The aim for this Wiki is to promote using a command to open up commonly used applications without having to go through many mouse clicks - thus saving time on monitoring and troubleshooting Windows machines.

Answer entries need to specify

  • Application name
  • Commands
  • Screenshot (Optional)

Shortcut to commands

  • 11
    If you find this stuff interesting, take a look at commandlinefu: commandlinefu.com It's basically like digg for CLI
    – username
    May 11, 2009 at 6:47
  • great list, very usefull
    – Adyt
    May 20, 2009 at 8:56
  • 1
    Try putting each command as a separate answer. Then we can vote and comment on each one.
    – lamcro
    Jun 26, 2009 at 12:22
  • 1
    This is a great question, super useful info, and the stackexchange engine made it trivial to find. I agree with @lamcro, however, that structuring each command as an individual answer would likely provide more value, however then the wouldn't be sorted alphabetically? hmmm... Jul 29, 2009 at 22:00
  • 1
    This is a great example, across all SE, of a well-executed poll. I especially like combining separate answers (for voting) and alphabetical index to them!
    – Jonik
    Sep 17, 2010 at 14:16

160 Answers 160

cipher /w:C:\

/W Removes data from available unused disk space on the entire volume. If this option is chosen, all other options are ignored. The directory specified can be anywhere in a local volume. If it is a mount point or points to a directory in another volume, the data on that volume will be removed.



Hopefully this fits in here - exporting the results of a command to file. For example, running a ping:

ping localhost

Can be exported to a log file:

ping localhost > C:\ping.log

Anything that would otherwise appear within the console screen, will be written to the file. Very useful for creating logs of running scheduled tasks.


I saw FINDSTR listed above but nobody mentioned FIND. This command is incredibly useful to search the list returned from another command. Example: netstat -an | find ":6667"

This command will find any IRC traffic on your computer. Substitute another port or an IP address to narrow down the returned results accordingly.


I find that MS's SysInternals are really useful. So I often keep the folder updated by running this robocopy command:

robocopy "\\live.sysinternals.com\Tools" "C:\utils\sysinternals" /LEV:0 /Z /XO /IT /R:10 /W:10

The three I use the most are:

  • autoruns.exe manage processes that start automatically
  • procexp.exe a heavy duty process explorer, great for finding file locks
  • contig.exe defragment a single file (useful for virtual machines)

It allows you to resize your cmd.exe window.

The cmd.exe window normally has 300 lines and 80 columns, which can be quite small sometimes.

You can double the height and width of the command window with

mode con cols=160 lines=600

To see your current settings use

mode con /status

Monitor network connections in the background, command-line while you work. (AKA - The `revolving netstat'):

> netstat -a 1

Stop services via command-line:

> net stop [servicename]

Fire up a Terminal Services session to a remote computer, via command-line:

> mstsc /v:[servername]

They kept around the "more" command, which was nice. Check out what's going on with the latest updates that have been installed, via WSUS:

> more /c c:\windows\windowsupdate.log

Problems with resolving via netBIOS? (Remember that buggy-ole-protocol?) Or issues with domain trusts? This set of commands has always served well on old domain controllers. (Also demonstrates how to link commands, (the double-ampersand means, `only continue if the last command completed successfully')

> nbtstat -R && nbtstat -r & nbtstat -c

When I was testing my WSUS server I found these useful:

gpresult > gp.txt (gives the policies aplied)

gpupdate /force (will force an group policy update on the machine)

wuauclt /detectnow (to force the Windows update agent to search for updates)

Windows key + r cmd

This opens the command-line window without the mouse. It is the quickest way I've found to get it up. Combine with the cmd \k *command* mentioned above.


Problem Steps Recorder - A beautiful new feature in Windows 7 and Server 2008 R2.


The two I use the most are:

PathPing - Traces the route and pings the site at the same time (ie: pathping www.zdnet.com)

and an easy way to lock your workstation/server:

%windir%\System32\rundll32.exe user32.dll,LockWorkStation
  • Any easy way to lock a workstation is windows+L. No need for the command.
    – railmeat
    Aug 11, 2009 at 2:20
  • @railmeat: Yes, I use that too. But if you are remotely on the box, it's a little difficult to hit it sometimes...
    – JFV
    Aug 11, 2009 at 15:10

cacls (or the more up-to-date icalcs):

cacls (Change Access Control Lists) is a command line utility for Microsoft Windows to change Access Control List (ACL) permissions on a directory, its subcontents, or files. An access control list is a list of permissions for a securable object, such as a file or directory, that controls who can access it.

alt text http://articles.techrepublic.com.com/i/tr/cms/contentPics/r00220020626van01_02.gif

It is a real life-saver on a file-server when specific file(s) and/or directory(s) permissions have to be modified.


Useful for batch/cmd processing:

cd %0\..

changes the path including the drive to the directory where the batch/cmd files is located.

For example, when you have your bat/cmd in z:\test, and you open up a shortcut to the bat/cmd from your desktop, with the command inside your bat/cmd you can change the path to z:\test and go on from there.

Edit: the command above only changes the path, not the drive! My fault... I tested it only on the same drive. The correct command for also changing the drive would be

cd /d %0\..

chkdsk (or checkdisk) is a command that checks the disk surface for physical errors or bad sectors. It can also fix logical file system errors.



I seem to regularly use "sc stop wuauserv", which turns off the Windows Update service. Primarly to make it stop nagging me to restart every few minutes.


The arp command gives you the IP address and Ethernet address for hosts your machine knows of on the network. Very useful to debug hairy network troubles... I usually use

arp -a
Network and Sharing Center
control.exe /name Microsoft.NetworkAndSharingCenter

Reference: http://technet.microsoft.com/en-us/library/cc733147.aspx#BKMK_Anchor3

enter image description here


enter image description here#####Mouse Properties control mouse

-- or --




To free up some disk space:

format c:

No, really, here's Disk Cleanup:


enter image description here


To open the Windows Event Log (Event Viewer).


enter image description here

  • And I always thought I had to do eventvwr.msc...thanks :)
    – user1804
    May 4, 2009 at 23:22

calc to open Calculator.

  • ??????..........
    – Adyt
    May 20, 2009 at 9:00
  • set path=c:\sierra\ll4 ll4 to open up Leisure Suit Larry Jul 24, 2009 at 21:45
net statistics workstation


net statistics server

One way of finding out how long the box has been up for.

Note: The times that these commands report are how long the Workstation and Server services have been running for. These are normally started with the rest of the OS, but I've seen secure builds that disable Workstation.


Depending on the version of Windows, Scheduled Tasks, and for command-line goodness, the schtasks or at commands.


Parameter List:
    /Create  : Creates a new scheduled task.
    /Delete  : Deletes the scheduled task(s).
    /Query  : Displays all scheduled tasks. 
    /Change  : Changes the properties of scheduled task. 
    /Run  : Runs the scheduled task immediately. 
    /End  : Stops the currently running scheduled task. 
    /?              Displays this help/usage.


\\computername: Specify a remote computer (default local machine.
time: Specify the time when the task is to run.
/interactive: Allow the task to interact with the desktop of the user who is logged on at the time the task runs.
/every:date,...: Schedule the task to run on the specified day or days of the week or month.
/next:date,...: Schedule the task to run on the next occurrence of the day (for example, next Monday).
command: Specify the command, the program (.exe or .com file), or the batch program (.bat or .cmd file) that you want to run.
id: Specify the identification number that is assigned to a scheduled task.
/delete: Cancel a scheduled task. If you omit the id parameter, all scheduled tasks on the computer are canceled.
/yes: Force a yes answer to all queries from the system when you cancel scheduled tasks.

I find the FOR command to be essential, usually parsing a text file of server names or user accounts. Sure, powershell or vbscript is more versatile, but sometimes the command prompt is what you have.

FOR /f %i in (servername.txt) do psexec \\%i netsh int ip show dns 

(with pstools) runs netsh on multiple servers and outputs their dns settings.

FOR /F "tokens=1,2,3* skip=8 usebackq" %i in (`net group /domain "Domain Admins"`) do net user /domain %i && net user /domain %j && net user /domain %k 

Dumps out each Domain Admin in WinNT "net user" style -- doing a dsquery command would be better. Add ">>filename.txt" to each part to save in a file. The >>file format appends. You get an error on the last line from the "net group".

Full command details are in "FOR /?" including string substitution, doing sequences (FOR /L %i IN (start,step,end) gives a loop where %i can be a number) and compound results.


Remote Assistance

%SYSTEMROOT%\System32\rcimlby.exe -LaunchRA

This is very handy to create as a shortcut on a users desktop. It goes straight to the "Invite someone to help you" page in the help centre. (Tested on XP/Pro Home).


The Advanced Tab of the System Properties dialog.

control sysdm.cpl,@0,3

I use this regularly to get to Page file settings, Performance, Environment Variables and User Profiles.


@0 = the function within sysdm.cpl to display (In this case System Properties)

3 = the tab number to activate (in this case Advanced)

For anyone interested, Victor Laurie provides more info on this syntax.


Restart an IIS app pool from the command line:

cscript c:\WINDOWS\system32\iisapp.vbs /a SuperDuperAppPool /r

Where 'SuperDuperAppPool' is your app pool name


fsmgmt.msc to access File Shares.

  • +1 I have always went through Computer Management screen for this.
    – dance2die
    May 4, 2009 at 14:50

To manage the entire IIS7 from the standard command-line (no PowerShell needed ;)

  • For some reason, I am not able to run that command. What version of Windows does that command work under?
    – dance2die
    May 4, 2009 at 23:44
  • It might not be in the path, which would be %windir%\system32\inetsrv\appcmd.exe I think. Version of Windows is anything with IIS7 installed. May 5, 2009 at 11:17

There have been a couple of mentions of WMIC, but there's a lot of power there that isn't being highlighted. Granted, much of this can be done easier now with PowerShell, but if you don't know PowerShell or aren't able to use it for whatever reason, then it's WMIC to the rescue!

You are able to use many of the WQL keywords. For some reason a nice well-documented syntax on how to use these on the command line in conjunction with WMIC is not found anywhere.

Some examples:

List the QFE (Quick Fix Engineering) hotfixes installed on a system

// See them all
wmic qfe | more

// List the HotFixID, InstalledBy and InstalledOn properties of the ones that begin with "KB9"
wmic qfe where "HotfixID like '%KB9%'" get HotFixID,InstalledBy,InstalledOn

// Useful if you're just trying to find out if a particular KB is installed, and you don't care about the properties
wmic qfe | find "981793"

// Or, if you need the properties just for the one
wmic qfe where "HotFixID = 'KB981793'"

Display, start and stop services! Very useful when you have a group of related services that you need to stop/start.

// Display McAfee services
wmic service where "DisplayName like '%McAfee%'"

// Stop all McAfee services
wmic service where "DisplayName like '%McAfee%'" call StopService

Context-sensitive Help

See what properties are available with a particular alias:

wmic service get /?

See what methods are available with a particular alias:

wmic service call /?

See which classes the aliases map to:

wmic alias list brief

Run a query or command against multiple computers:

// Get a list of all the patches on hostname1 and hostname2 and save it as a .csv file for easy import into Excel
wmic /node:hostname1,hostname2 get /format:csv > Patches.csv

// You can also list all your systems (one per line) in a text file and run it against all of them:
wmic /node:@MyServers.txt get /format:csv > Patches.csv

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .