Useful Command-line Commands on Windows

Question

The aim for this Wiki is to promote using a command to open up commonly used applications without having to go through many mouse clicks - thus saving time on monitoring and troubleshooting Windows machines.

Answer entries need to specify

• Application name
• Commands
• Screenshot (Optional)

Shortcut to commands

• && - Command Chaining
• %SYSTEMROOT%\System32\rcimlby.exe -LaunchRA - Remote Assistance (Windows XP)
• appwiz.cpl - Programs and Features (Formerly Known as "Add or Remove Programs")
• appwiz.cpl @,2 - Turn Windows Features On and Off (Add/Remove Windows Components pane)
• arp - Displays and modifies the IP-to-Physical address translation tables used by address resolution protocol (ARP)
• at - Schedule tasks either locally or remotely without using Scheduled Tasks
• bootsect.exe - Updates the master boot code for hard disk partitions to switch between BOOTMGR and NTLDR
• cacls - Change Access Control List (ACL) permissions on a directory, its subcontents, or files
• calc - Calculator
• chkdsk - Check/Fix the disk surface for physical errors or bad sectors
• cipher - Displays or alters the encryption of directories [files] on NTFS partitions
• cleanmgr.exe - Disk Cleanup
• clip - Redirects output of command line tools to the Windows clipboard
• cls - clear the command line screen
• cmd /k - Run command with command extensions enabled
• color - Sets the default console foreground and background colors in console
• command.com - Default Operating System Shell
• compmgmt.msc - Computer Management
• control.exe /name Microsoft.NetworkAndSharingCenter - Network and Sharing Center
• control keyboard - Keyboard Properties
• control mouse(or main.cpl) - Mouse Properties
• control sysdm.cpl,@0,3 - Advanced Tab of the System Properties dialog
• control userpasswords2 - Opens the classic User Accounts dialog
• desk.cpl - opens the display properties
• devmgmt.msc - Device Manager
• diskmgmt.msc - Disk Management
• diskpart - Disk management from the command line
• dsa.msc - Opens active directory users and computers
• dsquery - Finds any objects in the directory according to criteria
• dxdiag - DirectX Diagnostic Tool
• eventvwr - Windows Event Log (Event Viewer)
• explorer . - Open explorer with the current folder selected.
• explorer /e, . - Open explorer, with folder tree, with current folder selected.
• F7 - View command history
• find - Searches for a text string in a file or files
• findstr - Find a string in a file
• firewall.cpl - Opens the Windows Firewall settings
• fsmgmt.msc - Shared Folders
• fsutil - Perform tasks related to FAT and NTFS file systems
• ftp - Transfers files to and from a computer running an FTP server service
• getmac - Shows the mac address(es) of your network adapter(s)
• gpedit.msc - Group Policy Editor
• gpresult - Displays the Resultant Set of Policy (RSoP) information for a target user and computer
• httpcfg.exe - HTTP Configuration Utility
• iisreset - To restart IIS
• InetMgr.exe - Internet Information Services (IIS) Manager 7
• InetMgr6.exe - Internet Information Services (IIS) Manager 6
• intl.cpl - Regional and Language Options
• ipconfig - Internet protocol configuration
• lusrmgr.msc - Local Users and Groups Administrator
• msconfig - System Configuration
• notepad - Notepad? ;)
• mmsys.cpl - Sound/Recording/Playback properties
• mode - Configure system devices
• more - Displays one screen of output at a time
• mrt - Microsoft Windows Malicious Software Removal Tool
• mstsc.exe - Remote Desktop Connection
• nbstat - displays protocol statistics and current TCP/IP connections using NBT
• ncpa.cpl - Network Connections
• netsh - Display or modify the network configuration of a computer that is currently running
• netstat - Network Statistics
• net statistics - Check computer up time
• net stop - Stops a running service.
• net use - Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections
• odbcad32.exe - ODBC Data Source Administrator
• pathping - A traceroute that collects detailed packet loss stats
• perfmon - Opens Reliability and Performance Monitor
• ping - Determine whether a remote computer is accessible over the network
• powercfg.cpl - Power management control panel applet
• qfecheck - Shows installed Hotfixes applied to the server/workstation.
• quser - Display information about user sessions on a terminal server
• qwinsta - See disconnected remote desktop sessions
• reg.exe - Console Registry Tool for Windows
• regedit - Registry Editor
• rasdial - Connects to a VPN or a dialup network
• robocopy - Backup/Restore/Copy large amounts of files reliably
• rsop.msc - Resultant Set of Policy (shows the combined effect of all group policies active on the current system/login)
• runas - Run specific tools and programs with different permissions than the user's current logon provides
• sc - Manage anything you want to do with services.
• schtasks - Enables an administrator to create, delete, query, change, run and end scheduled tasks on a local or remote system.
• secpol.msc - Local Security Settings
• services.msc - Services control panel
• set - Displays, sets, or removes cmd.exe environment variables.
• set DIRCMD - Preset dir parameter in cmd.exe
• start - Starts a separate window to run a specified program or command
• start. - opens the current directory in the Windows Explorer.
• shutdown.exe - Shutdown or Reboot a local/remote machine
• subst.exe - Associates a path with a drive letter, including local drives
• systeminfo -Displays a comprehensive information about the system
• taskkill - terminate tasks by process id (PID) or image name
• tasklist.exe - List Processes on local or a remote machine
• taskmgr.exe - Task Manager
• telephon.cpl - Telephone and Modem properties
• timedate.cpl - Date and Time
• title - Change the title of the CMD window you have open
• tracert - Trace route
• whoami /all - Display Current User/Group/Privilege Information
• wmic - Windows Management Instrumentation Command-line
• winver.exe - Find Windows Version
• wscui.cpl - Windows Security Center
• wuauclt.exe - Windows Update AutoUpdate Client

Answer 1

A little known one is

getmac

Shows the mac address(es) of your network adapter(s)

Answer 2

In the command prompt type:

C:\> start.

opens the current directory in the Windows Explorer.

Answer 3

Remote Desktop Connection

mstsc.exe

Opens

Answer 4

Services control panel:

services.msc

Answer 5

A list I use a lot:

• nbtstat - List NetBIOS stats and information
• netstat - List TCP/IP stats and information
• ipconfig - List TCP/IP configuration for a system
• netsh - Network configuration for a system
• sc - manage services
• net - whole slew of commands to manage users and groups, shares, connections, etc.
• ping - makes sure a system is up on the network
• tracert - trace the hops between two hosts. useful to see if there's a break in between and where it is.
• nslookup - Query DNS for information
• dcdiag - check health of the domain controller
• setspn - check SPNs for Kerberos configuration

Answer 6

Robocopy is really useful. It mirrors directories.

Great for backups/restoring/transferring large amounts of files. Only transfers files which have changed, and can resume from where it left off.

It comes standard in Vista and later, but XP users can get it as part of the Windows Server 2003 Resource Kit (free) or later.

Answer 7

shutdown.exe

allow you to shutdown or reboot a machine. You can even reboot a remote machine with

shutdown -m \\server -t 0 -r

It even comes with a graphical user interface

shutdown -i

and you can abort a shutdown with

shutdown -a

Answer 8

(Not really a command per-se, but a way to get there)

For those of you that find yourself going to Start > Run > "cmd" a lot, you can cut down some steps.

Say you want to get your IP Address. You would normally go Start > Run > "cmd" [enter] then... ipconfig [enter]

now instead, go...

Start > Run > "cmd /k ipconfig"

This will run cmd and the command 'ipconfig' and it will keep the window open. So If I want to quickly get my MAC Address (Physical Address), I'd do:

 cmd /k ipconfig /all

...all from the run menu in one line.

---

All courtesy of BostonMark

Answer 9

control userpasswords2

Opens the classic User Accounts dialog:

Answer 10

I find that I use findstr a lot to find stuff in logs, error files, etc.

Its not grep by when you have a base install without it it works just fine.

Simple example in the log file ex0905.log we find all lines that have 2009-05-05 in them

findstr "2009-05-05" ex0905.log

Answer 11

tasklist.exe

will list processes on local or a remote machine.

tasklist.exe /S server

It can display which Services the scvhost.exe processes are hosting with

tasklist /SVC

You can also do some filtering. This will display the processes on a remote machine that have used more than 15 minutes of CPU time

tasklist /S server /FI "CPUTIME gt 00:15:00"

Answer 12

Behold! The forgotten art: DOS String Manipulation!

set mydate=%date:~10,4%_%date:~4,2%_%date:~7,2%
echo %mydate%

Output will be YYYY_MM_DD.

Copy and paste this into a .bat file and be amazed! This is especially useful for creating backups, or any time/date series of directories and files.

An Example:

@echo off
:: Yes this looks bad, but it works, it sets the file veriable mydate to YYYY_MM_DD
set mydate=%date:~10,4%_%date:~4,2%_%date:~7,2%
echo Backing up DC1:
:: start a new backup session, the /M switch is for the type of bakcup being performed, type ntbackup /? for more info
start /wait ntbackup backup \\DC1\c$ /j "DC1 Backup" /f "C:\BAK\DC1\DC1_%mydate%.bkf" /M incremental
echo DC1 is Done
echo Backing up EXCH:
start /wait ntbackup backup \\EXCH\c$ /j "EXCH Backup" /f "C:\BAK\EXCH\EXCH_%mydate%.bkf" /M incremental
echo EXCH is Done
echo Backing up FS1:
start /wait ntbackup backup \\FS1\c$ /j "FS1 Backup" /f "C:\BAK\FS1\FS1_%mydate%.bkf" /M incremental
echo FS1 is Done
echo Backup was completed %date% %time%
pause

Answer 13

Programs and Features (Formerly Known as "Add or Remove Programs")

appwiz.cpl

Opens

Answer 14

Sometimes I have to worry about too few free Sessions for Terminal Server Connection to a Server.

quser displays information about user sessions on a terminal server.

quser /SERVER:myserver

Output

C:\Documents and Settings\sysmanager01>quser /SERVER:serverx
USERNAME                    SESSIONNAME        ID  STATE   IDLE TIME  LOGON TIME
usr_hot1                                        1  Disc        none   30.04.2009 17:59
usr_hot                                         2  Disc        none   30.04.2009 18:01
appsuperuser                rdp-tcp#6           3  Conn            .  01.01.1601 02:00

Sometimes it's even possible to find pureworkaholics like appsuperuser :-)

It's easier when pasting the quser executable from any 32-bit Server to my local System32 folder.

Answer 15

Computer Management

compmgmt.msc

Opens

Answer 16

Very useful one I only found out about recently:

winver.exe

Gives you a dialog box with the version of Windows the machine is running, complete with Service Pack level and build number.

Answer 17

I use

qwinsta

to see disconnected remote desktop sessions and

logoff

to end them.

Works on 2000, XP, Vista, Server 2003 and probably Server 2008 (never tried).

Answer 18

To change the title of the CMD window you have open, simply use:

title [your new title]

I've got a lot of CMD windows and other programs open at work. This command, combined with Taskbar Shuffle (allows you to drag taskbar items into new orders) has saved me from insanity.

Answer 19

systeminfo

Displays a ton of information about the system at hand. The following are what it outputs on Vista:

Host Name, OS Name, OS Version, OS Manufacturer, OS Configuration, OS Build Type, Registered Owner, Registered Organization, Product ID, Original Install Date, System Boot Time, System Manufacturer, System Model, System Type, Processor(s), BIOS Version, Windows Directory, System Directory, Boot Device, System Locale, Input Locale, Time Zone, Total Physical Memory, Available Physical Memory, Page File, Max Size, Page File, Available, Page File, In Use, Page File Location(s), Domain, Logon Server, Hotfix(s), Network Card(s)

Answer 20

color 02

This, my friends, is the only command you'll ever need. The rest is nonessential.

Answer 21

explorer .

Open explorer with the current folder selected.

explorer /e, .

Open explorer, with folder tree, with current folder selected.

Answer 22

To restart IIS

iisreset

Answer 23

Chaining commands in particular net stop and start to restart any service:

net stop w3svc && net start w3svc

(silly example as iisreset will do that, but anyway ;)

Answer 24

On Windows XP at least, haven't tried Windows Vista/Windows 7:

appwiz.cpl @,2

takes you straight to the Add/Remove Windows Components pane.

Another way to add or remove components in an automated fashion is to use

sysocmgr.exe

in unattended mode with a .inf file that lists the components you'd like to install, e.g.

[NetOptionalComponents] 
SNMP = 1 

[SNMP] 
Contact_Name = IT Dept. 
Location = Office
Service = Physical, Applications, End-to-End 
Community_Name = Mormon 
Traps = server1, server2 
Send_Authentication = Yes 
Accept_CommunityName = Public:Read_Only 
Any_Host = No 
Limit_Host = server1, server2

(Credit due to thesystemadministrator.com for .inf file)

It's a clunky tool (hey, it's MS) but it's invaluable for getting your components sorted out post-install.

Answer 25

Device Manager

devmgmt.msc

Opens

Answer 26

Registry Editor

regedit

Answer 27

I didn't see taskkill on the list yet.

TASKKILL [/S system [/U username [/P [password]]]] { [/FI filter] [/PID processid | /IM imagename] } [/F] [/T]

Parameter List: /S system Specifies the remote system to connect to.

/U    [domain\]user    Specifies the user context under which
                       the command should execute.

/P    [password]       Specifies the password for the given
                       user context. Prompts for input if omitted.

/F                     Specifies to forcefully terminate
                       process(es).

/FI   filter           Displays a set of tasks that match a
                       given criteria specified by the filter.

/PID  process id       Specifies the PID of the process that
                       has to be terminated.

/IM   image name       Specifies the image name of the process
                       that has to be terminated. Wildcard '*'
                       can be used to specify all image names.

/T                     Tree kill: terminates the specified process
                       and any child processes which were started by

it.

Works great in conjunction with tasklist

Answer 28

Windows 7 Run Commands

I find it better to know where to find them until I have used them often enough to actually remember them.

Answer 29

EventViewer

eventvwr.msc

Opens

Answer 30

There is still no mention of WMIC.exe :)

Find whatever you want from remote machine, local machine... multiple machines.

Nicely filled out HTML page with all data related to OS

WMIC OS get /all /format:htable

Look at all the options available

ALIAS                    - Access to the aliases available on the local system
BASEBOARD                - Base board (also known as a motherboard or system board) management.
BIOS                     - Basic input/output services (BIOS) management.
BOOTCONFIG               - Boot configuration management.
CDROM                    - CD-ROM management.
COMPUTERSYSTEM           - Computer system management.
CPU                      - CPU management.
CSPRODUCT                - Computer system product information from SMBIOS.
DATAFILE                 - DataFile Management.
DCOMAPP                  - DCOM Application management.
DESKTOP                  - User's Desktop management.
DESKTOPMONITOR           - Desktop Monitor management.
DEVICEMEMORYADDRESS      - Device memory addresses management.
DISKDRIVE                - Physical disk drive management.
DISKQUOTA                - Disk space usage for NTFS volumes.
DMACHANNEL               - Direct memory access (DMA) channel management.
ENVIRONMENT              - System environment settings management.
FSDIR                    - Filesystem directory entry management.
GROUP                    - Group account management.
IDECONTROLLER            - IDE Controller management.
IRQ                      - Interrupt request line (IRQ) management.
JOB                      - Provides  access to the jobs scheduled using the schedule service.
LOADORDER                - Management of system services that define execution dependencies.
LOGICALDISK              - Local storage device management.
LOGON                    - LOGON Sessions.
MEMCACHE                 - Cache memory management.
MEMLOGICAL               - System memory management (configuration layout and availability of memory).
MEMPHYSICAL              - Computer system's physical memory management.
NETCLIENT                - Network Client management.
NETLOGIN                 - Network login information (of a particular user) management.
NETPROTOCOL              - Protocols (and their network characteristics) management.
NETUSE                   - Active network connection management.
NIC                      - Network Interface Controller (NIC) management.
NICCONFIG                - Network adapter management.
NTDOMAIN                 - NT Domain management.
NTEVENT                  - Entries in the NT Event Log.
NTEVENTLOG               - NT eventlog file management.
ONBOARDDEVICE            - Management of common adapter devices built into the motherboard (system board).
OS                       - Installed Operating System/s management.
PAGEFILE                 - Virtual memory file swapping management.
PAGEFILESET              - Page file settings management.
PARTITION                - Management of partitioned areas of a physical disk.
PORT                     - I/O port management.
PORTCONNECTOR            - Physical connection ports management.
PRINTER                  - Printer device management.
PRINTERCONFIG            - Printer device configuration management.
PRINTJOB                 - Print job management.
PROCESS                  - Process management.
PRODUCT                  - Installation package task management.
QFE                      - Quick Fix Engineering.
QUOTASETTING             - Setting information for disk quotas on a volume.
RECOVEROS                - Information that will be gathered from memory when the operating system fails.
REGISTRY                 - Computer system registry management.
SCSICONTROLLER           - SCSI Controller management.
SERVER                   - Server information management.
SERVICE                  - Service application management.
SHARE                    - Shared resource management.
SOFTWAREELEMENT          - Management of the  elements of a software product installed on a system.
SOFTWAREFEATURE          - Management of software product subsets of SoftwareElement.
SOUNDDEV                 - Sound Device management.
STARTUP                  - Management of commands that run automatically when users log onto the computer system.
SYSACCOUNT               - System account management.
SYSDRIVER                - Management of the system driver for a base service.
SYSTEMENCLOSURE          - Physical system enclosure management.
SYSTEMSLOT               - Management of physical connection points including ports,  slots and peripherals, and
TAPEDRIVE                - Tape drive management.
TEMPERATURE              - Data management of a temperature sensor (electronic thermometer).
TIMEZONE                 - Time zone data management.
UPS                      - Uninterruptible power supply (UPS) management.
USERACCOUNT              - User account management.
VOLTAGE                  - Voltage sensor (electronic voltmeter) data management.
VOLUMEQUOTASETTING       - Associates the disk quota setting with a specific disk volume.
WMISET                   - WMI service operational parameters management.

and many, many more.