PowerShell Investigation Lab: A Hands-On Tutorial for Beginners

PowerShell is an essential tool for Windows system administration, IT support, troubleshooting, and automation. Beyond running individual commands, it allows administrators to inspect system information, collect diagnostic data, investigate missing files, calculate cryptographic hashes, analyze running processes, and manage Windows services.

In this hands-on PowerShell investigation lab, you will build a dedicated workspace on your Windows computer and use it to perform a series of practical investigation tasks. Each stage introduces fundamental PowerShell commands and explains how they work together.

By the end of this tutorial, you will understand how to use the PowerShell pipeline, work with objects, validate file and directory structures, inspect file metadata, calculate SHA-256 hashes, find resource-intensive processes, and investigate the Windows Print Spooler service.

This lab is designed for beginners, junior IT support technicians, aspiring system administrators, and anyone learning PowerShell through practical exercises.

What You Will Learn

• Create and manage a structured PowerShell laboratory.
• Collect system, network, user, and service information.
• Use Get-Location, Get-ChildItem, Test-Path, and Get-Item to inspect files and directories.
• Understand the pipeline operator (|) and the $_ automatic variable.
• Find missing files and directories.
• Investigate file sizes, full paths, and modification timestamps.
• Calculate SHA-256 file hashes and record them automatically.
• Sort Windows processes by memory consumption.
• Use Get-Member to explore object properties and methods.
• Investigate Windows services before changing their state.

Prerequisites

You need a Windows computer with either Windows PowerShell 5.1 or PowerShell 7 installed. The examples involving Get-ComputerInfo, Get-LocalUser, Windows processes, and Windows services are intended for Windows.

Most exercises can be performed in a regular PowerShell session. Administrative privileges may be required when investigating protected processes or starting, stopping, or restarting certain services.

Important: Perform the deletion and service-management exercises only in your designated lab environment. Do not delete business files or restart production services without authorization.

Part 1 — Creating the PowerShell Lab

Before investigating a computer, it is useful to have a consistent location for storing collected information, investigation notes, reports, and backups.

We will create the following directory structure:

C:\PowerLab

C:\PowerLab

│
├── Evidence
├── Logs
├── Reports
├── Backup
└── Archive

Each directory has a specific purpose:

Step 1.1 — Navigate to the root of the C: drive

Suppose your PowerShell prompt currently displays:

PS C:\Windows\System32>

PS C:\Windows\System32>

You are inside the System32 directory. To move up one directory, run:

cd ..

cd ..

To move up two directory levels from the original location, you can run:

cd ../..

cd ../..

You can also go directly to the root of the C: drive:

Set-Location C:\

Set-Location C:\

PowerShell provides several commands and aliases for navigating the filesystem:

Get-Location
pwd

Get-Location
pwd

Both display your current working directory. pwd is an alias for Get-Location.

To change the current directory, use Set-Location or its familiar alias cd.

Microsoft documentation: Set-Location.

Grursus mal suada faci lisis Lorem ipsum dolarorit ametion consectetur elit. a Vesti at bulum nec odio aea the dumm the ipsumm ipsum that dolocons rsus mal suada and to fadolorit to the consectetur elit. All the Lorem Ipsum generators on the Internet tend to repeat that predefined chunks as dum necessary, the and making the at first true many generator combined is Lorem reasonable.

Trust us we looked for a very long time and wasted thousands of the dollars testing other teams freelancers, outsource companies.

Harvard Alexander

CEO Omix

Grursus mal suada faci lisis Lorem ipsum dolarorit ametion consectetur elit. Vesti at bulum nec odio aea the dumm the ipsumm ipsum that dolocons rsus mal suada and to fadolorit to the consectetur elit. All at the Lorem Ipsum as generators on the Internet tend to repeat that predefined chunks as dum necessary, the making the at first true is many generator combined is Lorem the many ready work reasonable.

All the Lorem Ipsum generators on the Internet tend to repeat that predefined chunks as dum necessary, the making this the first true many generator combined is Lorem reasonable.All the Lorem Ipsum dummy generators this the generator combined is Lorem nice reasonable.

Explore the city and new places

Grursus mal suada faci lisis Lorem ipsum dolarorit ametion consectetur elit. a Vesti at bulum nec odio an aea the dumm the ipsumm ipsum that dolocons.

Grursus mal suada faci lisis Lorem ipsum dolarorit ametion consectetur elit. a Vesti at bulum nec odio at aea the dumm the ipsumm ipsum that dolocons rsus mal suada and to fadolorit to the consectetur elit. All the Lorem Ipsum generators on the Internet tend to repeat.

Breaking News!

Grursus mal suada faci lisis Lorem ipsum dolarorit ametion consectetur elit. a Vesti at bulum nec odio an aea the dumm the ipsumm ipsum that dolocons.

• Struggling to sell one multi-million dollar home currently on the market
• Lopez has reportedly added to her real estate holdings an eight-plus acre
• The property, complete with a 30-seat screening room, a 100-seat amphit
• Lo managed to make it hers for $28 million. As the Bronx native acquires
• Lopez has reportedly added to her real estate holdings an eight-plus acre

`