Windows 11 PowerShell Diagnostics Cheat Sheet

Sidebar

Operating Systems · Windows 11 PowerShell Diagnostics Cheat Sheet

Read-only PowerShell one-liners for finding out what a Windows 11 PC is, what it is running and what has been going wrong. Every command here ran as a normal user (no administrator rights) on the PC this was written on (Windows 11 Pro, build 26300, Windows PowerShell 5.1) unless a line says otherwise; the commands that need administrator rights are marked. Nothing here changes a setting.

Who Is This PC?

Get-ComputerInfo -Property OsName,OsBuildNumber,CsProcessors,BiosVersionOS, build, processor and BIOS (slow, but one call; drop -Property for everything)

systeminfoClassic summary: OS, install date, boot time, RAM, hotfixes, network cards

Get-CimInstance Win32_ComputerSystemManufacturer, model, RAM, domain/workgroup

Get-CimInstance Win32_BIOSBIOS vendor, version and date

Get-CimInstance Win32_ProcessorCPU name, cores, logical processors, max clock

Get-CimInstance Win32_OperatingSystemBuild, install date, last boot, memory fields

Uptime, Boot and Admin Check

(Get-CimInstance Win32_OperatingSystem).LastBootUpTimeWhen it last started

(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTimeTime since then

([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole('Administrator')True if this window has administrator rights (it was False here)

Fast StartupA shutdown with Fast Startup on is partly a hibernate, so uptime can span shutdowns; restart rather than shut down to get a clean boot

Memory

Get-CimInstance Win32_PhysicalMemoryEach module: capacity, rated Speed, ConfiguredClockSpeed, part number

Get-Counter '\Memory\Available MBytes'Available RAM (see the Memory Troubleshooting sheet)

Get-CimInstance Win32_PageFileUsagePage file size and peak

Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10 Name, Id, WorkingSet64Top processes by RAM

Disks and Volumes

Get-DiskDisks: number, name, size, partition style, health

Get-PhysicalDiskMedia type (SSD/HDD), HealthStatus, OperationalStatus. Healthy can coexist with thousands of logged errors: check the event log too

Get-VolumeDrive letters, file system, size and free space

Get-PhysicalDisk | Get-StorageReliabilityCounterTemperature, wear, error totals: returned nothing here without administrator rights

chkdsk D:Read-only check (no /f); may need administrator rights; not run here

Processes, Services and Startup

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, Id, CPUBusiest by total CPU seconds

Get-Process | Sort-Object Handles -Descending | Select-Object -First 5 Name, Id, HandlesMost handles

Get-Service | Where-Object Status -eq 'Running'Running services (144 here)

Get-CimInstance Win32_Service | Where-Object State -eq 'Running' | Select-Object Name, PathNameServices with the program each runs: spot unfamiliar ones

Get-CimInstance Win32_StartupCommand | Select-Object Name, LocationPrograms that start at sign-in

Get-ScheduledTask | Where-Object State -ne 'Disabled'Scheduled tasks that are enabled (181 here)

Network

Get-NetAdapterAdapters: name, description, status, link speed. Here: only Ethernet is Up; Wi-Fi and four VPN adapters are Disconnected

Get-NetIPConfigurationIP addresses, gateway and DNS per interface

ipconfig /allThe classic equivalent

Test-NetConnection example.com -Port 443Can this PC reach a host and port (makes a network request; not run here)

Get-NetTCPConnection -State EstablishedCurrent connections (add -OwningProcess to link to programs; not run here)

Updates, Devices and Security

Get-HotFix | Sort-Object InstalledOn -DescendingInstalled updates with dates (reads only some update types: the full history is on the Drivers & Updates sheet)

Get-PnpDevice -PresentOnly | Where-Object Status -ne 'OK'Devices with a problem (none here)

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdatedMicrosoft Defender state. It reports Defender only, not other antivirus products

Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProductAntivirus products Windows knows about (client Windows only; not run here)

Events (the Short Versions)

Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=(Get-Date).AddHours(-24)}Critical and Error events in the last 24 hours

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=41}Unexpected restarts

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='disk'} | Group-Object IdHow many of each disk event

MoreThe Event Viewer sheet has the event IDs that matter; the Crash Triage sheet the first ten minutes

Habits That Prevent Trouble

-ErrorAction SilentlyContinueHide errors from a command you expect to fail on some items (e.g. access denied)

| Format-List *See every property of an object, to find the one you need

| Get-MemberList an object's properties and methods

| Out-File -Encoding utf8 file.txtSave output readably (Windows PowerShell 5.1 defaults to other encodings for some redirects)

Get-Help <cmd> -ExamplesExamples for any cmdlet

Read-only firstPrefer Get-* while investigating. Anything with Set-, Remove-, Stop- or Disable- changes the PC: note the undo first

Read-only does not mean harmless to read

These commands change nothing, but their output can include names, serial numbers, addresses and the programs you run. Check it before pasting into a forum or a support ticket.

Some answers need administrator rights

When a command returns nothing or Access denied, that is not the same as no problem found. The Crash Triage sheet shows what to copy from an administrator prompt.