Windows OS & PowerShell

Your JD asks for "Strong knowledge of Windows OS & Server Administration" and names PowerShell scripts. This is the module that closes the largest gap in your resume.

The troubleshooting toolkit

Memorise this table. It is the core of day-to-day L1/L2 work.

Command	Does
ipconfig /all	Every adapter, mask, gateway, DNS, DHCP server
ipconfig /release / /renew	Drop and re-request a DHCP lease
ipconfig /flushdns	Clear the DNS resolver cache
ping	Reachability and latency
tracert	Path to a host
nslookup	DNS resolution
netstat -ano	Connections, listening ports, owning PID
tasklist / taskkill	Running processes
sc query / Get-Service	Service state
systeminfo	OS version, boot time, patch level
wmic / Get-CimInstance	Hardware and OS inventory
sfc /scannow	Repair protected system files
DISM /Online /Cleanup-Image /RestoreHealth	Repair a broken component store
gpupdate /force	Re-apply Group Policy
gpresult /r	Which policies applied, and why
w32tm /resync	Force time synchronisation
nltest /dsgetdc:domain	Can this machine see a domain controller?

✖Time sync is not optional

Kerberos rejects authentication when the clock is skewed more than five minutes from the DC. "I can't log in but my password is right" is very often simply a wrong time.

PowerShell — the fundamentals

PowerShell is a pipeline language and you support role will be judged on it.

# Verb-Noun is the convention, and interviewers listen for it.
Get-Service -Name Spooler
Start-Service -Name Spooler
Restart-Service -Name Spooler
Stop-Service -Name Spooler

# The pipeline
Get-Service | Where-Object {$_.Status -eq 'Running'} | Measure-Object

# Object selection and projection
Get-Process | Select-Object -First 5 Name, Id, CPU
Get-Service | Select-Object Name, @{n='State'; e={$_.Status}}

Things you will actually be asked to write

# Events in the last hour — your first stop for "it crashed"
Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Level   = 1,2          # 1 Critical, 2 Error
    StartTime = (Get-Date).AddHours(-1)
} | Select-Object TimeCreated, Id, ProviderName, Message

# Disk health — a failing disk explains most "slow PC" tickets
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, MediaType
Get-Volume | Select-Object DriveLetter, @{n='FreeGB';e={[math]::Round($_.SizeRemaining/1GB,1)}}

# Patching state
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Who is logged on to a machine
query user /server:PC-ENG-07
Get-CimInstance Win32_LogonUser | Where-Object {$_.LogonType -eq 2}

★Event IDs worth memorising

ID	Source	Means
7	Disk	Bad block found
51	Disk	Paging/IO error — often a dying disk
55	Ntfs	File system corruption
41	Kernel-Power	Unexpected shutdown / power loss
6008	EventLog	Unexpected shutdown
7031/7034	Service Control Manager	Service crashed
1058	Service Control Manager	Service disabled

Services

Get-Service | Where-Object {$_.Status -ne 'Running'} | Select-Object Name, Status, StartType

Common support services:

Service	Symptoms when stopped
Spooler	Nothing prints. Queue stuck.
wuauserv	Windows Update fails
DNS Client	Name resolution fails
LanmanWorkstation / LanmanServer	Network shares fail
WinDefend	Defender does not scan
WSearch	Search indexer issues
Plug Play	USB devices not detected
Themes	GUI glitches (often a symptom, not a cause)

Reading Event Viewer

Log	Contains
System	Hardware, drivers, services, power
Application	Application crashes, .NET errors
Security	Logon events (4624 success, 4625 failure)
Setup	Windows updates and installation
Power-Troubleshooter	Why the machine slept or shut down

Get-WinEvent -LogName Security -MaxEvents 50 |
  Where-Object {$_.Id -eq 4625} | Select-Object TimeCreated, Message

ℹReliability Monitor

perfmon /rel shows hardware and software problems over time rather than a snapshot. When a user says "it keeps crashing", this is faster than the event log and tells you which component.

System repair, in order

1. sfc /scannow — repair protected files
2. DISM /Online /Cleanup-Image /RestoreHealth — repair the component store
3. sfc /scannow again — DISM often requires a second SFC pass
4. In-place repair install — keeps data, replaces the OS

⚠Rebuilding a profile, not the machine

For a corrupt user profile, create a new local admin and test there before you rebuild. If the machine works under a new profile, it is the profile — rename the old one and let Windows create a fresh one on next logon.

Boot and safe mode

Shift+Restart → Troubleshoot → Advanced Options, or:

bcdedit /enum

Tool	Use
Safe Mode	Third-party drivers and services are the suspect
Last Known Good	The system booted before a driver change
Startup Repair	Boot volume won't load
System Restore	Point back to before the fault

Next

Windows Server.