How to Use Get-ChildItem in Powershell

James Futhey

May 28, 2025 • 5 min read

The Get-ChildItem cmdlet is one of the most frequently used commands in PowerShell. It allows users to retrieve the contents of a folder, registry hive, or certificate store, making it essential for file system navigation and automation tasks.

Whether you're listing files in a directory, filtering for specific attributes, or working with registry keys, understanding how this cmdlet works is foundational for any PowerShell user.

What is the Get-ChildItem Cmdlet?

The Get-ChildItem cmdlet retrieves the child items - such as files and subdirectories - within a specified container. It works across multiple providers, including the file system, registry, and certificate store.

This cmdlet is often used to list files in a directory, recursively search for items, or filter results based on attributes like hidden, read-only, or system files.

Key Parameters of the Get-ChildItem Cmdlet

Below is an overview of key parameters used with the Get-ChildItem cmdlet. These parameters control what is listed, how deep the listing goes, and how outputs are filtered or formatted.

Parameter	Description
-Path	Specifies the location to search. Accepts a string or string array. You can use wildcard characters. The Path parameter is optional if used in the current location. Example: -Path "C:Test Folder"
-Recurse	Searches all child containers recursively. Used for walking a directory tree or registry key hierarchy.
-Directory	Limits results to directories only. Works with the file system provider.
-File	Limits results to files only. Excludes directories and containers.
-Name	Returns only the names of items, not full object details. Useful for scripts needing plain output.
-Force	Includes hidden and system items in the output. Without this, hidden files or folders are excluded.
-Attributes	Filters results by file or folder attributes. Example: -Attributes !ReadOnly,HidDen to exclude read-only and hidden items.
-Include	Filters output by a specific string pattern within the specified -Path . Must be used with -Recurse in some scenarios.
-Exclude	Omits matching items based on a filter string. Can use wildcard characters.
-Filter	Applies a search string at the provider level. Generally faster than -Include or -Exclude .
-Depth	Limits how many levels of subdirectories to search when using -Recurse . Introduced in PowerShell 7.1.
-Hidden	Returns only hidden items. Functions similarly to using -Attributes Hidden .
-CodeSigningCert	Used with the Certificate provider to list certificates with the CodeSigningCert attribute.
Common Parameters	Includes -Verbose , -ErrorAction , and others shared across most cmdlets.

Each of these parameters is context-sensitive. For example, -File and -Directory only apply to the FileSystem provider. Other providers, such as Registry or Certificate, support a different set of parameters, which may include -CodeSigningCert, or dynamic parameters available only at runtime.

Using combinations of these parameters allows you to tailor the output precisely - for instance, listing all non-hidden items recursively from a target location up to a certain depth:

Get-ChildItem -Path "C:Project" -Recurse -Depth 2 -File -Attributes !Hidden

This command gets all non-hidden files up to two levels deep from the directory "C:Project".

Key Differences: Get ChildItem vs Get-Item

Feature	Get-ChildItem	Get-Item
Output	Lists all child items in a container	Retrieves a single item
Recursive Search	Supports -Recurse and -Depth	No support for recursion
Filtering	Supports multiple filters and attributes	Limited filtering
Usage	Lists files, directories, registry keys	Gets a specific item object
Common Scenario	Listing folder contents or registry keys	Getting a single file or key

3 Practical Use Cases for the Get-ChildItem Cmdlet in PowerShell

Here are three common scenarios where Get-ChildItem proves especially useful:

1. Listing All Files in a Directory Tree

System administrators often need a quick way to audit all files under a given path, including subfolders. By combining Get-ChildItem with the -Recurse flag, they can retrieve a complete list of all files in a directory tree:

Get-ChildItem -Path "C:UsersJohnDoeDocuments" -Recurse

This helps when preparing for backups, scanning file types, or identifying large folders.

2. Filtering Specific File Types or Attributes

When working with logs, scripts, or other targeted file types, the -Filter or -Include parameters help limit output to relevant items. For example, to find all .log files in a folder:

Get-ChildItem -Path "C:Logs" -Filter *.log

This is especially helpful for troubleshooting, cleaning up old files, or reviewing application outputs.

3. Auditing Hidden or System Files

To identify hidden or system-protected files, administrators can use the -Attributes parameter. For instance, to list all hidden files in a directory:

Get-ChildItem -Path "C:Temp" -Attributes Hidden

This is useful during security audits, forensic checks, or when verifying that system files are correctly placed and untouched.

Prerequisites

Before using Get-ChildItem, ensure the following requirements are met:

PowerShell Version: The cmdlet works in Windows PowerShell 5.1 and in PowerShell 7.1 and above, including PowerShell Core on cross-platform systems.

Module Availability: Get-ChildItem is included in the Microsoft.PowerShell.Management module, which is loaded by default in most environments.

Permissions: You must have the necessary access rights for the resource you're querying. For example, reading from a secured directory, registry hive, or certificate store requires appropriate permissions.

Supported Providers: The behavior of Get-ChildItem changes depending on the provider (e.g., FileSystem, Registry, Certificate, Environment). Some parameters and outputs vary across providers.

Check Providers: Use the Get-PSProvider cmdlet to view available providers on your system and confirm compatibility with your target path:

How to Use Get-ChildItem in Powershell: 6 Examples

1. List Files in the Current Directory

If no -Path is specified, Get-ChildItem defaults to the current working directory. This command lists all non-hidden files and folders in that location. It’s the simplest way to inspect what's in your present directory.

Get-ChildItem

2. List Files with Specific Extension

Use the -Filter parameter to return only files matching a certain pattern - in this case, files ending in .txt. It’s more efficient than using Where-Object because filtering happens at the provider level.

Get-ChildItem -Path "C:Users" -Filter "*.txt"

3. Use Wildcard Characters for Flexible Matching

This matches any .log file that contains “2023” in the filename. You can use * to match zero or more characters and ? to match a single character. Useful for retrieving files with partial or uncertain names.

Get-ChildItem -Path "C:Logs*2023*.log"

4. Get a List of Directories Only

Adding the -Directory switch limits the output to only folders, excluding files. This is ideal when you need to process or loop through folders only (e.g., for backups or batch operations).

Get-ChildItem -Path "C:Projects" -Directory

The -Directory parameter filters the output to show only folder names.

5. Include Hidden Items and System Files

By default, hidden files and system items are excluded. Use -Force to include them in the results - especially useful when working in protected directories like C:\Windows where many items are hidden by design.

Get-ChildItem -Path "C:Windows" -Force

The -Force parameter displays hidden items and system files not shown by default.

6. Use Complex Combinations of Attributes

This command returns all files in C:\Reports and its subdirectories (-Recurse) that are not read-only (!ReadOnly) and are marked as archive (Archive). It’s helpful when managing files based on specific file system attributes - common in automated cleanup or backup tasks.

Get-ChildItem -Path "C:Reports" -Attributes !ReadOnly,Archive -Recurse

The Get-ChildItem cmdlet is a versatile and essential command for listing and filtering items within containers in PowerShell. Whether working with directories, registry nodes, or certificates, knowing how to use its parameters like -Path, -Recurse, -Filter, and -Attributes makes it easier to generate precise outputs.

Mastering its use helps in tasks ranging from file system cleanup to registry analysis and automation.