Admin Tasks: Services, Processes, Registry

Services

Get-Service | Where-Object Status -eq 'Running'
Stop-Service -Name 'wuauserv' -Force
Set-Service -Name 'wuauserv' -StartupType Automatic

Processes

Get-Process notepad
Stop-Process -Name notepad -Force
Get-Process | Sort-Object CPU -Descending | Select-Object -First 5

Registry

The registry looks like a drive; verbs work the same:

Get-ItemProperty 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionUninstall*' | Select-Object DisplayName, DisplayVersion | Sort-Object DisplayName

New-ItemProperty, Set-ItemProperty and Remove-ItemProperty manage values.

Events and Logs

Get-WinEvent -LogName System -MaxEvents 20
Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=2; StartTime=(Get-Date).AddDays(-1) }

Requires Admin

Many service/registry writes need an elevated shell. Include a check at script top:

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run as Administrator' }

Key Points

• Objects make service/process info queryable.
• Registry maps to a provider with Item cmdlets.
• Get-WinEvent digs into structured logs.
• Always guard privileged scripts.