# Useful Command-line Commands on Windows

The aim for this Wiki is to promote using a command to open up commonly used applications without having to go through many mouse clicks - thus saving time on monitoring and troubleshooting Windows machines.

• Application name
• Commands
• Screenshot (Optional)

Shortcut to commands

-
If you find this stuff interesting, take a look at commandlinefu: commandlinefu.com It's basically like digg for CLI –  username May 11 '09 at 6:47
Try putting each command as a separate answer. Then we can vote and comment on each one. –  lamcro Jun 26 '09 at 12:22
This is a great question, super useful info, and the stackexchange engine made it trivial to find. I agree with @lamcro, however, that structuring each command as an individual answer would likely provide more value, however then the wouldn't be sorted alphabetically? hmmm... –  David Alpert Jul 29 '09 at 22:00
This is a great example, across all SE, of a well-executed poll. I especially like combining separate answers (for voting) and alphabetical index to them! –  Jonik Sep 17 '10 at 14:16

## locked by Zypher♦Dec 11 '11 at 21:18

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

cipher /w:C:\


/W Removes data from available unused disk space on the entire volume. If this option is chosen, all other options are ignored. The directory specified can be anywhere in a local volume. If it is a mount point or points to a directory in another volume, the data on that volume will be removed.

support.microsoft.com/kb/814599

-

Hopefully this fits in here - exporting the results of a command to file. For example, running a ping:

ping localhost


Can be exported to a log file:

ping localhost > C:\ping.log


Anything that would otherwise appear within the console screen, will be written to the file. Very useful for creating logs of running scheduled tasks.

-

I saw FINDSTR listed above but nobody mentioned FIND. This command is incredibly useful to search the list returned from another command. Example: netstat -an | find ":6667"

This command will find any IRC traffic on your computer. Substitute another port or an IP address to narrow down the returned results accordingly.

-

I find that MS's SysInternals are really useful. So I often keep the folder updated by running this robocopy command:

robocopy "\\live.sysinternals.com\Tools" "C:\utils\sysinternals" /LEV:0 /Z /XO /IT /R:10 /W:10


The three I use the most are:

• autoruns.exe manage processes that start automatically
• procexp.exe a heavy duty process explorer, great for finding file locks
• contig.exe defragment a single file (useful for virtual machines)
-
mode


It allows you to resize your cmd.exe window.

The cmd.exe window normally has 300 lines and 80 columns, which can be quite small sometimes.

You can double the height and width of the command window with

mode con cols=160 lines=600


To see your current settings use

mode con /status

-

Monitor network connections in the background, command-line while you work. (AKA - The revolving netstat'):

> netstat -a 1


Stop services via command-line:

> net stop [servicename]


Fire up a Terminal Services session to a remote computer, via command-line:

> mstsc /v:[servername]


They kept around the "more" command, which was nice. Check out what's going on with the latest updates that have been installed, via WSUS:

> more /c c:\windows\windowsupdate.log


Problems with resolving via netBIOS? (Remember that buggy-ole-protocol?) Or issues with domain trusts? This set of commands has always served well on old domain controllers. (Also demonstrates how to link commands, (the double-ampersand means, only continue if the last command completed successfully')

> nbtstat -R && nbtstat -r & nbtstat -c

-

When I was testing my WSUS server I found these useful:

gpresult > gp.txt (gives the policies aplied)

gpupdate /force (will force an group policy update on the machine)

wuauclt /detectnow (to force the Windows update agent to search for updates)

-

Windows key + r cmd

This opens the command-line window without the mouse. It is the quickest way I've found to get it up. Combine with the cmd \k *command* mentioned above.

-

Problem Steps Recorder - A beautiful new feature in Windows 7 and Server 2008 R2.

PSR.EXE

-

The two I use the most are:

PathPing - Traces the route and pings the site at the same time (ie: pathping www.zdnet.com)

and an easy way to lock your workstation/server:

%windir%\System32\rundll32.exe user32.dll,LockWorkStation

-

cacls (or the more up-to-date icalcs):

cacls (Change Access Control Lists) is a command line utility for Microsoft Windows to change Access Control List (ACL) permissions on a directory, its subcontents, or files. An access control list is a list of permissions for a securable object, such as a file or directory, that controls who can access it.

It is a real life-saver on a file-server when specific file(s) and/or directory(s) permissions have to be modified.

-

Useful for batch/cmd processing:

cd %0\..


changes the path including the drive to the directory where the batch/cmd files is located.

For example, when you have your bat/cmd in z:\test, and you open up a shortcut to the bat/cmd from your desktop, with the command inside your bat/cmd you can change the path to z:\test and go on from there.

Edit: the command above only changes the path, not the drive! My fault... I tested it only on the same drive. The correct command for also changing the drive would be

cd /d %0\..

-

chkdsk (or checkdisk) is a command that checks the disk surface for physical errors or bad sectors. It can also fix logical file system errors.

-

I seem to regularly use "sc stop wuauserv", which turns off the Windows Update service. Primarly to make it stop nagging me to restart every few minutes.

-

The arp command gives you the IP address and Ethernet address for hosts your machine knows of on the network. Very useful to debug hairy network troubles... I usually use

arp -a

-
Network and Sharing Center
control.exe /name Microsoft.NetworkAndSharingCenter


Opens

-

#####Mouse Properties control mouse

-- or --

main.cpl


Opens

-

To free up some disk space:

format c:


No, really, here's Disk Cleanup:

cleanmgr.exe


-

To open the Windows Event Log (Event Viewer).

Eventvwr


-
show 1 more comment

calc to open Calculator.

-
net statistics workstation


or

net statistics server


One way of finding out how long the box has been up for.

Note: The times that these commands report are how long the Workstation and Server services have been running for. These are normally started with the rest of the OS, but I've seen secure builds that disable Workstation.

-

Depending on the version of Windows, Scheduled Tasks, and for command-line goodness, the schtasks or at commands.

Parameter List:
/Create  : Creates a new scheduled task.
/Delete  : Deletes the scheduled task(s).
/Query  : Displays all scheduled tasks.
/Change  : Changes the properties of scheduled task.
/Run  : Runs the scheduled task immediately.
/End  : Stops the currently running scheduled task.
/?              Displays this help/usage.


at

\\computername: Specify a remote computer (default local machine.
time: Specify the time when the task is to run.
/interactive: Allow the task to interact with the desktop of the user who is logged on at the time the task runs.
/every:date,...: Schedule the task to run on the specified day or days of the week or month.
/next:date,...: Schedule the task to run on the next occurrence of the day (for example, next Monday).
command: Specify the command, the program (.exe or .com file), or the batch program (.bat or .cmd file) that you want to run.
id: Specify the identification number that is assigned to a scheduled task.
/delete: Cancel a scheduled task. If you omit the id parameter, all scheduled tasks on the computer are canceled.
/yes: Force a yes answer to all queries from the system when you cancel scheduled tasks.

-
reg.exe

-

I find the FOR command to be essential, usually parsing a text file of server names or user accounts. Sure, powershell or vbscript is more versatile, but sometimes the command prompt is what you have.

FOR /f %i in (servername.txt) do psexec \\%i netsh int ip show dns


(with pstools) runs netsh on multiple servers and outputs their dns settings.

FOR /F "tokens=1,2,3* skip=8 usebackq" %i in (net group /domain "Domain Admins") do net user /domain %i && net user /domain %j && net user /domain %k


Dumps out each Domain Admin in WinNT "net user" style -- doing a dsquery command would be better. Add ">>filename.txt" to each part to save in a file. The >>file format appends. You get an error on the last line from the "net group".

Full command details are in "FOR /?" including string substitution, doing sequences (FOR /L %i IN (start,step,end) gives a loop where %i can be a number) and compound results.

-

Remote Assistance

%SYSTEMROOT%\System32\rcimlby.exe -LaunchRA


This is very handy to create as a shortcut on a users desktop. It goes straight to the "Invite someone to help you" page in the help centre. (Tested on XP/Pro Home).

-

The Advanced Tab of the System Properties dialog.

control sysdm.cpl,@0,3


I use this regularly to get to Page file settings, Performance, Environment Variables and User Profiles.

Syntax:

@0 = the function within sysdm.cpl to display (In this case System Properties)

3 = the tab number to activate (in this case Advanced)

-

Restart an IIS app pool from the command line:

cscript c:\WINDOWS\system32\iisapp.vbs /a SuperDuperAppPool /r


Where 'SuperDuperAppPool' is your app pool name

-

fsmgmt.msc to access File Shares.

-
show 1 more comment

To manage the entire IIS7 from the standard command-line (no PowerShell needed ;)

appcmd.exe

-

There have been a couple of mentions of WMIC, but there's a lot of power there that isn't being highlighted. Granted, much of this can be done easier now with PowerShell, but if you don't know PowerShell or aren't able to use it for whatever reason, then it's WMIC to the rescue!

You are able to use many of the WQL keywords. For some reason a nice well-documented syntax on how to use these on the command line in conjunction with WMIC is not found anywhere.

## Some examples:

### List the QFE (Quick Fix Engineering) hotfixes installed on a system

// See them all
wmic qfe | more

// List the HotFixID, InstalledBy and InstalledOn properties of the ones that begin with "KB9"
wmic qfe where "HotfixID like '%KB9%'" get HotFixID,InstalledBy,InstalledOn

// Useful if you're just trying to find out if a particular KB is installed, and you don't care about the properties
wmic qfe | find "981793"

// Or, if you need the properties just for the one
wmic qfe where "HotFixID = 'KB981793'"

## Display, start and stop services! Very useful when you have a group of related services that you need to stop/start.

// Display McAfee services
wmic service where "DisplayName like '%McAfee%'"

// Stop all McAfee services
wmic service where "DisplayName like '%McAfee%'" call StopService

## Context-sensitive Help

### See what properties are available with a particular alias:

wmic service get /?


### See what methods are available with a particular alias:

wmic service call /?


### See which classes the aliases map to:

wmic alias list brief


## Run a query or command against multiple computers:

// Get a list of all the patches on hostname1 and hostname2 and save it as a .csv file for easy import into Excel
wmic /node:hostname1,hostname2 get /format:csv > Patches.csv

// You can also list all your systems (one per line) in a text file and run it against all of them:
wmic /node:@MyServers.txt get /format:csv > Patches.csv

-