Using past command history in the PowerShell console Ranjan.info

By default, Windows saves all the commands you type in the PowerShell console to a text log file. It also allows you to rerun any command and view the history of PowerShell commands you’ve run, even after closing the console or restarting your computer. PowerShell currently uses two command history providers: a history of commands in the current session (displayed by the Get-History cmdlet) and a text log with past commands that the PSReadLine module saves.

Viewing PowerShell Command History on Windows

In the PowerShell console, the last command you typed appears when you press the Up key. If you continue to press the “Up” key, you will see all the previously executed commands. Thus, using “Up arrow” And “Down arrowKeys You can scroll through the history of PowerShell commands and replay previously typed commands. This is useful if you need to quickly execute one of the previous commands without having to type them again.

The PowerShell console keeps a complete command history since Windows PowerShell 5.1 (installed by default in Windows 10). In previous versions of Windows PowerShell (and the cmd command prompt), the history of executed commands is only available in the current PowerShell session. Use gate-history cmdlet to view the history of previous commands in the current session.

You can display more detailed information about previously executed commands in the current PowerShell session, including command status and start/end/duration times:

Get-History | Format-List -Property *

You can run the previous command by its ID:

Invoke-History 6

When you close the PowerShell console the command history is reset and the list in Get-History is cleared.

However, Windows PowerShell 5.1 and PowerShell Core save the last 4096 commands in each user’s profile to a plain text file %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt,

You can open this file and view the command history using any text editor. For example, to open a command log file using Notepad:

notepad (Get-PSReadLineOption | select -ExpandProperty HistorySavePath)

History logs are kept separately for the PowerShell console and PowerShell ISE.

How to search in PowerShell command history?

If you don’t want to scroll through the entire PowerShell command history using the up/down arrows, you can search the command history using keyboard shortcuts. CTRL + R (reverse search) and ctr + s (further search). Press the key combination and start typing the part of the command that you want to find in the previously executed command. The text you enter will be found at any position in the command history (as opposed to searching in PowerShell F8 either Shift+F8, which allows searching for matches only from the beginning of the line). The PowerShell console should display the previous command matching the search string. Line matches in the command are highlighted.

press CTRL+R,CTRL+S Again to continue searching the history if the order found is not the one you want. As a result, the following command corresponding to the search pattern will appear on the screen.

use of F8 key, you can find the command in the history that matches the text on the current command line. type for example get- and press F8, The last entry matching this text will be found in the command history. To go to the next command in history, press F8 Again.

you can also use # To search through character command history. For example, to find the last command starting with get-wmiType #get-wmi and press Tab key. The last command matching the pattern will appear in the console:

To display a list of commands in the history that match a query, you can use:

Get-History | Select-String -Pattern "Get-"

And:

Get-Content (Get-PSReadlineOption).HistorySavePath| Select-String -Pattern "Get-"

Configure PowerShell Command History with the PSReadLine Module

The command history functionality in PowerShell is not built into the Windows Management Framework itself but is based on PSReadLine Module, which greatly extends the functionality of the PowerShell console. Where is the PSReadLine module located on Windows C:\Program Files\WindowsPowerShell\Modules\PSReadline folder and is automatically imported when you start the PowerShell console.

PSReadLine provides syntax highlighting in the console, the ability to use the mouse to select text and is responsible for using copy / paste CTRL+C And CTRL+V,

Check that the module is loaded in your current PowerShell session:

Get-Module

If the PSReadline module is not loaded, verify that it is installed. If necessary, install it from the PowerShell Gallery online repository:

Get-Module -ListAvailable | where {$_.name -like "*PSReadline*"}

Install-Module PSReadLine

A complete list of the PSReadLine module’s functions for managing command history in PowerShell and the keys assigned to them can be displayed with the command:

Get-PSReadlineKeyHandler | ? {$_.function -like '*hist*'}

Key       Function                Description
---       --------                -----------
UpArrow   PreviousHistory         Replace the input with the previous item in the history
DownArrow NextHistory             Replace the input with the next item in the history
Ctrl+r    ReverseSearchHistory    Search history backwards interactively
Ctrl+s    ForwardSearchHistory    Search history forward interactively
Alt+F7    ClearHistory            Remove all items from the command line history (not PowerShell history)
F8        HistorySearchBackward   Search for the previous item in the history that starts with the current input - like NextHistory if the input is empty
Shift+F8  HistorySearchForward    Search for the next item in the history that starts with the current input - like NextHistory if the input is empty
Unbound   ViSearchHistoryBackward Starts a new seach backward in the history.
Unbound   BeginningOfHistory      Move to the first item in the history
Unbound   EndOfHistory            Move to the last item (the current input) in the history

List the current PowerShell command history settings in the PSReadLine module:

Get-PSReadlineOption | select HistoryNoDuplicates, MaximumHistoryCount, HistorySearchCursorMovesToEnd, HistorySearchCaseSensitive, HistorySavePath, HistorySaveStyle

You may want to consider the following PSReadline parameter:

• history no duplicates – whether to save a single command;
• max history count – the maximum number of orders stored (by default the last 4096 orders are saved);
• HistorySearchCursorMovesToEnd – whether it is necessary to jump to the end of the command when searching;
• istorySearchCaseSensitive – whether a search is case sensitive (PowerShell command history is not case sensitive by default);
• history savepath – path to a text file where the history of PowerShell commands is stored;;
• history save style – Command history saving option:
  • save slowly – commands are saved when executed (by default);
  • saveexit ,History is saved when you close the PowerShell console;
  • save nothing – Disable saving command history.

You can change the PSReadLine module settings with Set-PSReadlineOption command. For example, to increase the number of PowerShell commands stored in the log:

Set-PSReadlineOption -MaximumHistoryCount 10000

If you want to save not only executed commands but also their output in PowerShell command history, you can enable command transcription. Just add the following function to the user’s PowerShell profile (notepad $profile.CurrentUserAllHosts,

Function StartTranscript {
Trap {
Continue
}
$TranScriptFolder = $($(Split-Path $profile) + '\TranscriptLog\')
if (!(Test-Path -Path $TranScriptFolder )) { New-Item -ItemType directory -Path $TranScriptFolder }
Start-Transcript -Append ($($TranScriptFolder + $(get-date -format 'yyyyMMdd-HHmmss') + '.txt')) -ErrorVariable Transcript -ErrorAction stop
}
StartTranscript

User profiles now include a detailed log file for each PowerShell session %USERPROFILE%\Documents\WindowsPowerShell\TranscriptLog directory.

How to run PowerShell command without saving it in history?

In the Linux Bash shell, you can disable the history for commands starting with spaces (with HISTCONTROL= ignorespace, You can configure similar behavior for PowerShell.

To do this, add the following code to the PowerShell profile of the current user ( $profile.CurrentUserAllHosts ,

Set-PSReadLineOption -AddToHistoryHandler {
    param($command)
    if ($command -like ' *') {
        return $false
    }
    return $true
} 

Now, just start your command with a space If you don’t want it to be saved in the PowerShell command history.

In addition, starting from readline v2.0.4 module version, commands containing the following keywords are automatically ignored and not saved in history: Password, Asplaintext, Token, Apikey, Secret, At the same time, cmdlets from the SecretManagement password management module are considered secure and are allowed to be saved to the history file.

Using Predictive IntelliSense with PowerShell Command History

a new powershell predictive intellisense The feature is available in PSReadLine 2.2.2+. This feature displays the most appropriate commands from the local command history as you type commands in the PowerShell console.

In this example, I typed get-wm in the console, and predictive intelligence suggested one of the commands I typed earlier that matched my input. If this command suits me, I need to press right arrow key to accept this command and not to type the rest of the characters manually.

By default, predictive IntelliSense prompts are displayed in gray text and are difficult to read against the black background of the PowerShell console. This command makes the suggested text more odd:

Set-PSReadLineOption -Colors @{ InlinePrediction = '#7A957B'}

To reset IntelliSense predictive suggestions, press Esc key.

You can switch to another view by pressing F2 key. Now, instead of displaying the one most appropriate command (InlineView ), a drop-down list will be displayed with all similar commands (ListView,

Use the Up/Down keys to quickly select the command you need from the command history.

Predictive IntelliSense works with the standard pwsh.exe/powershell.exe command line as well as in Windows Terminal and Visual Studio Code.

How to clear command history in PowerShell?

As we mentioned above, the PSReadline module saves all PowerShell console commands to a text file. However, in some cases, the administrator has to enter various sensitive information in the PowerShell console (credentials, passwords, tokens, addresses, personal data, etc.). The history data in the plain text file can be accessed by another server administrator or attacker. For security reasons, you may want to clear the history of PowerShell commands you’ve run or turn off command history altogether.

clear history cmdlet allows you to clear the history of commands in the current PowerShell session only. This only removes the previous command list that get-history returned.

You can only remove one previous order from the history:

Clear-History -count 1 -newest

or clear all commands with a specific pattern:

Clear-History -CommandLine *set-ad*

To completely clear the history of previous PowerShell commands, you need to delete the ConsoleHost_history.txt file written by the PSReadline module. You can get the current PowerShell history file location and delete it with the command:

Remove-Item (Get-PSReadlineOption).HistorySavePath

Then, close the PowerShell console window.

If you want to completely disable saving PowerShell command history to a text file, run the command:

Set-PSReadlineOption -HistorySaveStyle SaveNothing

How to export/import PowerShell command history to another session?

Sometimes it’s convenient to have the same set of frequently used PowerShell commands on different computers. You can export the current command history on your computer to an XML file and import it on other computers. You can do this by copying the ConsoleHost_history.txt file in the user’s profile to the target computer.

you can also use Export-Clixml cmdlet

To export the command history from the current session to a text file:

Get-History | Export-Clixml -Path c:\ps\commands_hist.xml

To import command history from a file into another PowerShell session (on the local computer or on a different computer):

Add-History -InputObject (Import-Clixml -Path c:\ps\commands_hist.xml)

To automatically export previous commands to a file when a PowerShell session ends, you can bind the script to the PoSh session end event (!! The session must be ended with exit command, R, not just by closing the PowerShell console):

$HistFile = Join-Path ([Environment]::GetFolderPath('UserProfile')) .ps_history
Register-EngineEvent PowerShell.Exiting -Action { Get-History | Export-Clixml $HistFile } | out-null
if (Test-path $HistFile) { Import-Clixml $HistFile | Add-History }