Windows commands for command line

Go to category:

• network commands
• remote calling
• processes and services
• domain and group policy
• disk and file system
• information commands
• other
• switches - redirection operators
• scripts and batch files

Network

ping - tests the connection to a remote PC, measures the response time (latency)

• ping 192.168.10.5 - target PC by IP
• ping -t komp1 - target PC by DNS name (translation is performed) and doesn't stop after 4 packets

ipconfig - network adapter configuration (displays TCP/IP values)

• ipconfig /all - detailed output
• ipconfig /renew - renews the IP address of the interface
• ipconfig /registerdns - renews DHCP lease and re-registers the address with DNS
• ipconfig /flushdns - clears the DNS cache
• ipconfig /displaydns - displays the DNS cache

nslookup - finds DNS records, simply IP address to domain name

• has its own prompt after running
• nslookup www.seznam.cz - returns the A record from the primary DNS for the given domain
• ls -d {domain} - lists all records (if authorized) = Zone Transfer

arp - works with the ARP table (mapping IP addresses to MAC addresses)

• arp -a - displays the ARP table
• arp -d 157.55.85.212 - deletes the entry
• arp -s 157.55.85.212 00-aa-00-62-c6-09 - adds the entry

netstat - active TCP connections on a port

• netstat -b - lists the applications that created the connection
• netstat -r - displays the routing table
• netstat -ano | findstr 3044 – search

netdiag - client connection information, a diagnostic tool that tests the computer's network connection, verifies authorization, etc.

netsh - network shell - network configuration

• has its own prompt after running
• command-line commands (shell) for configuring everything related to networks
• for example, netsh interface ip IP address configuration

tracert - traceroute function, tracks the path to the target (through which nodes/hops)

• tracert www.google.com - pings individual hops

net - a wide range of commands related to networks, sharing, accounts, services

• net use Administrator password - changes the local user Administrator's password to "password"
• net use - displays mapped shares
• net use u: \\ok\d - maps the network path to a drive
• net user user - displays information about a local account
• net user user /expire:1.10.2011 - sets the expiration date for a local account
• net user user /domain - displays information about the domain account (e.g., last password change, login, logon script, global groups, etc.)
• net help user - help for the net user command
• net localgroup - lists existing local groups
• net localgroup /domain - lists existing groups in the domain

route - information about the routing table

• route print - displays the routing table

telnet - client for the Telnet service, suitable for testing the operation of an application on a specific port

• telnet www.google.com 80 - connects to the specified address and port

ftp - simple FTP client

tftp - simple TFTP client

pathping - combination of ping and traceroute functions, quickly checks the path to the target and lists hops, performs statistics for each hop using ping

• pathping -q 10 www.google.com - query the target by DNS, 10 queries for each hop (shortens execution time)

nbtstat - works with NetBIOS, mainly for troubleshooting

• nbtstat -n - locally registered names
• nbtstat -c - displays the contents of the NetBIOS cache
• nbtstat -RR - refreshes the record on the WINS server

Network Commands

ping - tests connectivity to a remote PC, measures response time (latency)

• ping 192.168.10.5 - target PC by IP
• ping -t komp1 - target PC by DNS name (translation will be performed) and does not stop after 4 packets

ipconfig - configures network adapters (displays TCP/IP values)

• ipconfig /all - detailed output
• ipconfg /renew - renews the IP address of the interface
• ipconfig /registerdns - renews DHCP lease and re-registers the address with DNS
• ipconfig /flushdns - clears the DNS cache
• ipconfig /displaydns - displays the DNS cache

nslookup - finds DNS records, simplifies to IP address for domain names

• after starting, it has its own prompt
• nslookup www.seznam.cz - returns A record from the primary DNS for the given domain
• ls -d {domain} - lists all records (if permissions allow) = Zone Transfer

arp - works with ARP table (mapping IP addresses to MAC addresses)

• arp -a - displays the ARP table
• arp -d 157.55.85.212 - deletes a record
• arp -s 157.55.85.212 00-aa-00-62-c6-09 - adds a record

netstat - active TCP connections on ports

• netstat -b - lists applications that created the connections
• netstat -r - displays the routing table
• netstat -ano | findstr 3044 – search

netdiag - information about client connections, diagnostic tool that tests computer network connections, verifies authorization, etc.

netsh - network shell - network configuration

• after starting, it has its own prompt
• command-line tool (shell) for configuring everything related to networks
• e.g., netsh interface ip for configuring IP addresses

tracert - traceroute function, tracks the path to the target (through which nodes/hops)

• tracert www.google.com - pings individual hops

net - wide range of commands related to networks, sharing, accounts, services

• net use Administrator password - changes the password of the local Administrator user to the given password
• net use - displays mapped shares
• net use u: \\ok\d - maps a network path to a drive
• net user user - displays information about the local account
• net user user /expire:1.10.2011 - sets the expiration date for a local account
• net user user /domain - displays information about the domain account (e.g., last password change, login, logon script, global groups, etc.)
• net help user - help for the net user command
• net localgroup - lists existing local groups
• net localgroup /domain - lists existing domain groups

route - information about the routing table

• route print - displays the routing table

telnet - client for the telnet service, suitable for testing the running of an application on a certain port

• telnet www.google.com 80 - connects to the specified address and port

ftp - simple FTP client

tftp - simple TFTP client

pathping - combines ping and traceroute functions, quickly traverses the path to the target and lists hops, performs statistics for each hop using ping

• pathping -q 10 www.google.com - queries the target by DNS, 10 queries for each hop (shortens execution time)

nbtstat - works with NetBIOS, mainly for troubleshooting

• nbtstat -n - locally registered names
• nbtstat -c - displays the NetBIOS cache contents
• nbtstat -RR - refreshes the WINS server record

Remote Calls

winrm - Windows Remote Management - remote command execution, WS-Management protocol

• winrm quickconfig - configuration on the server

winrs - remote command execution on a server where WinRM is running

• winrs -r:COMPUTER ipconfig - executes the ipconfig command on the COMPUTER server and returns the result

Processes and Services

sc - service control

• sc delete name - deletes a service
• sc create name - adds a service
• sc start name - starts a service

net - the net command can also be used to control services

• net start name - starts a service
• net stop name - stops a service

tasklist - displays running system processes, similar to Task Manager, can be used on a remote computer, shows relationships between processes

• tasklist /svc - shows services in each process
• tasklist /fi "PID eq 2500" - searches for a process with a specific ID

runas - starts an application with different privileges

• runas /user:ok\peter cmd.exe - runs cmd as the user peter

at - scheduled remote execution, schedules a specific command/task on a remote computer

shutdown - shuts down or restarts the computer

• shutdown -r -f -t 1 - restarts the PC in 1 second with forced application termination

reg - command-line tool for working with the registry (like regedit), search, insert, delete...

tskill - terminates a process by PID or name, even on a remote PC

taskkill - a more powerful command to terminate a process, can use filters, and terminate multiple processes at once

Domain and Group Policy

gpresult - Group Policy Result Tool

• information about applied policies and security groups to which the computer and logged-in user belong

gpupdate - updates group policies, normally only changes, can also be used on a remote PC

• gpupdate /force - reapplies all policies

dsadd - adds an object to AD

• dsadd ou ou=test,dc=company,dc=local - creates the test organizational unit in company.local

dsquery - queries information in AD

• dsquery server - lists DC servers
• dsquery server -hasfsmo schema - shows who holds the Schema Master role
• dsquery server -hasfsmo name - shows who holds the Domain Naming Master role
• dsquery server -hasfsmo infr - shows who holds the Infrastructure Master role
• dsquery server -hasfsmo pdc - shows who holds the PDC Emulator role
• dsquery server -hasfsmo rid - shows who holds the RID Master role
• dsquery user -SAMID %USERNAME% - searches for a user by SAM account name (uses the currently logged-in user) and returns their DN (distinguished name)

dsget - retrieves information from AD

• dsquery user -SAMID %USERNAME% | dsget user -SID - returns the SID of the currently logged-in user from AD

dsacls - manages ACL (permissions) on AD DS objects, part of Support Tools

• dsacls CN=Guest,CN=Users,DC=company,DC=local - displays ACL on the Guest user

ntdsutil - database maintenance of the Active Directory store, manages FSMO, performs authoritative restore

browstat - displays information about the domain, PDC, and browser, the command is from the Windows Resource Kit

• browstat sta - displays statistics for transports

certutil - command-line control of the certification authority, part of Certificate Services

• certutil -dcinfo - displays information about domain controller certificates

netdom - joins a computer to a domain, renames, establishes trust, the command is from Remote Server Administration Tools, Support Tools

• netdom renamecomputer old /newname:new /userd:domain\admin /passwordd:* /reboot:60 - changes the computer name (locally and in the domain), restarts after 60 minutes
• netdom query /d:domain FSMO - lists servers that hold FSMO roles
• netdom verify computer - verifies connection to the DC and displays its name

redircmp - changes the default container where a computer account is placed after joining a domain

• redircmp ou=computers,dc=company,dc=local - sets the default container

auditpol - manages auditing policies, displays, and sets parameters

• Auditpol /list /subcategory:* - lists available subcategories
• Auditpol /get /category:* - displays current settings

Disk and File System

chkdsk - disk check, checks the FAT table and disk surface

• chkdsk /f - performs repairs

chkntfs - disables automatic disk check on startup, can also perform an unscheduled check

• chkntfs /d - restores settings

diskpart - disk management, partition management, text-based interface for creating/deleting and modifying VOLUME, PARTITION with RAID support

• after launching, it has its own prompt
• expand can expand partition size

fsutil - file system management

• fsutil dirty query c: - check the status of NTFS

dir - displays directory contents

attrib - displays and sets file attributes

copy - copies files

xcopy - copies files including subdirectories with many options

robocopy - copies/synchronizes directories, including subdirectories and permissions, an enhanced version of xcopy, with backup options, part of the system since Windows Vista

md - creates a directory

rd - removes a directory

bootcfg - configures BOOT.INI

del - deletes a file

cacls - configures ACL on files, can be used to display directories along with assigned permissions (including AD groups)

• cacls d:\*.* > decko.txt - lists the contents of drive D (root only) along with permissions for each folder and file, output is saved to a file

icacls - replacement for the cacls command

• icacls d:\* /save decko.txt /T - lists the contents of drive D (recursively) along with permissions for each folder and file, output is saved to a file

find - searches for a string inside files

subst - assigns a drive letter to a directory

type - displays the contents of a file in text format

takeown - takes ownership of a folder/file (admin rights required), enabling access where it was previously restricted, can also be used remotely

• takeown /F d:\folder /R /A - sets ownership for the administrators group on the folder d:\folder and all subfolders and files

mklink - creates a link to a file or folder, supports file symbolic link, directory symbolic link, directory junction, hard link

• mklink /D link source - creates a symlink named "link" for the folder at "source"
• mklink /J elsewhere c:\somewhere - creates a directory junction in the current folder, generally works better than a symlink

Information

systeminfo - overview of basic system info, including installed hotfixes

ver - displays the operating system version

now - displays the current date and time

whoami - displays the name of the logged-in user (and optionally more information)

• whoami /all - provides more detailed information, including group memberships

set - configures environment variables

• set - lists set variables, important system values are included (e.g., the name of the workstation, the DC it authenticated to)
• set test=15 - sets a variable

winsat - Windows System Assessment Tool - measures various parameters and properties of the computer

• winsat disk - measures disk speed (performance)
• winsat mem - measures memory speed
• winsat features - displays computer parameters

cmdkey - manages stored usernames and passwords (credentials) in the system, found in User Accounts - Manage your credentials

• cmdkey /list - displays all stored credentials

wevtutil - retrieves information from event logs (Event log)

• wevtutil el - lists all logs
• wevtutil qe Application /c:3 /rd:true /f:text - returns the last 3 events from the Application log in text format

Others

w32tm - time synchronization

• w32tm /config /manualpeerlist:131.107.1.10 /syncfromflags:MANUAL - synchronizes the DC with an external source
• w32tm /config /update - updates the configuration
• w32tm /resync - triggers synchronization

certreq - requests a certificate from a CA

logman - creates and manages Event Trace Session and Performance logs for Performance Monitor

Switches - redirection operators

First, a simplified (and not entirely accurate) description of some general switches that can be used with other commands (we will explain later how it actually works).

| more - paginates output (waits for a key press before continuing output after filling a page), added after a command using | (pipe symbol)

• dir c:\windows | more

| findstr - searches the output for the specified string and displays only those lines, added after a command using | (pipe symbol)

• dir c:\windows | findstr system

| sort - sorts and displays the passed lines, added after a command using | (pipe symbol)

• dir c:\windows | sort /+13

In reality, these are not general switches but rather the use of one redirection operator, in this case, | pipe, combined with regular commands (programs) like more and findstr. With these operators, we can redirect the input and output of commands.

> (greater-than sign) - redirects the output of a command to a file or device (like a printer), by default it outputs to the command prompt window

• dir c:\windows > c:\output.txt - saves the directory contents to a file on disk

>> (double greater-than sign) - similar to the > command, but appends to the specified file

• type file2.txt >> file1.txt - merges file1.txt and file2.txt

< (less-than sign) - redirects command input from a file, by default it reads from the keyboard

• create a file called cmd.txt and enter the commands select disk 0 and list partition on separate lines
• diskpart < cmd.txt - displays the list of partitions on disk 0

| (pipe symbol) - redirects the output of the first command as input to the second command

• dir c:\windows | find "system" - from the directory listing, displays only lines containing the string "system"

& (ampersand) - combines two commands, executes the first and then the second

• dir c:\ & dir d:

Scripts and Batch Files (cmd, bat)

for - conditionally executes a command multiple times (works with files and directories as well), many usage options

if - conditional statement in a batch file

• if exist test.txt (del test.txt) else (echo Not found) - if the file test.txt exists, it deletes it, otherwise it prints a message

goto - jumps to a label inside a batch file

• goto End - jumps to the label "End"
  :End - label for the jump

echo - prints the specified text

• echo test - prints the word "test"
• echo %windir% - prints the content of a variable

cls - clears the screen (command prompt window)

exit - exits the script or command prompt window

start - runs a command in a separate command prompt window (and does not wait for the command to finish)

• start dir c:

pause - waits for a key press

sleep - waits for a specified number of seconds, the command is from the Windows Resource Kit