Is there a global, persistent CMD history?

Sometimes I forget how the exact syntax of a CMD command looks and then I would like to search my own CMD history. Clearly, within the same session, you can browse it with the up and down arrow keys but what about the history of former CMD sessions? Is there a file, a log the history gets written to or does it all go to digital Nirvana?

Thanks!

• You can hijack the exit command to automatically save a log before exiting: doskey exit=doskey /history ^>^> C:\path\to\cmdhistory.log $T exit$* but you'll need to figure out how to execute this automatically at each command prompt session startup. PS: Make sure the path of the log file is writable. C:\  is not writable for a non-admin command prompt. – ADTC Jan 7 '18 at 5:00
• @ADTC: AutoRun should handle 'each startup': superuser.com/a/302553/333316 or stackoverflow.com/a/17405182/2868801 – dave_thompson_085 Jun 3 '18 at 20:40

No, Windows command prompt history can't be saved when a session ends.

• for real? how do you know this? Sorry for questioning you, I guess you are right but how can u know unless u programmed the damn thing ;) – raoulsson Dec 18 '09 at 0:08
• Ok, let me rephrase :-) The Windows command interpreter ("cmd.exe") doesn't provide any support for saving/exporting/keeping history, of, if it does, Microsoft didn't document it and nobody was ever able to find it. You can of course try to work around that, like Sean suggested, but there's (or does appear to be) no built-in support for this. – Massimo Dec 18 '09 at 6:17
• You can press F7 to see a history list of the current session. – jftuga Feb 14 '11 at 13:20
• CURRENT session is the keyword here. – Massimo Aug 24 '15 at 5:42
• You can see / save the history by running doskey.exe /history (that's also where the F7 shortcut comes from, BTW) but there's no way to load it back up in your next session. – Coderer Feb 19 '16 at 9:45

Not natively but check out: http://mridgers.github.io/clink/ , makes cmd.exe much more productive. Quoting features from the project page:

Powerful Bash-like line editing from GNU's Readline library.
Superior path completion (TAB).
Paste from clipboard (Ctrl-V).
Support for the completion of executables/commands, and environment variables.
Undo/Redo (Ctrl-_ or Ctrl-X, Ctrl-U)
Improved command line history.
Persists across sessions.
Searchable (Ctrl-R and Ctrl-S).
History expansion (e.g. !!, !<string>, and !$). Scriptable completion using Lua.  • clink solved everything – Still.Tony Jan 20 '15 at 16:27 • Any plans to include it by default in Windows? :D – Jaime Hablutzel Mar 1 '15 at 22:40 • Can you set a ~/.inputrc when using clink? (and do you know whether it can be used Console or anything?) – Mike H-R Apr 20 '15 at 17:39 • Apparently, see the doc github.com/mridgers/clink/blob/master/docs/clink.md. – Baris Demiray Dec 18 '15 at 9:29 • ... except aliases. clink hates doskey; forget all of your years-long and carefully-assigned aliases. that's why i stopped to use it. though i miss all the features. – user246890 Jul 3 '17 at 17:31 Massimo is correct that your command prompt history does not persist across sessions. You could manually grab this before closing your prompt by typing doskey /history > history.txt Or... you could use PowerShell as your CMD prompt, and follow this post to persist your history across sessions. You can use clink. Clink combines the native Windows shell cmd.exe with the powerful command line editing features of the GNU Readline library, which provides rich completion, history, and line-editing capabilities. Easiest way to install clink is using chocolatey. Once you install chocolatey, you can install clink by typing choco install clink  Starting from the next time you start cmd.exe, it should store history across sessions. • Finally decided to give Chocolatey a shot because of this post. Installation was as easy as of brew in macOS. And now I have a Bash-like command prompt in Windows! – TranslucentCloud Sep 23 '16 at 7:39 It is possible to save the current history to file, $ doskey /history > somefile.txt


But it seems there is no way to load it back as history. It is possible only to use a command line argument to load and execute all lines,

cmd.exe /K somefile.txt

, what can be useful to load a list of doskey macros. This invocation could be included in a shortcut so you don't need to type it everytime; this reference has some additional info on this approach.

There is a similar question on Superuser that bring some alternatives, including clink, as suggested by @RobertBak.

• Hmm, to load it back into history, wouldn't you simply need to save it to a .bat file and run it? – Pacerier Aug 23 '15 at 22:10
• @Pacerier running the commands again would surely include them back in the history, but it likely would have large side-effects. Imagine that you delete some files through the shell and then recreate them outside the shell through a long and painful process. Reloading the history through your procedure would unexpectedly delete the files again. – mMontu Aug 24 '15 at 11:00
• @Pacerier you realize "run it" does mean executing all those commands, right? It's not simply loading them into history, but actually letting them have some effects on your system. – ADTC Jan 7 '18 at 5:07

Command History: To enable a command history (that can be accessed using the up and down arrow keys) just execute doskey at the command prompt. For example, to create a command history of 100 elements:

doskey /listsize=100

• That doesn't answer the question at all?? – Chopper3 Feb 14 '11 at 13:27
• Not works on Windows 10. – TranslucentCloud Sep 23 '16 at 7:27

clink is nice and the author publishes a chocolatey package on every release, however I would suggest DeepBlueCLI.

You can use https://github.com/sans-blue-team/DeepBlueCLI to set-up Windows Security Event ID 4688.

For PowerShell, DeepBlueCLI also uses module logging (PowerShell event 4013) and script block logging (4104). It does not use transcription.

The added benefit is that it logs the hash of the command line exe in AppLocker event log. Source: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing

Also, because this solution uses the Windows Event Log infrastructure, you can query it through WMI or PowerShell Get-EventLog. With clink, you have to learn another tool in order to detect system- or network-wide patterns of behavior.

• event 4688 is the key, and that is the central store how Windows record all executed commands. all other tools is just reading looking for this event. thanks. But by default is it not enable: itprotoday.com/strategy/… – Peter Teoh May 7 at 1:13