Get-Service | Where-Object Status -eq 'Stopped'          # filtern
Get-Process | Sort-Object CPU -Descending                # sortieren
Get-Process | Select-Object -First 5 Name, Id, CPU       # Spalten und Anzahl wählen
Get-Service | Out-GridView                               # sortierbares Fenster (nur mit Desktop)
Get-Service | Export-Csv "$env:USERPROFILE\Desktop\dienste.csv" -NoTypeInformation -Encoding UTF8
Get-ComputerInfo | Out-File "$env:USERPROFILE\Desktop\info.txt"
Get-Process | Format-Table -AutoSize                     # nur zur Anzeige, am Ende der Pipeline

$os  = Get-CimInstance Win32_OperatingSystem
$cs  = Get-CimInstance Win32_ComputerSystem
$bio = Get-CimInstance Win32_BIOS
[pscustomobject]@{
  Computer     = $env:COMPUTERNAME
  Benutzer     = $env:USERNAME
  Hersteller   = $cs.Manufacturer
  Modell       = $cs.Model
  Seriennr     = $bio.SerialNumber
  Windows      = $os.Caption
  Build        = $os.BuildNumber
  LetzterStart = $os.LastBootUpTime
  RAM_GB       = [math]::Round($cs.TotalPhysicalMemory / 1GB, 1)
  Domaene      = $cs.Domain
}

$pfade = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
         'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
Get-ItemProperty $pfade -ErrorAction SilentlyContinue |
  Where-Object DisplayName |
  Select-Object DisplayName, DisplayVersion, Publisher, InstallDate |
  Sort-Object DisplayName

$ziel = '10.0.0.1'
22, 53, 80, 443, 3389 | ForEach-Object {
  [pscustomobject]@{ Port = $_; Offen = (Test-NetConnection $ziel -Port $_ -WarningAction SilentlyContinue).TcpTestSucceeded }
}

([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(
  [Security.Principal.WindowsBuiltInRole]::Administrator)

Get-CimInstance Win32_UserProfile |
  Where-Object { -not $_.Special } |
  Select-Object LocalPath, LastUseTime, Loaded, SID

Get-WinEvent -FilterHashtable @{
  LogName = 'Application'
  ProviderName = 'Microsoft-Windows-User Profiles Service'
  StartTime = (Get-Date).AddDays(-7)
} | Select-Object TimeCreated, Id, Message -First 20

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' |
  Select-Object PSChildName, @{n='Pfad'; e={ $_.GetValue('ProfileImagePath') }}

# Fehler und Warnungen im System-Log der letzten 24 Stunden
Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24) } |
  Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, Message

# Die letzten 20 Fehler im Anwendungs-Log
Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=2 } -MaxEvents 20

# Nach einer bestimmten Ereignis-ID suchen (unerwartetes Herunterfahren)
Get-WinEvent -FilterHashtable @{ LogName='System'; Id=41,6008 } -MaxEvents 10

# Wer oder was hat neu gestartet?
Get-WinEvent -FilterHashtable @{ LogName='System'; Id=1074 } -MaxEvents 10 |
  Select-Object TimeCreated, Message

# Fehlgeschlagene Anmeldungen (Administrator nötig)
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4625 } -MaxEvents 20

# Verfügbare Logs mit Einträgen
Get-WinEvent -ListLog * | Where-Object RecordCount -gt 0 | Sort-Object RecordCount -Descending

Get-Process | Sort-Object WS -Descending | Select-Object -First 10 Name, Id,
  @{n='RAM_MB'; e={ [math]::Round($_.WS / 1MB) }}

Get-NetTCPConnection -LocalPort 443 -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{n='Prozess'; e={ (Get-Process -Id $_.OwningProcess).ProcessName }}

Get-Volume | Where-Object DriveLetter | Select-Object DriveLetter, FileSystemLabel,
  @{n='Groesse_GB'; e={ [math]::Round($_.Size / 1GB, 1) }},
  @{n='Frei_GB';    e={ [math]::Round($_.SizeRemaining / 1GB, 1) }}

Get-ChildItem $env:USERPROFILE -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object {
  [pscustomobject]@{
    Ordner = $_.Name
    GB = [math]::Round((Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue |
          Measure-Object Length -Sum).Sum / 1GB, 2)
  }
} | Sort-Object GB -Descending | Select-Object -First 10

Get-ChildItem C:\ -Recurse -File -Force -ErrorAction SilentlyContinue |
  Sort-Object Length -Descending | Select-Object -First 20 FullName,
    @{n='GB'; e={ [math]::Round($_.Length / 1GB, 2) }}

Get-Printer | ForEach-Object { Get-PrintJob -PrinterName $_.Name } |
  Select-Object PrinterName, Id, DocumentName, UserName, JobStatus, SubmittedTime

# einmalig für den eigenen Benutzer
Install-Module ExchangeOnlineManagement -Scope CurrentUser

Connect-ExchangeOnline -UserPrincipalName admin@domain.tld

Disconnect-ExchangeOnline -Confirm:$false

Suspend-BitLocker -MountPoint "C:" -RebootCount 1
# BIOS-Update durchführen und neu starten, danach:
Get-BitLockerVolume -MountPoint "C:" | Select-Object MountPoint, VolumeStatus, ProtectionStatus