Stop 4 of 9 · Daily
Scripts you can read
PowerShell and Bash from a plain-English ask, written so you can read every line before it runs, with a dry run first and a test machine before anything real.
Why scripts are the risky part
Everything else in this course produces text Tariq reads. A script produces text that runs. The failure mode is different: a triage summary that is slightly wrong wastes a question, while a filter that is slightly wrong empties a folder on 44 laptops at once.
So the rule for this stop is the one rule that never bends. Read every line before you run it. Not skim, read. If a line does something you cannot explain out loud, you do not run the script yet, you ask what that line does.
The four gates
| Gate | What it means |
|---|---|
| Read | Every line explained in your own words before it executes |
| Dry run | -WhatIf in PowerShell, an echo or a list-only pass in Bash |
| Test machine | A spare laptop or a VM, never the user's device |
| Scope | The narrowest target that proves it, one machine before a group |
Ask for the read-only version first. Almost every destructive script has a harmless twin that lists exactly what the real one would touch, and reading that list is faster than reasoning about the filter.
Get-ChildItem C:\Users -Directory |
Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-180) } |
Select-Object Name, LastWriteTime
That one only reads. When Tariq is satisfied the list is right, the removal step still runs with the dry-run flag on the first pass, and he reads the output before he takes the flag off.
Remove-Item $profilePath -Recurse -WhatIf
Asking for the script
Write me a PowerShell script for Windows 11 laptops managed by Intune at Grantham and Reed. Goal: find local user profiles that have not been used in 180 days and report them. Reporting only, no removal in this version. Before the code, explain in plain English what each step does and exactly what it reads or writes. Then give the code with a comment on every line that is not obvious. Then tell me what could go wrong and what output I should expect on a machine with nothing to report. Assume I run it in an elevated PowerShell session on one test laptop first.
Now give me the removal version of that script. It must support -WhatIf, refuse to touch any profile that is currently loaded or belongs to an account still enabled in Entra ID, and print the full list it would act on before it acts. Show me the exact command line I would use for the dry run, and the one I would use for real, separately.
Explain this script line by line in plain English. For each line say what it reads, what it changes and whether it can be undone. Then tell me the three things that would make it dangerous on a machine that is not identical to the one it was written for, and rewrite the riskiest line so it reports instead of acting. [paste the script you found]
That third prompt is the one to reach for when a forum post promises to fix your exact symptom. A script from the internet is an unread script, and unread scripts do not run on client machines.