PowerShell production operations checklist with practical examples: practical implementation guide

Intro

PowerShell is excellent for Windows and cross-platform automation, but production demands consistency, safety, and observability. This guide gives you a practical production checklist with code you can copy, adapt, and ship. It focuses on:

• Configuration and hardening
• Securing credentials and secrets
• Logging and monitoring
• Error handling and idempotency
• Deployment and versioning
• Maintenance and backups
• Upgrades and compatibility
• Common production pitfalls to avoid

Use this as your team baseline to reduce surprises and keep operations boring in the best way.

Workflow Overview

A predictable workflow cuts rework and makes outcomes repeatable. Implement these stages:

1. Baseline and harden

• Set strict mode and safe error policy
• Verify execution policy and remoting needs

1. Secure secrets

• Store credentials safely, never in code

1. Safe script pattern

• Use CmdletBinding, ShouldProcess, -WhatIf, -Confirm
• Validate parameters and return structured output

1. Observability

• Start-Transcript for sessions
• Structured logs (JSONL)
• Event Log entries for key actions and failures

1. Package and version

• Create modules with manifests, pin dependencies
• Sign scripts where possible

1. Release safely

• Small, incremental changes with clear rollback

1. Operate and maintain

• Scheduled tasks for routine jobs
• Health checks and log rotation

1. Backups

• Scripts, configs, and module caches saved and restorable

1. Upgrades

• Validate versions and compatibility in a small ring first

1. Review and improve

• Capture learnings and refine defaults

Configuration Baseline

Harden your default shell behavior and host setup.

# Run in an elevated session where required
# 1) Execution policy (adjust per org policy)
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy RemoteSigned -Force

# 2) Strict mode and stop on errors
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# 3) Enable remoting only if you need remote management
#    Configure firewall and authentication as per your security policy
Enable-PSRemoting -Force

# 4) Ensure script directories are locked down
$opsRoot = 'C:\Ops'
New-Item -ItemType Directory -Path $opsRoot -Force | Out-Null
# Example: restrict to Administrators and a service account
icacls $opsRoot /inheritance: r | Out-Null
icacls $opsRoot /grant 'Administrators:(OI)(CI)F' | Out-Null

Least privilege: prefer standard user contexts or constrained endpoints over full admin.

Optional JEA (Just Enough Administration) role capability example:

# Create a minimal role that allows service inspection and restart
$rcPath = 'C:\Program Files\WindowsPowerShell\Modules\Company.Jea\RoleCapabilities\OpsMaintenance.psrc'
New-Item -ItemType Directory (Split-Path $rcPath) -Force | Out-Null
New-PSRoleCapabilityFile -Path $rcPath -VisibleCmdlets 'Get-Service','Restart-Service'

Secure Credentials and Secrets

Rules of thumb:

• Never hardcode secrets in code or repo
• Prefer a secret vault; otherwise use DPAPI-protected exports for local use
• Lock down file ACLs and log access

Example: store a credential for use on the same machine and user context.

# One-time setup by an operator account
$credPath = 'C:\Ops\svc_cred.xml'
Get-Credential | Export-Clixml -Path $credPath
icacls $credPath /inheritance: r | Out-Null
icacls $credPath /grant "$($env: USERNAME):(R)" | Out-Null

# In your script
$svcCred = Import-Clixml -Path $credPath

Never commit exported secrets to version control. Rotate and revoke access regularly.

Logging and Monitoring

Aim for fast local inspection and central visibility.

1. Transcripts for ad hoc sessions:

Start-Transcript -Path 'C:\Logs\ops-transcript.txt' -Append
# ... run commands ...
Stop-Transcript

1. Structured JSONL logging helper:

$LogPath = 'C:\Logs\ops.jsonl'
New-Item -ItemType Directory -Path (Split-Path $LogPath) -Force | Out-Null

function Write-LogJson {
  param(
    [Parameter(Mandatory)] [ValidateSet('INFO','WARN','ERROR')] [string]$Level,
    [Parameter(Mandatory)] [string]$Message,
    [hashtable]$Data
  )
  $obj = [ordered]@{
    ts    = (Get-Date).ToString('o')
    level = $Level
    msg   = $Message
    data  = $Data
  }
  $line = $obj | ConvertTo-Json -Compress
  Add-Content -Path $LogPath -Value $line -Encoding utf8
}

Write-LogJson -Level INFO -Message 'Startup' -Data @{ host = $env: COMPUTERNAME }

1. Windows Event Log source and writes:

$src = 'Company.PowerShell.Ops'
if (-not [System.Diagnostics.EventLog]::SourceExists($src)) {
  New-EventLog -LogName Application -Source $src
}
Write-EventLog -LogName Application -Source $src -EntryType Information -EventId 1001 -Message 'Ops script started.'

Error Handling and Idempotency

Always treat errors as first-class citizens and make scripts safe to re-run.

• Set $ErrorActionPreference = 'Stop' in automation contexts
• Use try { } catch { } finally { }
• Support -WhatIf and -Confirm with SupportsShouldProcess for change actions
• Check current state and only apply diffs (idempotency)

Example: ensure a service is running, safely and idempotently.

function Ensure-ServiceRunning {
  [CmdletBinding(SupportsShouldProcess = $true)]
  param(
    [Parameter(Mandatory)] [string]$Name
  )
  try {
    $svc = Get-Service -Name $Name -ErrorAction Stop
    if ($svc.Status -ne 'Running') {
      if ($PSCmdlet.ShouldProcess("service $Name", 'Start')) {
        Start-Service -Name $Name -ErrorAction Stop
        Write-LogJson -Level INFO -Message 'Service started' -Data @{ name = $Name }
      }
    } else {
      Write-LogJson -Level INFO -Message 'Service already running' -Data @{ name = $Name }
    }
  } catch {
    Write-LogJson -Level ERROR -Message 'Failed to ensure service' -Data @{ name = $Name; err = $_.Exception.Message }
    throw
  }
}

# Dry run
Ensure-ServiceRunning -Name 'Spooler' -WhatIf

Deployment and Versioning

Package reusable code and ship with control.

1. Module manifest and dependency pinning:

$moduleRoot = 'C:\Ops\Company.Ops'
New-Item -ItemType Directory -Path $moduleRoot -Force | Out-Null

New-ModuleManifest -Path (Join-Path $moduleRoot 'Company.Ops.psd1') `
  -RootModule 'Company.Ops.psm1' `
  -ModuleVersion '1.0.0' `
  -Author 'Ops Team' `
  -Description 'Operations helpers for production' `
  -RequiredModules @(@{ ModuleName = 'Microsoft.PowerShell.Management'; ModuleVersion = '7.0.0.0' })

1. Script signing (use an appropriate code signing cert):

$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert | Select-Object -First 1
Set-AuthenticodeSignature -FilePath 'C:\Ops\Ensure-Service.ps1' -Certificate $cert

1. Versioned releases:

• Bump module version on every release
• Keep a CHANGELOG and tag builds
• Distribute via your approved channel (file share, package repo, or configuration management)

Maintenance and Backups

Automate routine work and make restores boring.

1. Scheduled task example for nightly log rotation:

$taskName = 'RotateLogs'
$action = New-ScheduledTaskAction -Execute 'pwsh.exe' -Argument '-NoProfile -File C:\Ops\Rotate-Logs.ps1'
$trigger = New-ScheduledTaskTrigger -Daily -At 2:00AM
Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -RunLevel Highest -User 'SYSTEM'

1. Back up scripts, configs, and module versions:

# Backup module versions to a share
Save-Module -Name Company.Ops -RequiredVersion 1.0.0 -Path \\backup\psmodules

# Backup configuration
$cfg = @{ Services = @('Spooler','W32Time'); LogPath = 'C:\Logs\ops.jsonl' }
$cfg | Export-Clixml 'C:\Ops\config.xml'

1. Test restore paths regularly:

# Restore module to a temp path and import
Save-Module -Name Company.Ops -RequiredVersion 1.0.0 -Path 'C:\Temp\Cache'
Import-Module 'C:\Temp\Cache\Company.Ops\1.0.0\Company.Ops.psd1' -Force

Upgrades and Compatibility

Minimize surprises when moving to new runtimes or dependencies.

• Check versions explicitly:

$PSVersionTable.PSVersion
Get-Module | Select-Object Name, Version, Path

• Run scripts with -NoProfile for deterministic behavior
• Validate in a small ring first, then expand
• Keep Windows PowerShell 5.1 and PowerShell 7 side-by-side if needed
• Prefer LTS releases where available

Common Production Pitfalls

Avoid these mistakes and apply the fix.

• Running everything as admin
• Fix: use least privilege or JEA roles

• Secrets in code or logs
• Fix: use protected stores, redact on write

• Ignoring errors
• Fix: $ErrorActionPreference = 'Stop' and wrap with try/catch

• No dry-run support
• Fix: implement SupportsShouldProcess, honor -WhatIf and -Confirm

• No logs or only ad hoc console output
• Fix: centralized JSONL and Event Log entries

• Non-idempotent scripts
• Fix: check current state and only apply changes

• No timeouts or retries on remote calls
• Fix: set -TimeoutSec, add retry with backoff where appropriate

• Mixing interactive and automation logic
• Fix: parameterize, fail fast on missing inputs, avoid prompts in unattended runs

Local Pilot Plan

Start with a small, inspectable pilot to learn fast and reduce risk. Example pilot: ensure the Print Spooler service is running on one host.

Scope and success:

• Goal: Ensure service Spooler is Running
• Success metric: Exit code 0, JSONL log entry with level=INFO, EventId 1001 written
• Runtime: under 2 seconds on target host

Steps:

1. Create a working folder and logs

New-Item -ItemType Directory -Path C:\Ops -Force | Out-Null
New-Item -ItemType Directory -Path C:\Logs -Force | Out-Null

1. Add the logging helper and Ensure-ServiceRunning function (from earlier sections) into C:\Ops\Ensure-Service.ps1.

1. Dry run locally

pwsh -NoProfile -File C:\Ops\Ensure-Service.ps1 -WhatIf
Get-Content C:\Logs\ops.jsonl -Tail 5

1. Real run

pwsh -NoProfile -File C:\Ops\Ensure-Service.ps1
wevtutil qe Application /c:5 /q:"*[System[Provider[@Name='Company.PowerShell.Ops']]]" /f: text

1. Schedule it hourly with rollback plan (disable the task)

$taskName = 'EnsureSpooler'
$action = New-ScheduledTaskAction -Execute 'pwsh.exe' -Argument '-NoProfile -File C:\Ops\Ensure-Service.ps1'
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(5) -RepetitionInterval (New-TimeSpan -Minutes 60) -RepetitionDuration ([TimeSpan]::MaxValue)
Register-ScheduledTask -TaskName $taskName -Action $action -Trigger $trigger -RunLevel Highest -User 'SYSTEM'
# Rollback: Unregister-ScheduledTask -TaskName EnsureSpooler -Confirm:$false

1. Document findings and expand to the next small service or host ring.

Conclusion

You now have a production-ready PowerShell checklist and practical examples to apply immediately:

• Harden the environment and enforce strict, stop-on-error defaults
• Protect secrets, log in structured form, and write to the Event Log
• Design idempotent scripts with -WhatIf and safe error handling
• Package, version, and sign what you ship
• Automate maintenance, back up code and configs, and test restores
• Upgrade in small rings with explicit compatibility checks

Start with the local pilot, measure success, and iterate. Keep security, observability, and idempotency as defaults, and production will become predictable and low risk.