Useful Command-line Commands on Windows

Question

The aim for this Wiki is to promote using a command to open up commonly used applications without having to go through many mouse clicks - thus saving time on monitoring and troubleshooting Windows machines.

Answer entries need to specify

• Application name
• Commands
• Screenshot (Optional)

Shortcut to commands

• && - Command Chaining
• %SYSTEMROOT%\System32\rcimlby.exe -LaunchRA - Remote Assistance (Windows XP)
• appwiz.cpl - Programs and Features (Formerly Known as "Add or Remove Programs")
• appwiz.cpl @,2 - Turn Windows Features On and Off (Add/Remove Windows Components pane)
• arp - Displays and modifies the IP-to-Physical address translation tables used by address resolution protocol (ARP)
• at - Schedule tasks either locally or remotely without using Scheduled Tasks
• bootsect.exe - Updates the master boot code for hard disk partitions to switch between BOOTMGR and NTLDR
• cacls - Change Access Control List (ACL) permissions on a directory, its subcontents, or files
• calc - Calculator
• chkdsk - Check/Fix the disk surface for physical errors or bad sectors
• cipher - Displays or alters the encryption of directories [files] on NTFS partitions
• cleanmgr.exe - Disk Cleanup
• clip - Redirects output of command line tools to the Windows clipboard
• cls - clear the command line screen
• cmd /k - Run command with command extensions enabled
• color - Sets the default console foreground and background colors in console
• command.com - Default Operating System Shell
• compmgmt.msc - Computer Management
• control.exe /name Microsoft.NetworkAndSharingCenter - Network and Sharing Center
• control keyboard - Keyboard Properties
• control mouse(or main.cpl) - Mouse Properties
• control sysdm.cpl,@0,3 - Advanced Tab of the System Properties dialog
• control userpasswords2 - Opens the classic User Accounts dialog
• desk.cpl - opens the display properties
• devmgmt.msc - Device Manager
• diskmgmt.msc - Disk Management
• diskpart - Disk management from the command line
• dsa.msc - Opens active directory users and computers
• dsquery - Finds any objects in the directory according to criteria
• dxdiag - DirectX Diagnostic Tool
• eventvwr - Windows Event Log (Event Viewer)
• explorer . - Open explorer with the current folder selected.
• explorer /e, . - Open explorer, with folder tree, with current folder selected.
• F7 - View command history
• find - Searches for a text string in a file or files
• findstr - Find a string in a file
• firewall.cpl - Opens the Windows Firewall settings
• fsmgmt.msc - Shared Folders
• fsutil - Perform tasks related to FAT and NTFS file systems
• ftp - Transfers files to and from a computer running an FTP server service
• getmac - Shows the mac address(es) of your network adapter(s)
• gpedit.msc - Group Policy Editor
• gpresult - Displays the Resultant Set of Policy (RSoP) information for a target user and computer
• httpcfg.exe - HTTP Configuration Utility
• iisreset - To restart IIS
• InetMgr.exe - Internet Information Services (IIS) Manager 7
• InetMgr6.exe - Internet Information Services (IIS) Manager 6
• intl.cpl - Regional and Language Options
• ipconfig - Internet protocol configuration
• lusrmgr.msc - Local Users and Groups Administrator
• msconfig - System Configuration
• notepad - Notepad? ;)
• mmsys.cpl - Sound/Recording/Playback properties
• mode - Configure system devices
• more - Displays one screen of output at a time
• mrt - Microsoft Windows Malicious Software Removal Tool
• mstsc.exe - Remote Desktop Connection
• nbstat - displays protocol statistics and current TCP/IP connections using NBT
• ncpa.cpl - Network Connections
• netsh - Display or modify the network configuration of a computer that is currently running
• netstat - Network Statistics
• net statistics - Check computer up time
• net stop - Stops a running service.
• net use - Connects a computer to or disconnects a computer from a shared resource, displays information about computer connections, or mounts a local share with different privileges (documentation)
• odbcad32.exe - ODBC Data Source Administrator
• pathping - A traceroute that collects detailed packet loss stats
• perfmon - Opens Reliability and Performance Monitor
• ping - Determine whether a remote computer is accessible over the network
• powercfg.cpl - Power management control panel applet
• qfecheck - Shows installed Hotfixes applied to the server/workstation.
• quser - Display information about user sessions on a terminal server
• qwinsta - See disconnected remote desktop sessions
• reg.exe - Console Registry Tool for Windows
• regedit - Registry Editor
• rasdial - Connects to a VPN or a dialup network
• robocopy - Backup/Restore/Copy large amounts of files reliably
• rsop.msc - Resultant Set of Policy (shows the combined effect of all group policies active on the current system/login)
• runas - Run specific tools and programs with different permissions than the user's current logon provides
• sc - Manage anything you want to do with services.
• schtasks - Enables an administrator to create, delete, query, change, run and end scheduled tasks on a local or remote system.
• secpol.msc - Local Security Settings
• services.msc - Services control panel
• set - Displays, sets, or removes cmd.exe environment variables.
• set DIRCMD - Preset dir parameter in cmd.exe
• start - Starts a separate window to run a specified program or command
• start. - opens the current directory in the Windows Explorer.
• shutdown.exe - Shutdown or Reboot a local/remote machine
• subst.exe - Associates a path with a drive letter, including local drives
• systeminfo -Displays a comprehensive information about the system
• taskkill - terminate tasks by process id (PID) or image name
• tasklist.exe - List Processes on local or a remote machine
• taskmgr.exe - Task Manager
• telephon.cpl - Telephone and Modem properties
• timedate.cpl - Date and Time
• title - Change the title of the CMD window you have open
• tracert - Trace route
• whoami /all - Display Current User/Group/Privilege Information
• wmic - Windows Management Instrumentation Command-line
• winver.exe - Find Windows Version
• wscui.cpl - Windows Security Center
• wuauclt.exe - Windows Update AutoUpdate Client

Answer 1

If you suspect something's wrong with protected system files, you can use this tool.

sfc /scannow

Answer 2

Microsoft Windows Malicious Software Removal Tool

mrt

Answer 3

SC - Manage anything you want to do with services.

DESCRIPTION:
        SC is a command line program used for communicating with the
        NT Service Controller and services. USAGE:
        sc <server> [command] [service name] <option1> <option2>...

Answer 4

The set command with filtering to display contents of environment variables. Instead of typing

C:\Users\Erlend>echo %computername%
ASUS-G1S

you can type

C:\Users\Erlend>set comp
COMPUTERNAME=ASUS-G1S

to get the same effect. Using set alone shows you all environment variables.

Answer 5

One of my favourites is rsop.msc, 'Resultant Set of Policy'.

RSoP shows the combined effect of all group policies active on the current system/login. So on a client machine if you're unsure about which particular policy settings are/aren't applied, simply check it out in RSoP!

Answer 6

start:

start .                (opens explorer to the pwd)

start c:\              (opens explorer to the root of C:)

start document.doc     (open the document - just like double-clicking on it)

start wordpad file.txt (open wordpad for the file, creating if necessary)

start calc             (launch the calculator app)

Answer 7

cipher /w:C:\

/W Removes data from available unused disk space on the entire volume. If this option is chosen, all other options are ignored. The directory specified can be anywhere in a local volume. If it is a mount point or points to a directory in another volume, the data on that volume will be removed.

support.microsoft.com/kb/814599

Answer 8

Hopefully this fits in here - exporting the results of a command to file. For example, running a ping:

ping localhost

Can be exported to a log file:

ping localhost > C:\ping.log

Anything that would otherwise appear within the console screen, will be written to the file. Very useful for creating logs of running scheduled tasks.

Answer 9

I saw FINDSTR listed above but nobody mentioned FIND. This command is incredibly useful to search the list returned from another command. Example: netstat -an | find ":6667"

This command will find any IRC traffic on your computer. Substitute another port or an IP address to narrow down the returned results accordingly.

Answer 10

I find that MS's SysInternals are really useful. So I often keep the folder updated by running this robocopy command:

robocopy "\\live.sysinternals.com\Tools" "C:\utils\sysinternals" /LEV:0 /Z /XO /IT /R:10 /W:10

The three I use the most are:

• autoruns.exe manage processes that start automatically
• procexp.exe a heavy duty process explorer, great for finding file locks
• contig.exe defragment a single file (useful for virtual machines)

Answer 11

mode

It allows you to resize your cmd.exe window.

The cmd.exe window normally has 300 lines and 80 columns, which can be quite small sometimes.

You can double the height and width of the command window with

mode con cols=160 lines=600

To see your current settings use

mode con /status

Answer 12

Monitor network connections in the background, command-line while you work. (AKA - The `revolving netstat'):

> netstat -a 1

Stop services via command-line:

> net stop [servicename]

Fire up a Terminal Services session to a remote computer, via command-line:

> mstsc /v:[servername]

They kept around the "more" command, which was nice. Check out what's going on with the latest updates that have been installed, via WSUS:

> more /c c:\windows\windowsupdate.log

Problems with resolving via netBIOS? (Remember that buggy-ole-protocol?) Or issues with domain trusts? This set of commands has always served well on old domain controllers. (Also demonstrates how to link commands, (the double-ampersand means, `only continue if the last command completed successfully')

> nbtstat -R && nbtstat -r & nbtstat -c

Answer 13

When I was testing my WSUS server I found these useful:

gpresult > gp.txt (gives the policies aplied)

gpupdate /force (will force an group policy update on the machine)

wuauclt /detectnow (to force the Windows update agent to search for updates)

Answer 14

Windows key + r cmd

This opens the command-line window without the mouse. It is the quickest way I've found to get it up. Combine with the cmd \k *command* mentioned above.

Answer 15

Problem Steps Recorder - A beautiful new feature in Windows 7 and Server 2008 R2.

PSR.EXE

Answer 16

The two I use the most are:

PathPing - Traces the route and pings the site at the same time (ie: pathping www.zdnet.com)

and an easy way to lock your workstation/server:

%windir%\System32\rundll32.exe user32.dll,LockWorkStation

Answer 17

cacls (or the more up-to-date icalcs):

cacls (Change Access Control Lists) is a command line utility for Microsoft Windows to change Access Control List (ACL) permissions on a directory, its subcontents, or files. An access control list is a list of permissions for a securable object, such as a file or directory, that controls who can access it.

It is a real life-saver on a file-server when specific file(s) and/or directory(s) permissions have to be modified.

Answer 18

Useful for batch/cmd processing:

cd %0\..

changes the path including the drive to the directory where the batch/cmd files is located.

For example, when you have your bat/cmd in z:\test, and you open up a shortcut to the bat/cmd from your desktop, with the command inside your bat/cmd you can change the path to z:\test and go on from there.

Edit: the command above only changes the path, not the drive! My fault... I tested it only on the same drive. The correct command for also changing the drive would be

cd /d %0\..

Answer 19

chkdsk (or checkdisk) is a command that checks the disk surface for physical errors or bad sectors. It can also fix logical file system errors.

Answer 20

I seem to regularly use "sc stop wuauserv", which turns off the Windows Update service. Primarly to make it stop nagging me to restart every few minutes.

Answer 21

The arp command gives you the IP address and Ethernet address for hosts your machine knows of on the network. Very useful to debug hairy network troubles... I usually use

arp -a

Answer 22

Disk Management

diskmgmt.msc

Opens

Answer 23

calc to open Calculator.

Answer 24

net statistics workstation

or

net statistics server

One way of finding out how long the box has been up for.

Note: The times that these commands report are how long the Workstation and Server services have been running for. These are normally started with the rest of the OS, but I've seen secure builds that disable Workstation.

Answer 25

Depending on the version of Windows, Scheduled Tasks, and for command-line goodness, the schtasks or at commands.

schtasks

Parameter List:
    /Create  : Creates a new scheduled task.
    /Delete  : Deletes the scheduled task(s).
    /Query  : Displays all scheduled tasks. 
    /Change  : Changes the properties of scheduled task. 
    /Run  : Runs the scheduled task immediately. 
    /End  : Stops the currently running scheduled task. 
    /?              Displays this help/usage.

at

\\computername: Specify a remote computer (default local machine.
time: Specify the time when the task is to run.
/interactive: Allow the task to interact with the desktop of the user who is logged on at the time the task runs.
/every:date,...: Schedule the task to run on the specified day or days of the week or month.
/next:date,...: Schedule the task to run on the next occurrence of the day (for example, next Monday).
command: Specify the command, the program (.exe or .com file), or the batch program (.bat or .cmd file) that you want to run.
id: Specify the identification number that is assigned to a scheduled task.
/delete: Cancel a scheduled task. If you omit the id parameter, all scheduled tasks on the computer are canceled.
/yes: Force a yes answer to all queries from the system when you cancel scheduled tasks.

Answer 26

reg.exe

manipulates the Windows Registry.

Answer 27

I find the FOR command to be essential, usually parsing a text file of server names or user accounts. Sure, powershell or vbscript is more versatile, but sometimes the command prompt is what you have.

FOR /f %i in (servername.txt) do psexec \\%i netsh int ip show dns

(with pstools) runs netsh on multiple servers and outputs their dns settings.

FOR /F "tokens=1,2,3* skip=8 usebackq" %i in (`net group /domain "Domain Admins"`) do net user /domain %i && net user /domain %j && net user /domain %k

Dumps out each Domain Admin in WinNT "net user" style -- doing a dsquery command would be better. Add ">>filename.txt" to each part to save in a file. The >>file format appends. You get an error on the last line from the "net group".

Full command details are in "FOR /?" including string substitution, doing sequences (FOR /L %i IN (start,step,end) gives a loop where %i can be a number) and compound results.

Answer 28

Remote Assistance

%SYSTEMROOT%\System32\rcimlby.exe -LaunchRA

This is very handy to create as a shortcut on a users desktop. It goes straight to the "Invite someone to help you" page in the help centre. (Tested on XP/Pro Home).

Answer 29

The Advanced Tab of the System Properties dialog.

control sysdm.cpl,@0,3

I use this regularly to get to Page file settings, Performance, Environment Variables and User Profiles.

Syntax:

@0 = the function within sysdm.cpl to display (In this case System Properties)

3 = the tab number to activate (in this case Advanced)

For anyone interested, Victor Laurie provides more info on this syntax.

Answer 30

Restart an IIS app pool from the command line:

cscript c:\WINDOWS\system32\iisapp.vbs /a SuperDuperAppPool /r

Where 'SuperDuperAppPool' is your app pool name