How to view, search, and clear command history in PowerShell and CMD

Checking what we have typed in the console is pure gold. when we are documenting, repeating tasks or correcting errors. In Windows CMD and PowerShell coexist, and each one handles the history of commands in a different way, with shortcuts, search, export and delete options that are worth mastering.

In this practical and very complete guide You'll learn how to view, search, export, import, and delete history in PowerShell and CMD, how PSReadLine's persistent history works, what Clear-History switches offer, what shortcuts speed up your work, and how to audit processes with event 4688 and 4689 if you need a forensic log.

PowerShell vs. CMD: How Their History Works

PowerShell and CMD don't play in the same league when we talk about history. CMD only retains commands for the duration of the active session, while PowerShell combines a built-in session history with a persistent history maintained by the PSReadLine module.

PowerShell's built-in session history It's volatile and is cleared when the console is closed; it's queried with Get-History and managed with cmdlets such as Invoke-History, Add-History, or Clear-History. By default, the $MaximumHistoryCount variable limits the number of entries and is typically set to 4096.

PSReadLine saves a history file per user and host, and maintains history between sessions. This file, available since PowerShell 5.0, allows you to navigate with the up and down arrows and perform incremental searches using keyboard shortcuts.

View and search history in PowerShell

Get-History is the gateway to session history. Displays the ID, command line, and execution order; its alias is 'h'. However, it only reflects events in the current session, not the persistent PSReadLine file.

Get-History

On keyboard shortcuts on the console save time: Up arrow for previous commands, Down arrow for next ones, F7 to list in a window, ESC to close, F8 to search by prefix (type and press F8), and F9 to execute by ID.

Reverse lookup, very usefulCtrl+R searches backward in the history by typing part of the command, and Ctrl+S searches forward. PSReadLine also allows you to search with '#string' and jump between matches by pressing Tab.

The order of history may seem strange: PowerShell adds commands when they finish, not when you type them, and in nested prompts some are not logged until you return to the previous level, which can be confusing during long runs.

Persistent history with PSReadLine

PSReadLine maintains a permanent record in a text file per user and host, ensuring that previous commands can be recovered after closing and reopening PowerShell.

%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Its behavior can be queried and modified with Get-PSReadLineOption and Set-PSReadLineOptionThis allows you to configure aspects such as duplicates, case sensitivity, path and save style, among other preferences.

Get-PSReadLineOption | Select HistoryNoDuplicates, MaximumHistoryCount, HistorySearchCursorMovesToEnd, HistorySearchCaseSensitive, HistorySavePath, HistorySaveStyle

Key options to consider:

• HistoryNoDuplicates: avoids duplicate entries, reducing duplicates
• MaximumHistoryCount: Controls the maximum number of stored commands
• HistorySearchCursorMovesToEnd: Adjusts the cursor position in searches
• HistorySearchCaseSensitive: performs case-sensitive searches
• HistorySavePath: Defines the path to the history file
• HistorySaveStyle: Determines when history is saved, options include SaveIncrementally, SaveAtExit, and SaveNothing

It can be customized using Set-PSReadLineOption. For example, to save only on exit and reduce disk writes:

Set-PSReadLineOption -HistorySaveStyle SaveAtExit

Also control the history size with $MaximumHistoryCountTo limit it to 100 commands, adjust the variable and restart PowerShell; to make it persistent, add it to your PowerShell profile.

$MaximumHistoryCount = 100

Clear, filter, and manage history in PowerShell

Clear-History clears the history of the active session, without affecting the persistent PSReadLine file. Used to start from scratch or delete specific entries by ID, pattern, quantity, or age.

Main syntax with parameter sets:

Clear-History  <int[]>]  <int>]    
Clear-History  <int>] >]    

Parameters used-Id to delete by identifier, -CommandLine for exact patterns or wildcards, -Count for the number of entries, and -Newest to reverse the order and delete the most recent entries. It also supports confirmation and simulation mode with -WhatIf.

Example: delete all history in the active session:

Get-History
Clear-History
Get-History

Example: delete the last 5 entries with -Count and -Newest:

Clear-History -Count 5 -Newest
Get-History

Example: Remove entries that match patterns with -CommandLine:

Clear-History -CommandLine '*Help*', '*Syntax'
Get-History

Example: delete by specific IDs:

Clear-History -Id 3, 5
Get-History

Example: combining -Id and -Count To delete in sequence from a specific ID:

Clear-History -Id 7 -Count 5
Get-History

Remember: -Count with -Id removes from the included Id, with -CommandLine it removes matches in order, and by default it removes the oldest entries, unless you use -Newest.

Run and load commands from history in PowerShell

Invoke-History executes a history entry without having to rewrite it. Its alias is 'r'. Without parameters, it repeats the last command; with an Id, it executes exactly that command:

Invoke-History          # Repetir la última entrada
Invoke-History -Id 12   # Ejecutar la entrada 12

You can also export and import history. To document or share procedures. Export to CSV or Clixml and re-import by adding it with Add-History:

Get-History | Export-Csv -Path .\historial.csv -NoTypeInformation
Get-History | Export-Clixml -Path .\historial.xml

$h = Import-Clixml .\historial.xml
$h | Add-History

Related article:

How to Master Reliability History in PowerShell: Management, Auditing, and Analysis

View and manage history in CMD

CMD keeps only one history during the active sessionYou can navigate with the up and down arrows, use PgUp and PgDn to navigate, and press F7 to open a window with all your saved commands; ESC closes that window.

Other useful shortcuts in CMD: F9 to ask for the command number in the displayed list and F8 to search for matches that begin with what you have typed so far on the line.

Doskey expands capabilities: allows you to view the full history with 'doskey /history' or save it to a redirected file, e.g., 'doskey /history > C:\cmd_history.txt'. You can also adjust the memory size with /listsize=100.

To clear the history in memory, use the keyboard shortcut Alt+F7. Don't forget that when you close CMD, your history is lost unless you previously exported it.

To have a more powerful persistent history in CMD, you can use tools like Clink, which significantly improve history management and search, or Windows Bus Terminal, which integrates multiple consoles and support for PowerShell and WSL2.

Audit commands and processes with Event Viewer

For comprehensive and centralized controlYou can log process creation using advanced auditing. Event 4688 records each process started, with user, context, and command line information; 4689 indicates its termination.

Activate 'Audit process creation' In the local security policy, in the advanced audit section, setting Success and/or Failure as you prefer.

Then adjust the policy in gpedit.msc in Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies > Detailed Tracking and enable it.

To view these events, open Event Viewer in Windows, navigate to Windows Logs > Security, and filter by ID 4688. For more in-depth analysis, tools like Logbinder Supercharger can make the review easier.

Useful Cmdlets and History Notes in PowerShell

Main History Cmdlets: Get-History (alias 'h') to view, Invoke-History (alias 'r') to execute, Add-History to add commands, and Clear-History (alias 'clhy') to delete. PowerShell and PSReadLine history coexist, but Clear-History only affects the history of the active session.

Final Notes on Clear-History: does not accept piped input, does not return output, supports wildcards in -CommandLine, and supports CommonParameters such as -Verbose and -ErrorAction for additional control.

Related article:

Shell and CMD commands for the address bar in Windows 11

Mastering History in PowerShell and CMD facilitates rapid command retrieval, procedural debugging, documentation, and auditing. PSReadLine provides persistence and search power, while Clear-History controls which commands remain in the session, and events 4688 and 4689 elevate logging to a security and compliance level.

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.