CmdID / PowerShell / Cmdlets / Move
Move-Item
Moves an item from one location to another. PowerShell reference
From the PowerShell reference
12 parameters
Aliases mi, move, mv
2 Sigma rules look for it
What it does
Moves an item from one location to another. The Move-Item cmdlet moves an item, including its properties, contents, and child items, from one location to another location. The locations must be supported by the same provider. For example, it can move a file or subdirectory from one directory to another or move a registry subkey from one key to another. When you move an item, it is added to the new location and deleted from its original location. If the specified destination path resolves to an existing non-container item, or you're moving and the target name already exists, this cmdlet raises an error. To overwrite an existing item, use the Force parameter. When the destination is an existing container (such as a directory), the item is moved into that container, if supported by the provider.
Move-Item [-Path] <String[]> [[-Destination] <String>] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Move-Item -LiteralPath <String[]> [[-Destination] <String>] [-Force] [-Filter <String>] [-Include <String[]>] [-Exclude <String[]>] [-PassThru] [-Credential <PSCredential>] [-WhatIf] [-Confirm] [-UseTransaction] [<CommonParameters>]Move a file to another directory and rename it
Move-Item -Path C:\test.txt -Destination E:\Temp\tst.txtIdentifyMove a directory and its contents to another directory
Move-Item -Path C:\Temp -Destination C:\LogsIdentifyMove all files of a specified extension from the current directory to another directory
Move-Item -Path .\*.txt -Destination C:\LogsIdentifyRecursively move all files of a specified extension from the current directory to another directory
Get-ChildItem -Path ".\*.txt" -Recurse | Move-Item -Destination "C:\TextFiles"IdentifyMove registry keys and values to another key
Move-Item "HKLM:\software\mycompany\*" "HKLM:\software\mynewcompany"IdentifyMove a directory and its contents to a subdirectory of the specified directory
Move-Item -LiteralPath 'Logs[Sept06]' -Destination 'Logs[2006]'IdentifyIts page in the reference: Move-Item.
Parameters
-CredentialNOTE: This parameter is not supported by any providers installed with PowerShell. To impersonate another user, or elevate your credentials when running this cmdlet, use Invoke-Command.-DestinationSpecifies the path to the location where the items are being moved. The default is the current directory. Wildcards are permitted, but the result must resolve to a single location.
To rename the item being moved, specify a new name in the value of the Destination parameter.-ExcludeSpecifies, as a string array, an item or items that this cmdlet excludes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Exclude parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-FilterSpecifies a filter to qualify the Path parameter. The FileSystem provider is the only installed PowerShell provider that supports the use of filters. You can find the syntax for the FileSystem filter language in about_Wildcards. Filters are more efficient than other parameters, because the provider applies them when the cmdlet gets the objects rather than having PowerShell filter the objects after they are retrieved.-ForceForces the command to run without asking for user confirmation. For the FileSystem provider, if a file exists at the target location, you can't overwrite it without using this parameter. Using this parameter doesn't allow you to overwrite read-only files or files that you don't have rights to modify.
The behavior varies from provider to provider. For more information, see about_Providers.-IncludeSpecifies, as a string array, an item or items that this cmdlet includes in the operation. The value of this parameter qualifies the Path parameter. Enter a path element or pattern, such as *.txt. Wildcard characters are permitted. The Include parameter is effective only when the command includes the contents of an item, such as C:\Windows\*, where the wildcard character specifies the contents of the C:\Windows directory.-LiteralPathSpecifies the path to the current location of the items. The value of LiteralPath is used exactly as it is typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose it in single quotation marks ('). Single quotation marks tell PowerShell not to interpret any characters as escape sequences.
For more information, see about_Quoting_Rules.-PassThruReturns an object representing the moved item. By default, this cmdlet does not generate any output.-PathSpecifies the path to the current location of the items. The default is the current directory. Wildcard characters are permitted.-UseTransactionIncludes the command in the active transaction. This parameter is valid only when a transaction is in progress. For more information, see about_Transactions.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.