Author Posts

January 1, 2012 at 12:00 am

by willsteele at 2012-09-01 13:14:38

I have seen good cheat sheets before and find they come in very handy. If I am in a pinch and don't have time to thumb through 2 or 3 books to find that one trick I saw once in a book I read once 3 years ago cheat sheets really help me with syntax, nuggets, etc. I am not trying to replace the ones that are out there, just put all the little syntactical nuggets I need. So, any weird things you have encountered, tips, syntactical oddities, etc, feel free to share. I will see if we can get it to be a PowerShell.org reference and not a Will Steele reference so no one feels like I am ripping off ideas for credit. The powers that be will have to bless that idea though.

So far I have a lot of obvious things. Below are just a few of them.

wildcards
operators
escape characters
custom formats for strings/numbers

Also, if you have never looked at what cheat sheets are out there here is the key list. We may want to put this under the references section:

http://devcheatsheet.com/tag/powershell/
http://www.simple-talk.com/dotnet/.net-tools/down-the-rabbit-hole–a-study-in-powershell-pipelines,-functions,-and-parameters/
http://www.simple-talk.com/dotnet/.net-tools/harnessing-powershells-string-comparison-and-list-filtering-features/
http://blogs.msdn.com/b/powershell/archive/2007/01/25/powershell-cheat-sheet-redux-the-pdf-version.aspx
http://www.microsoft.com/en-us/download/details.aspx?id=7097
http://ramblingcookiemonster.wordpress.com/2012/09/07/powershell-cheat-sheet/

I think will all the great PowerShell minds on this board we should be able to come up with something top notch. Below are my key pieces of the puzzle. If there is someone pretty savvy with presentation, feel free to pull it together. I can whip something up, but, it'll look pretty lame if I am really on my game.

Special Characters
`0 Null
`a Alert bell/beep
`b Backspace
`f Form feed
`n New line
`r Carriage return
`t Horizontal tab
`v Vertical tab
`' Single quote
`" Double quote

Quoting Rules
Quotation marks are used to specify a literal string. You can enclose a string in single quotation marks (') or double quotation marks (").
' – single quotes around a string force it to be a literal string. That means it will not evaluate anything inside of the quotation marks.
" – double quotes around a string force its contents to be evaluated. When processed any variables, expressions nnd subexpressions.
Here strings
A here-string is a single-quoted or double-quoted string in which quotation marks are interpreted literally. A here-string can span multiple lines. All the lines in a here-string are interpreted as strings even though they are not enclosed in quotation marks. Like regular strings, variables are replaced by their values in double-quoted here-strings. In single-quoted here-strings, variables are not replaced by their values.

@' '@ – literal here strings where values will not be evaluated and variables inside the quotation marks are NOT substituted for their values.
@" "@ – here strings for which expressions are evaluated and variable values WILL be placed inside the output text block.

For more information see Get-Help about_Quoting_Rules

String manipulation
Format specifier
Most of these, for the same of example, assumes you are just using the "{0}" -f $arg pattern. There are other ways this formatting can be done and those are explored in other sections.
"{0:X}" – hexadecimal. Example, "{0:X}" -f [int][char]'b'
"{0:-30}" – fixed width fields. Example, "{0,-20}::{1,-5}" -f 1,2
"{0:00000}" – zero-fill with 5 0's. Example, "{0:00000}" -f 1
"{0:D5}" – zero-fill with 5 0'. Example, "{0:D5}" -f 1

.NET String methods
.PadLeft()
.PadRight()
.Substring()
.Trim()

Automatic Variables
$$
$?
$^
$_
$Args
$ConsoleFileName
$Error
$EventArgs
$EventSubscriber
$ExecutionContext
$False
$ForEach
$Home
$Host
$Input
$LastExitCode
$Matches
$MyInvocation
$NestedPromptLevel
$NULL
$PID
$Profile
$PSBoundParameters
$PsCmdlet
$PSCommandPath
$PsCulture
$PSDebugContext
$PsHome
$PSScriptRoot
$PSSenderInfo
$PsUICulture
$PsVersionTable
$Pwd
$ReportErrorShowExceptionClass
$ReportErrorShowInnerException
$ReportErrorShowSource
$ReportErrorShowStackTrace
$Sender
$ShellID
$StackTrace
$This
$True

Operators
Arithemetic

+

*
/
%

Order of operations with operators
1) Parentheses
2) Negation
3) *, /, %
4) +, –

Assignment
=
+=
-=
*=
/=
%=

Comparison
-eq/ceq/ieq
-ne/cne/ine
-gt/cgt/igt
-lt/clt/ilt
-le/cle/ile
-ge/cge/ige

Match
-match
-notmatch
-replace
-like
-notlike
-contains
-notcontains

Bitwise
-bAND
-bOR
-bXOR
-bNOT

Logical
-and
-or
-xor
-not
!

Redirection
>
>>
2>
2>
2>&1

Split/Join
-split
-join

Type
-is
-isnot
-as

Unary
++

Special
$() Expression subparse
@() List subexpression
DATA { } Data evaluation
& Call
[ ] Cast
, comma
. dot sourcing
-f format
@{} hashtable
${} braced variable
[ ] Index
| Pipeline
() Precendence/assignment expression evaluation
. Property dereference
.. Range (for arrays)
{} Scriptblock
: Provider/drive specifier
:: Status (for static members of objects
# Single line comment delimiter
< # #> Multi-line comment delimiter

Boolean evaluations
This list comes from Lee Holmes' Appendix A
$true – True
$false – False
$null – False
nonzero number – True
Zero – False
Nonempty string – True
Empty string – False
Empty array – False
Single-element array – Bool of single element
Multi-element array – True
Hashtable (empty or not) – True

Wildcards
* – Matches 0 or more characters
? – Matches exactly 1 character in the specified position
[a-l] – match a range of characters
[abf] – match a specific set of characters

Language Keywords (and Get-Help reference)
Begin: about_Functions, about_Functions_Advanced
Break: about_Break, about_Trap
Catch: about_Try_Catch_Finally
Continue: about_Continue, about_Trap
Data: about_Data_Sections
Do: about_Do, about_While
Dynamicparam: about_Functions_Advanced_Parameters
Else: about_If
Elseif: about_If
End: about_Functions, about_Functions_Advanced_Method
Exit: Described in this topic.
Filter: about_Functions
Finally: about_Try_Catch_Finally
For: about_For
Foreach: about_Foreach
From: Reserved for future use.
Function: about_Functions, about_Functions_Advanced
If: about_If
In: about_Foreach
Param: about_Functions
Process: about_Functions, about_Functions_Advanced
Return: about_Return
Switch: about_Switch
Throw: about_Throw, about_Functions_Advanced_Methods
Trap: about_Trap, about_Break, about_Try_Catch_Finally
Try: about_Try_Catch_Finally
Until: about_Do
While: about_While, about_Do

Type accelerators
Value types
[int] System.Int32
[int[]] System.Int32[]
[long] System.Int64
[long[]] System.Int64[]
[string] System.String
[string[]] System.String[]
[char] System.Char
[char[]] System.Char[]
[bool] System.Boolean
[bool[]] System.Boolean[]
[byte] System.Byte
[byte[]] System.Byte[]
[double] System.Double
[double[]] System.Double[]
[decimal] System.Decimal
[decimal[]] System.Decimal[]
[float] System.Single
[single] System.Single

Reference types
[array] System.Array
[hashtable] System.Collections.Hashtable
[ipaddress] System.Net.IPAddress
[math] System.Math
[regex] System.Text.RegularExpression.Regex
System.Management.Automation.PowerShell
[pscustomobject] System.Management.Automation.PSObject
[psmoduleinfo] System.Management.Automation.PSModuleInfo
[psobject] System.Management.Automation.PSObject
[psprimativedictionary] System.Management.Automation.PSPrimativeDictionary
[ref] System.Management.Automation.PSReference
[regex] System.Text.RegularExpressions.Regex
[runspace] System.Management.Automation.Runspaces.Runspace
[runspacefactory] System.Management.Automation.Runspaces.RunspaceFactory
[scriptblock] System.Management.Automation.ScriptBlock
[switch] System.Management.Automation.SwitchParameter
[type] System.Type
[type[]] System.Type[]
[wmi] System.Management.ManagementObject
[wmiclass] System.Management.ManagementClass
[wmisearcher] System.Management.ManagementObjectSearcher
[xml] System.Xml.XmlDocument

[CmdletBinding()] customizations
These declarations must be placed inside the parentheses of a [CmdletBinding()] statement and set to the respective values.
SupportsShouldProcess - $true or $false.
DefaultParameterSetName - String name of default parameter set. Must be specified.
ComfirmImpact - Low, Medium or High.

Parameter attribute customizations
These are included in the param() statement. Must be included inside a [Parameter()] declaration where individual attributes are separated by commas.
Mandatory - $true or $false.
Position - Integer based value indicated position of argument in parameter list when no parameter is specified.
ParameterSetName - String indicating a parameter set.
ValueFromPipeline - $true or $false.
ValueFromPipelineByPropertyName - $true or $false.
ValueFromRemainingArguments - $true.

Parameter validation attributes
[Alias("alias")]
[AllowNull()]
[AllowEmptyString()]
AllowEmptyCollection()]
[ValidateCount(min,max)]
[ValidateLength(min,max)]
ValidatePattern(Regex)]
[ValidateRange(min,max)]
[ValidateScript({scriptblock with logic referencing $_})]
[ValidateSet(define a set of strings to compare against)]
[ValidateNotNull()]
[ValidateNotNullOrEmpty()]

Custom Date Format
The following work with -f, ToString() or Get-Date -Format

"d" The day of the month, from 1 through 31. 6/1/2009 1:45:30 PM -> 1
More information: The "d" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 15
"dd" The day of the month, from 01 through 31. 6/1/2009 1:45:30 PM -> 01
More information: The "dd" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 15
"ddd" The abbreviated name of the day of the week. 6/15/2009 1:45:30 PM -> Mon (en-US)
More information: The "ddd" Custom Format Specifier. 6/15/2009 1:45:30 PM -> ?? (ru-RU)
6/15/2009 1:45:30 PM -> lun. (fr-FR)
"dddd" The full name of the day of the week. 6/15/2009 1:45:30 PM -> Monday (en-US)
More information: The "dddd" Custom Format Specifier. 6/15/2009 1:45:30 PM -> ??????????? (ru-RU)
6/15/2009 1:45:30 PM -> lundi (fr-FR)
"f" The tenths of a second in a date and time value. 6/15/2009 13:45:30.617 -> 6
More information: The "f" Custom Format Specifier. 6/15/2009 13:45:30.050 -> 0
"ff" The hundredths of a second in a date and time value. 6/15/2009 13:45:30.617 -> 61
More information: The "ff" Custom Format Specifier. 6/15/2009 13:45:30.005 -> 00
"fff" The milliseconds in a date and time value. 6/15/2009 13:45:30.617 -> 617
More information: The "fff" Custom Format Specifier. 6/15/2009 13:45:30.0005 -> 000
"ffff" The ten thousandths of a second in a date and time value. 6/15/2009 13:45:30.6175 -> 6175
More information: The "ffff" Custom Format Specifier. 6/15/2009 13:45:30.00005 -> 0000
"fffff" The hundred thousandths of a second in a date and time value. 6/15/2009 13:45:30.61754 -> 61754
More information: The "fffff" Custom Format Specifier. 6/15/2009 13:45:30.000005 -> 00000
"ffffff" The millionths of a second in a date and time value. 6/15/2009 13:45:30.617542 -> 617542
More information: The "ffffff" Custom Format Specifier. 6/15/2009 13:45:30.0000005 -> 000000
"fffffff" The ten millionths of a second in a date and time value. 6/15/2009 13:45:30.6175425 -> 6175425
More information: The "fffffff" Custom Format Specifier. 6/15/2009 13:45:30.0001150 -> 0001150
"F" If non-zero, the tenths of a second in a date and time value. 6/15/2009 13:45:30.617 -> 6
More information: The "F" Custom Format Specifier. 6/15/2009 13:45:30.050 -> (no output)
"FF" If non-zero, the hundredths of a second in a date and time value. 6/15/2009 13:45:30.617 -> 61
More information: The "FF" Custom Format Specifier. 6/15/2009 13:45:30.005 -> (no output)
"FFF" If non-zero, the milliseconds in a date and time value. 6/15/2009 13:45:30.617 -> 617
More information: The "FFF" Custom Format Specifier. 6/15/2009 13:45:30.0005 -> (no output)
"FFFF" If non-zero, the ten thousandths of a second in a date and time value. 6/1/2009 13:45:30.5275 -> 5275
More information: The "FFFF" Custom Format Specifier. 6/15/2009 13:45:30.00005 -> (no output)
"FFFFF" If non-zero, the hundred thousandths of a second in a date and time value. 6/15/2009 13:45:30.61754 -> 61754
More information: The "FFFFF" Custom Format Specifier. 6/15/2009 13:45:30.000005 -> (no output)
"FFFFFF" If non-zero, the millionths of a second in a date and time value. 6/15/2009 13:45:30.617542 -> 617542
More information: The "FFFFFF" Custom Format Specifier. 6/15/2009 13:45:30.0000005 -> (no output)
"FFFFFFF" If non-zero, the ten millionths of a second in a date and time value. 6/15/2009 13:45:30.6175425 -> 6175425
More information: The "FFFFFFF" Custom Format Specifier. 6/15/2009 13:45:30.0001150 -> 000115
"g", "gg" The period or era. 6/15/2009 1:45:30 PM -> A.D.
More information: The "g" or "gg" Custom Format Specifier.
"h" The hour, using a 12-hour clock from 1 to 12. 6/15/2009 1:45:30 AM -> 1
More information: The "h" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 1
"hh" The hour, using a 12-hour clock from 01 to 12. 6/15/2009 1:45:30 AM -> 01
More information: The "hh" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 01
"H" The hour, using a 24-hour clock from 0 to 23. 6/15/2009 1:45:30 AM -> 1
More information: The "H" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 13
"HH" The hour, using a 24-hour clock from 00 to 23. 6/15/2009 1:45:30 AM -> 01
More information: The "HH" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 13
"K" Time zone information. With DateTime values:
More information: The "K" Custom Format Specifier. 6/15/2009 1:45:30 PM, Kind Unspecified ->
6/15/2009 1:45:30 PM, Kind Utc -> Z
6/15/2009 1:45:30 PM, Kind Local -> -07:00 (depends on local computer settings)
With DateTimeOffset values:
6/15/2009 1:45:30 AM -07:00 --> -07:00
6/15/2009 8:45:30 AM +00:00 --> +00:00
"m" The minute, from 0 through 59. 6/15/2009 1:09:30 AM -> 9
More information: The "m" Custom Format Specifier. 6/15/2009 1:09:30 PM -> 9
"mm" The minute, from 00 through 59. 6/15/2009 1:09:30 AM -> 09
More information: The "mm" Custom Format Specifier. 6/15/2009 1:09:30 PM -> 09
"M" The month, from 1 through 12. 6/15/2009 1:45:30 PM -> 6
More information: The "M" Custom Format Specifier.
"MM" The month, from 01 through 12. 6/15/2009 1:45:30 PM -> 06
More information: The "MM" Custom Format Specifier.
"MMM" The abbreviated name of the month. 6/15/2009 1:45:30 PM -> Jun (en-US)
More information: The "MMM" Custom Format Specifier. 6/15/2009 1:45:30 PM -> juin (fr-FR)
6/15/2009 1:45:30 PM -> Jun (zu-ZA)
"MMMM" The full name of the month. 6/15/2009 1:45:30 PM -> June (en-US)
More information: The "MMMM" Custom Format Specifier. 6/15/2009 1:45:30 PM -> juni (da-DK)
6/15/2009 1:45:30 PM -> uJuni (zu-ZA)
"s" The second, from 0 through 59. 6/15/2009 1:45:09 PM -> 9
More information: The "s" Custom Format Specifier.
"ss" The second, from 00 through 59. 6/15/2009 1:45:09 PM -> 09
More information: The "ss" Custom Format Specifier.
"t" The first character of the AM/PM designator. 6/15/2009 1:45:30 PM -> P (en-US)
More information: The "t" Custom Format Specifier. 6/15/2009 1:45:30 PM -> ? (ja-JP)
6/15/2009 1:45:30 PM -> (fr-FR)
"tt" The AM/PM designator. 6/15/2009 1:45:30 PM -> PM (en-US)
More information: The "tt" Custom Format Specifier. 6/15/2009 1:45:30 PM -> ?? (ja-JP)
6/15/2009 1:45:30 PM -> (fr-FR)
"y" The year, from 0 to 99. 1/1/0001 12:00:00 AM -> 1
More information: The "y" Custom Format Specifier. 1/1/0900 12:00:00 AM -> 0
1/1/1900 12:00:00 AM -> 0
6/15/2009 1:45:30 PM -> 9
"yy" The year, from 00 to 99. 1/1/0001 12:00:00 AM -> 01
More information: The "yy" Custom Format Specifier. 1/1/0900 12:00:00 AM -> 00
1/1/1900 12:00:00 AM -> 00
6/15/2009 1:45:30 PM -> 09
"yyy" The year, with a minimum of three digits. 1/1/0001 12:00:00 AM -> 001
More information: The "yyy" Custom Format Specifier. 1/1/0900 12:00:00 AM -> 900
1/1/1900 12:00:00 AM -> 1900
6/15/2009 1:45:30 PM -> 2009
"yyyy" The year as a four-digit number. 1/1/0001 12:00:00 AM -> 0001
More information: The "yyyy" Custom Format Specifier. 1/1/0900 12:00:00 AM -> 0900
1/1/1900 12:00:00 AM -> 1900
6/15/2009 1:45:30 PM -> 2009
"yyyyy" The year as a five-digit number. 1/1/0001 12:00:00 AM -> 00001
More information: The "yyyyy" Custom Format Specifier. 6/15/2009 1:45:30 PM -> 02009
"z" Hours offset from UTC, with no leading zeros. 6/15/2009 1:45:30 PM -07:00 -> -7
More information: The "z" Custom Format Specifier.
"zz" Hours offset from UTC, with a leading zero for a single-digit value. 6/15/2009 1:45:30 PM -07:00 -> -07
More information: The "zz" Custom Format Specifier.
"zzz" Hours and minutes offset from UTC. 6/15/2009 1:45:30 PM -07:00 -> -07:00
More information: The "zzz" Custom Format Specifier.
":" The time separator. 6/15/2009 1:45:30 PM -> : (en-US)
More information: The ":" Custom Format Specifier. 6/15/2009 1:45:30 PM -> . (it-IT)
6/15/2009 1:45:30 PM -> : (ja-JP)
"/" The date separator. 6/15/2009 1:45:30 PM -> / (en-US)
More Information: The "/" Custom Format Specifier. 6/15/2009 1:45:30 PM -> - (ar-DZ)
6/15/2009 1:45:30 PM -> . (tr-TR)
"string" Literal string delimiter. 6/15/2009 1:45:30 PM ("arr:" h:m t) -> arr: 1:45 P
'string' 6/15/2009 1:45:30 PM ('arr:' h:m t) -> arr: 1:45 P
% Defines the following character as a custom format specifier. 6/15/2009 1:45:30 PM (%h) -> 1
More information: Using Single Custom Format Specifiers.
\ The escape character. 6/15/2009 1:45:30 PM (h \h) -> 1 h
Any other character The character is copied to the result string unchanged. 15-Jun
More information: Using the Escape Character.

Custom Number Format
"0" Zero placeholder Replaces the zero with the corresponding digit if one is present; otherwise, zero appears in the result string. 1234.5678 ("00000") -> 01235
More information: The "0" Custom Specifier. 0.45678 ("0.00", en-US) -> 0.46
0.45678 ("0.00", fr-FR) -> 0,46
"#" Digit placeholder Replaces the "#" symbol with the corresponding digit if one is present; otherwise, no digit appears in the result string. 1234.5678 ("#####") -> 1235
More information: The "#" Custom Specifier. 0.45678 ("#.##", en-US) -> .46
0.45678 ("#.##", fr-FR) -> ,46
"." Decimal point Determines the location of the decimal separator in the result string. 0.45678 ("0.00", en-US) -> 0.46
More information: The "." Custom Specifier. 0.45678 ("0.00", fr-FR) -> 0,46
"," Group separator and number scaling Serves as both a group separator and a number scaling specifier. As a group separator, it inserts a localized group separator character between each group. As a number scaling specifier, it divides a number by 1000 for each comma specified. Group separator specifier:
More information: The "," Custom Specifier. 2147483647 ("##,#", en-US) -> 2,147,483,647
2147483647 ("##,#", es-ES) -> 2.147.483.647
Scaling specifier:
2147483647 ("#,#,,", en-US) -> 2,147
2147483647 ("#,#,,", es-ES) -> 2.147
"%" Percentage placeholder Multiplies a number by 100 and inserts a localized percentage symbol in the result string. 0.3697 ("%#0.00", en-US) -> %36.97
More information: The "%" Custom Specifier. 0.3697 ("%#0.00", el-GR) -> %36,97
0.3697 ("##.0 %", en-US) -> 37.0 %
0.3697 ("##.0 %", el-GR) -> 37,0 %
"‰" Per mille placeholder Multiplies a number by 1000 and inserts a localized per mille symbol in the result string. 0.03697 ("#0.00‰", en-US) -> 36.97‰
More information: The "‰" Custom Specifier. 0.03697 ("#0.00‰", ru-RU) -> 36,97‰
"E0" Exponential notation If followed by at least one 0 (zero), formats the result using exponential notation. The case of "E" or "e" indicates the case of the exponent symbol in the result string. The number of zeros following the "E" or "e" character determines the minimum number of digits in the exponent. A plus sign (+) indicates that a sign character always precedes the exponent. A minus sign (-) indicates that a sign character precedes only negative exponents. 987654 ("#0.0e0") -> 98.8e4
"E+0" More information: The "E" and "e" Custom Specifiers. 1503.92311 ("0.0##e+00") -> 1.504e+03
"E-0" 1.8901385E-16 ("0.0e+00") -> 1.9e-16
"e0"
"e+0"
"e-0"
\ Escape character Causes the next character to be interpreted as a literal rather than as a custom format specifier. 987654 ("\###00\#") -> #987654#
More information: The "\" Escape Character.
'string' Literal string delimiter Indicates that the enclosed characters should be copied to the result string unchanged. 68 ("# ' degrees'") -> 68 degrees
"string" 68 ("#' degrees'") -> 68 degrees
; Section separator Defines sections with separate format strings for positive, negative, and zero numbers. 12.345 ("#0.0#;(#0.0#);-\0-") -> 12.35
More information: The ";" Section Separator. 0 ("#0.0#;(#0.0#);-\0-") -> -0-
-12.345 ("#0.0#;(#0.0#);-\0-") -> (12.35)
12.345 ("#0.0#;(#0.0#)") -> 12.35
0 ("#0.0#;(#0.0#)") -> 0.0
-12.345 ("#0.0#;(#0.0#)") -> (12.35)
Other All other characters The character is copied to the result string unchanged. 68 ("# °") -> 68 °

Custom Number format
Use with -f "{0:C}" for example
C or c Currency
D or d Decimal
E or e Scientific (exponential)
F or f Fixed-point
G or g General
N or n Number
P or p Percent
R or r Round-trip
X or x Hexadecimal

WQL Query Operators
Initial WQL Operators can be found at: http://msdn.microsoft.com/en-us/library/windows/desktop/aa394605(v=vs.85).aspx. For more in depth PowerShell WMI reference check out Ravikanth's Chaganti's eBook at: http://www.ravichaganti.com/blog/?p=1979.
General WQL terms]
AND Combines two Boolean expressions, and returns TRUE when both expressions are TRUE.
ASSOCIATORS OF Retrieves all instances that are associated with a source instance.
Use this statement with schema queries and data queries.
__CLASS References the class of the object in a query.
Windows NT 4.0 and Windows Me/98/95: Not available.
FROM Specifies the class that contains the properties listed in a SELECT statement. Windows Management Instrumentation (WMI) supports data queries from only one class at a time.
GROUP Clause Causes WMI to generate one notification to represent a group of events.
Use this clause with event queries.
HAVING Filters the events that are received during the grouping interval that is specified in the WITHIN clause.
IS Comparison operator used with NOT and NULL. The syntax for this statement is the following:
IS [NOT] NULL
(where NOT is optional)
ISA Operator that applies a query to the subclasses of a specified class. For more information, see ISA Operator for Event Queries, ISA Operator for Data Queries, and ISA Operator for Schema Queries.
KEYSONLY Used in REFERENCES OF and ASSOCIATORS OF queries to ensure that the resulting instances are only populated with the keys of the instances, which reduces the overhead of the call.
Windows 2000, Windows NT 4.0, and Windows Me/98/95: Not available.
LIKE Operator that determines whether or not a given character string matches a specified pattern.
NOT Comparison operator that use in a WQL SELECT query, for example:
SELECT * FROM meta_class WHERE NOT __class < "Win32" AND NOT __this ISA " Win32_Account"
NULL Indicates an object does not have an explicitly assigned value. NULL is not equivalent to zero (0) or blank.
OR Combines two conditions.
When more than one logical operator is used in a statement, the OR operators are evaluated after the AND operators.
REFERENCES OF Retrieves all association instances that refer to a specific source instance. Use this statement with schema and data queries. The REFERENCES OF statement is similar to the ASSOCIATORS OF statement. However, it does not retrieve endpoint instances; it retrieves the association instances.
SELECT Specifies the properties that are used in a query.
For more information, see SELECT Statement for Data Queries, SELECT Statement for Event Queries, or SELECT Statement for Schema Queries.
TRUE Boolean operator that evaluates to -1 (minus one).
WHERE Narrows the scope of a data, event, or schema query.
WITHIN Specifies a polling or grouping interval.
Use this clause with event queries.
FALSE Boolean operator that evaluates to 0 (zero).

Normal operators to be used with WHERE operator
= Equal to
< Less than
> Greater than
< = Less than or equal to
>= Greater than or equal to
!= or <> Not equal to

To be used with LIKE clause
IS
IS NOT
ISA
1) with data queries: http://msdn.microsoft.com/en-us/library/windows/desktop/aa391407(v=vs.85).aspx
2) with event queries: http://msdn.microsoft.com/en-us/library/windows/desktop/aa391408(v=vs.85).aspx
3) with schema queries: http://msdn.microsoft.com/en-us/library/windows/desktop/aa391409(v=vs.85).aspx
LIKE - "SELECT * FROM Meta_Class WHERE __Class LIKE '%Win32%'" (Use single quotes inside query)

Format Files
Retrieved with gci $pshome "*.ps1xml" | sort name | select name

Certificate.format.ps1xml
Diagnostics.Format.ps1xml
DotNetTypes.format.ps1xml
Event.Format.ps1xml
FileSystem.format.ps1xml
getevent.types.ps1xml
Help.format.ps1xml
HelpV3.format.ps1xml
PowerShellCore.format.ps1xml
PowerShellTrace.format.ps1xml
Registry.format.ps1xml
types.ps1xml
typesv3.ps1xml
WSMan.Format.ps1xml

Verb names
Derived from Get-verb | select @{e={"$($_.verb): $($_.group)"}}

"$($_.verb): $($_.group)"
-------------------------
Add: Common
Clear: Common
Close: Common
Copy: Common
Enter: Common
Exit: Common
Find: Common
Format: Common
Get: Common
Hide: Common
Join: Common
Lock: Common
Move: Common
New: Common
Open: Common
Optimize: Common
Pop: Common
Push: Common
Redo: Common
Remove: Common
Rename: Common
Reset: Common
Resize: Common
Search: Common
Select: Common
Set: Common
Show: Common
Skip: Common
Split: Common
Step: Common
Switch: Common
Undo: Common
Unlock: Common
Watch: Common
Backup: Data
Checkpoint: Data
Compare: Data
Compress: Data
Convert: Data
ConvertFrom: Data
ConvertTo: Data
Dismount: Data
Edit: Data
Expand: Data
Export: Data
Group: Data
Import: Data
Initialize: Data
Limit: Data
Merge: Data
Mount: Data
Out: Data
Publish: Data
Restore: Data
Save: Data
Sync: Data
Unpublish: Data
Update: Data
Approve: Lifecycle
Assert: Lifecycle
Complete: Lifecycle
Confirm: Lifecycle
Deny: Lifecycle
Disable: Lifecycle
Enable: Lifecycle
Install: Lifecycle
Invoke: Lifecycle
Register: Lifecycle
Request: Lifecycle
Restart: Lifecycle
Resume: Lifecycle
Start: Lifecycle
Stop: Lifecycle
Submit: Lifecycle
Suspend: Lifecycle
Uninstall: Lifecycle
Unregister: Lifecycle
Wait: Lifecycle
Debug: Diagnostic
Measure: Diagnostic
Ping: Diagnostic
Repair: Diagnostic
Resolve: Diagnostic
Test: Diagnostic
Trace: Diagnostic
Connect: Communications
Disconnect: Communications
Read: Communications
Receive: Communications
Send: Communications
Write: Communications
Block: Security
Grant: Security
Protect: Security
Revoke: Security
Unblock: Security
Unprotect: Security
Use: Other

Built-in conversion
1kb = 1024
1mb = 1048576
1gb = 1073741824
1tb = 1099511627776
1pb = 1125899906842624

ATS/ETS keywords
The adpated type system (ATS) and extended type system (ETS) are key to how PowerShell interacts with the .NET Framework. Different members of ATS, ETS and .NET objects can be accessed by dereferencing the appropriate layer. A good link to exploring this is: http://blogs.msdn.com/b/besidethepoint/archive/2011/11/22/psobject-and-the-adapted-and-extended-type-systems-ats-and-ets.aspx. Another earlier post is http://blogs.msdn.com/b/powershell/archive/2008/09/06/hate-add-member-powershell-s-adaptive-type-system.aspx. One of the key places you will see this is the use of Get-Member -View. Also, it is used in WMI calls, some service controller work and a few other common spots.

adapted
all
base
extended

A good way to see this in action:
$dir = dir
$dir | Get-Member -View Adapted
$dir | Get-Member -View Base
$dir | Get-Member -View Extended
$dir | Get-Member -View All

Default Providers
Retrieved with the command Get-PSProvider | select name. To access providers, provided you are in the right context, simple type cd [providername]:. For instance, to switch to the wsman provider, type cd wsman: and hit the [Enter] key. It will return PS WSMan:\> and you can browse it like the usual file system providers of old.
Alias
Environment
FileSystem
Function
Registry
Variable
Certificate
WSMan

by mjolinor at 2012-09-01 13:42:51

Hashtable should be @{} (${} is braced variable)

Missing :
: operator (provider/drive specifier)
() operator (precendence and assignment expression evaluation)
{} script block
[math] type accelerator
[ipaddress] type accelerator

here-strings and about_quoting_rules

All I see right now..........

by willsteele at 2012-09-01 13:54:02

I added everything except the here-strings and about_quoting_rules. Where do you want me to put those? Also, should I expand upon the contents (I know it depends on where they go).

by mjolinor at 2012-09-01 14:09:42

Not sure where those should go.

Maybe a section on string delimiters, ( " ' @" "@ @' '@), along with the about reference.

by DonJ at 2012-09-01 17:10:40

Wow, that's a cheat book ;). Variables you can get with dir variable{/b] – worth having listed on your sheet?

FWIW, I'd be willing to contribute the cheat chapter from my Lunches book, if you'd like to use that as a starting point.

by willsteele at 2012-09-01 17:37:27

Yeah definitely. That would be awesome Don. Your dir:\variable makes me think of providers. Let me see if I can pull together a good list of those.

by mjolinor at 2012-09-01 17:50:31

Something you might add on the automtic variables is an asterisk or some other notation to show which ones are and are not created in a new scope. Some are inherited and some are not.

by willsteele at 2012-09-01 18:36:51

[quote="mjolinor"]Something you might add on the automtic variables is an asterisk or some other notation to show which ones are and are not created in a new scope. Some are inherited and some are not.[/quote]

I wasn't aware of that. Can you email me or post a list. I'll add it to the main one.

by mjolinor at 2012-09-01 18:49:37

Easy to get. From a fresh PS console:

&{gv -scope 0}

Everything in the list was initialized with the scope. (This is why you can't use $args from a parent scope).

by willsteele at 2012-09-10 07:40:30

Added this new link today for other cheat sheets. Very thorough: http://ramblingcookiemonster.wordpress. ... eat-sheet/.

by cookie.monster at 2012-09-10 15:00:58

Thanks for the reference : ) I found it quite difficult to break down such a powerful language on one page, even when taking liberties with grammar and descriptions! Will link your original post – looks quite handy.

by NachumElla at 2012-09-11 03:11:44

Wow...great contribution!
Bookmarked : )

by willsteele at 2012-09-11 06:22:35

[quote="cookie.monster"]Thanks for the reference : ) I found it quite difficult to break down such a powerful language on one page, even when taking liberties with grammar and descriptions! Will link your original post – looks quite handy.[/quote]

Yeah, unless it was a double-sided 11 x 17 inch sheet, I don't think it'd be happening. But, I include "everything" and the kitchen sink. Anything to avoid having to roll that extra 5 feet to grab a book. : )

by mjolinor at 2012-09-15 06:57:57

By request:

Fast searching of large text files]

get-content -readcount 10000 | foreach {$_ -match ''}

You can adjust readcount to your available resources. Larger numbers should yield better performance up to the point where you run out of physical memory and it starts paging. At that point you're just churning the disk and it starts to get slower.

Another tip:

Pipelining output from a ForEach loop]

&{foreach ($i in $x){

}} | -> on to the next command in the pipeline

by juneb_msft at 2012-09-15 11:00:56

Here's my favorite function from my profile.

function Get-CodeParms ($cmdlet)
{
$common = "Verbose", "Debug", "WarningAction", "WarningVariable", "ErrorAction", "ErrorVariable", "OutVariable", "OutBuffer"
$allparms = (get-command $cmdlet).parametersets | foreach {$_.parameters} | foreach {$_.name} | sort-object | get-unique
$allparms | where {$common -notcontains $_ }
< #
.Synopsis
Gets a list of cmdlet parameters in all parameter sets. Omits common parameters.
.Parameter Cmdlet
Specifies the cmdlet to search. Returns parameters of this cmdlet.
.Example
get-codeparms invoke-command
#>
}