Object DisplayName, Mail

Azure

# illustrative
Install-Module Az -Scope CurrentUser
Connect-AzAccount
Get-AzVM -Status | Where-Object PowerState -eq 'VM running' |
  Select-Object Name, ResourceGroupName, Location

Get-AzResource -TagName 'env' -TagValue 'temp' | Remove-AzResource -WhatIf

AWS Tools for PowerShell (Install-Module AWS.Tools.EC2) follows the same shape: Get-EC2Instance, Stop-EC2Instance.

Patterns that scale

Authenticate non-interactively in automation: service principals, certificates, or managed identities — never a person's password.
Page through large results (-All in Graph) and filter server-side.
Export results with Export-Csv for audits, and always dry-run bulk changes with -WhatIf.