Cheatsheet: PowerShell

Verb-Noun is PowerShell's mandatory cmdlet naming convention: the verb (Get, Set, New, Remove, Start, Stop...) is drawn from a small approved list (Get-Verb lists them) so behavior is predictable across every cmdlet, and the noun names the thing being acted on (Process, Service, Item, ChildItem). Capitalization is cosmetic only -- PowerShell is case-insensitive for cmdlet names, parameters, and most string comparisons (unlike Bash or most .NET string methods), so get-process, Get-Process, and GET-PROCESS all run identically.

Bash pipes pass raw text between processes, so downstream commands have to parse (grep/awk/cut) whatever format the upstream command happened to print. PowerShell's pipe (|) passes live .NET objects with typed properties and methods intact -- Get-Process | Where-Object CPU -gt 100 filters on the actual numeric CPU property, no text parsing involved. This is why PowerShell scripts rarely need sed/awk-style text munging for structured data, but it also means PowerShell pipelines generally don't interoperate with plain Unix pipe-based tools without a format/conversion step (ConvertTo-Json, Out-String).

Where-Object filters objects by a property condition (roughly grep): Get-Process | Where-Object CPU -gt 100. Select-Object picks specific properties or the first/last N items (roughly awk/cut/head): Get-Process | Select-Object Name, CPU -First 5. Sort-Object sorts by property (sort): Get-Process | Sort-Object CPU -Descending. ForEach-Object runs a script block per item for arbitrary transforms (roughly a loop, usable inline in a pipeline): 1..5 | ForEach-Object { $_ * 2 }.

$_ and $PSItem are identical, interchangeable aliases for 'the current object flowing through the pipeline' inside a script block passed to Where-Object, ForEach-Object, etc. -- $PSItem was added later purely for readability in scripts where $_ might be visually confused with other punctuation, but there is no behavioral difference; pick one and be consistent. Neither is related to a variable you declare yourself with $name = value, which just holds whatever you assigned until reassigned or the scope ends.

Invoke-Command -ComputerName <host> -ScriptBlock { <command> } runs a script block remotely and returns the (serialized) results as objects; Enter-PSSession -ComputerName <host> opens an interactive remote session instead. Both require PowerShell Remoting to be enabled on the target (Enable-PSRemoting -Force, which configures WinRM) and appropriate network/firewall/trust settings (WinRM listens on 5985/5986 by default) -- it is not on by default on most machines, unlike SSH being commonly pre-installed on Linux servers.