Inside Windows

The facts about a computer, its event logs, its registry, its users and its apps.

Updated

Facts

  1. Your Computer's Facts: `Get-CimInstance` (Journeyman): Get-CimInstance asks Windows' own catalog of facts about the computer, one class at a time, such as Win32_OperatingSystem for the Windows version and the last restart, Win32_LogicalDisk for the disks and Win32_Battery for the battery, and a calculated property turns its bytes into gigabytes.
  2. Event Logs: Why Did It Restart? (Journeyman): Windows writes what happens to it in event logs, and Get-WinEvent -FilterHashtable finds the events you want by log, event ID, level and start time, so the five restart IDs, 41, 1074, 6005, 6006 and 6008, tell a planned restart from a crash or a power cut.

Settings and People

  1. The Registry as a Drive (Freelancer): The registry is where Windows and its apps keep their settings, and PowerShell shows it as two drives, HKCU: for your own settings and HKLM: for the whole computer, where Get-ChildItem lists keys like folders and Get-ItemProperty reads their values; before changing one, rehearse with -WhatIf and back up the key with reg export.
  2. Users and Groups on This PC (Journeyman): Every Windows PC has its own list of accounts and groups: Get-LocalUser and Get-LocalGroup read them, Get-LocalGroupMember shows who is in a group such as Administrators, and a quick check tells you whether this window runs as administrator; adding an account takes an administrator window, so rehearse it with -WhatIf.

Apps

  1. A New PC from One File: `winget export` and `import` (Journeyman): winget export writes the list of apps on a PC to a JSON file, which PowerShell can read and change with ConvertFrom-Json and ConvertTo-Json -Depth, and winget import installs every app on the list on a new PC in one command.

Exercise: The PC Health Report

  1. Exercise: The PC Health Report (Journeyman): Finish a module that makes a one-page health report for a Windows PC, with its disks in gigabytes, its restarts in plain words and everything on one web page, gathered with Get-CimInstance and Get-WinEvent -FilterHashtable, while a Pester check tries it with stand-in objects instead of your real PC.