Windows Command Line Reference

Guide
1. System Information Configuration
These commands provide detailed information about the operating system, hardware,
and user context.

systeminfo
Displays detailed OS configuration, hardware, and patches (hotfixes).
 systeminfo
 systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" (Quick OS details)
 systeminfo /s <remote_hostname> (Query remote system - requires permissions)
whoami
Displays current user context.
 whoami (Current user)
 whoami /groups (Group memberships)
 whoami /priv (User privileges - essential
for capability assessment. Admin often
required to see all)
 whoami /fqdn (Fully qualified domain name)
 whoami /all (Combines user, groups, privileges)
hostname
Displays the computer's hostname.
 hostname
ver / winver
Displays Windows version.
 ver (Command-line version)
 winver (GUI window with build number)
getmac
Displays MAC address(es).
 getmac /v (Verbose, shows adapter name)
bcdedit
Manages Boot Configuration Data. (Admin Required).
 bcdedit /enum all (Check for unusual boot entries)
driverquery
Displays installed device drivers.
 driverquery (Basic list)
 driverquery /v (Verbose, includes signature info)
 driverquery /si (Signed drivers)
msinfo32
Opens System Information GUI (comprehensive hardware/software info).
 msinfo32 (Opens GUI)
 msinfo32 /report C:\temp\[Link] (Saves report to file)
 nfo32 (Opens GUI)
path
Displays or sets the command search path.
 path
wmic
(Windows Management Instrumentation Command-line). Note: Being deprecated;
PowerShell's Get-CimInstance is preferred, but wmic is still widely used.
 wmic os get Caption,Version,BuildNumber,OSArchitecture
 wmic product get name,version (Installed software - can be slow)
 wmic qfe list brief (Quick Fix Engineering - installed patches)
 wmic process list brief (Running processes)
 wmic logicaldisk get caption,description,filesystem,size,freespace
 wmic useraccount list brief
 wmic netlogin get name,lastlogon (Requires permissions)
Attacker Usage Examples (Detection & Understanding):
 wmic /node:"<target>" process call create "[Link] /c <command>" (Remote execution)
 wmic startup create Name="evil", Command="C:\path\[Link]" (Persistence)
 wmic process where name="[Link]" delete (Terminate process)
powercfg
Manages power settings.
 powercfg /a (Shows available sleep states)
 powercfg /energy (Generates energy efficiency report, can reveal issues)
 powercfg /lastwake (Shows what woke the system)
fsutil
File system utility.
 fsutil fsinfo drives (List drives)
 fsutil fsinfo volumeinfo C: (Detailed volume info)
 fsutil dirty query C: (Check if volume is marked 'dirty'. Admin Required)
 fsutil usn readjournal C: (Read USN change journal - advanced forensics. Admin
Required)
set
Displays, sets, or removes environment variables.
 set (Show all variables)
 set PROCESSOR_ARCHITECTURE (Show specific variable)
msconfig
Opens System Configuration utility (boot options, services, startup).
 msconfig (Opens GUI)

2. Network Analysis Configuration

Tools for testing connectivity, viewing configurations, and analyzing network traffic.

ipconfig
Displays IP configuration.
 ipconfig (Basic IP/Subnet/Gateway)
 ipconfig /all (Detailed info including MAC, DNS, DHCP)
 ipconfig /displaydns (Show DNS resolver cache contents)
 ipconfig /flushdns (Clear DNS resolver cache. Admin Required)
 ipconfig /registerdns (Register DNS name and IP. Admin Required)
 ipconfig /release & ipconfig /renew (DHCP operations)
ping
Tests network connectivity using ICMP Echo requests.
 ping [Link]
 ping -n 20 <hostname_or_ip> (Send 20 pings)
 ping -t <hostname_or_ip> (Ping continuously until stopped)
netstat
Displays network connections, listening ports, statistics.
 netstat -ano (Show TCP/UDP, listening ports, IPs/ports, PIDs)
 netstat -anob (Like -ano but includes executable name - can be slow. Admin
Required)
 netstat -p tcp -ano (Filter by protocol)
 netstat -r (Show routing table, similar to route print)
 netstat -e (Ethernet statistics)
 netstat -s (Per-protocol statistics)
tracert
Traces the route (hops) to a destination.
 tracert [Link]
 tracert -d <hostname_or_ip> (Do not resolve addresses to hostnames - faster)
pathping
Combines ping and tracert, showing latency and packet loss at each hop over time.
More informative than tracert but slower.
 pathping [Link]
 pathping -n -q 15 [Link] (No hostname resolution, 15 queries per hop)
nslookup
Queries DNS servers.
 nslookup [Link] (Basic A record lookup)
 nslookup -type=mx [Link] (Query for MX records)
 nslookup [Link] [Link] (Query using a specific DNS server)
 nslookup (Interactive mode)
arp
Displays and modifies the Address Resolution Protocol (ARP) cache (IP-to-MAC
mapping).
 arp -a (Show current ARP entries)
  arp -d * (Delete ARP cache entries. Admin Required)
netsh
(Network Shell): Powerful network configuration tool. (Admin Required for most
modifications).
 netsh interface ip show config (Alternative to ipconfig)
 netsh advfirewall firewall show rule name=all (Show all firewall rules)
 netsh advfirewall set currentprofile state off (Disable firewall for current profile - use
caution!)
 netsh wlan show profiles (List saved Wi-Fi profiles)
 netsh wlan show profile name="ProfileName" key=clear (Show saved Wi-Fi password.
Admin Required)
 netsh interface show interface (List network interfaces)
route
Displays and modifies the local IP routing table.
 route print (Show routing table)
 route print -4 (Show IPv4 routes only)
 route add <destination> MASK <subnet_mask> <gateway> METRIC <metric_cost> IF
<interface_index> (Admin Required)
 route delete <destination> (Admin Required)

3. Process & Service Management

Commands to manage running applications, background services, and scheduled tasks.

tasklist
Lists running processes.
 tasklist (Basic list)
 tasklist /svc (Show services hosted in each process. Admin Required for some info)
 tasklist /m <[Link]> (Show processes using a specific DLL)
 tasklist /v (Verbose output, includes user context, window title)
 tasklist /fi "IMAGENAME eq [Link]" (Filter by image name)
 tasklist /s <remote_hostname> (Remote query - requires permissions)
query process / query user / query session
Shows Remote Desktop Session Host information.
 query process * (Show processes for all users)
 query user or quser (Show logged-on users)
 query session or qwinsta (Show session information)
taskkill
Terminates processes. (Admin Required often needed, especially for /F).
 taskkill /IM [Link] (Terminate by image name)
 taskkill /PID <process_id> (Terminate by Process ID)
 taskkill /IM <[Link]> /F (Force termination)
 taskkill /PID <PID1> /PID <PID2> /F (Terminate multiple PIDs)
 taskkill /T /IM <parent_process.exe> /F (Terminate process and its children)
schtasks
Schedules commands and programs (Task Scheduler). (Admin Required for
creating/modifying system tasks).
 schtasks /query /fo LIST /v (Detailed list of all tasks)
 schtasks /query /tn "MyTask" (Query a specific task)
 schtasks /create /tn "MyTask" /tr "C:\path\[Link]" /sc ONLOGON (Example creation)
 schtasks /delete /tn "TaskName" /f (Delete task)
 schtasks /run /tn "TaskName" (Run task now)
 schtasks /end /tn "TaskName" (Stop running task)
sc (Service Control)
Manages Windows services. (Admin Required for most actions).
 sc query (List running services)
 sc query state= all (List all services)
 sc qc <ServiceName> (Query Configuration: binary path, dependencies, start type -
CRITICAL for analysis)
 sc queryex <ServiceName> (Query Extended: PID, flags)
 sc getdisplayname "ServiceNameKey" (Get friendly display name)
 sc getkeyname "Display Name" (Get the service key name)
 sc start <ServiceName>
 sc stop <ServiceName>
 sc config <ServiceName> start= disabled (Change start type)
 sc delete <ServiceName> (Use extreme caution)
net start / net stop
Starts or stops services (simpler than sc for basic operations).
 net start (List running services)
 net start "Print Spooler"
 net stop "Print Spooler" (Admin Required)
taskmgr
Opens Task Manager GUI.
 taskmgr

4. File Systems Data Management

Commands for file manipulation, directory navigation, and file system analysis.

dir
Lists files and directories.
 dir C:\Windows
 dir /a (Show hidden and system files)
 dir /s (Recursive)
 dir /b (Bare format, names only)
 dir /o:d (Sort by date)
 dir /tc (Show creation time)
cd (or chdir)
Changes directory.
  cd C:\Users
 cd .. (Move up one level)
md (or mkdir)
Creates a new directory.
 md C:\Temp\NewFolder
rd (or rmdir)
Removes a directory.
 rd C:\Temp\OldFolder (Only if empty)
 rd /s /q C:\Temp\OldFolder (Remove directory and contents, quiet mode - use
caution)
del (or erase)
Deletes files. (WARNING: Destructive).
 del C:\Temp\[Link]
 del /f /q C:\Temp\*.tmp (Force delete read-only, quiet mode)
copy
Copies files.
 copy C:\[Link] D:\backup
xcopy
Copies files and directories (more options than copy).
 xcopy C:\source D:\dest /E /H /I /Y (/E=subdirs, /H=hidden/system, /I=assume dest is
dir, /Y=suppress prompt)
robocopy
Robust file copy utility (preferred over xcopy).
 robocopy C:\source D:\dest /E /COPYALL /R:3 /W:10 (/E=subdirs, /COPYALL=all file
info, /R=retries, /W=wait time)
 robocopy C:\source D:\dest /MIR (Mirrors directory - WARNING: deletes files in dest
not in source)
move
Moves files or renames directories.
 move C:\[Link] D:\ (Move file)
 move C:\OldFolderName C:\NewFolderName (Rename folder)
ren (or rename)
Renames files or directories.
 ren [Link] [Link]
type
Displays contents of a text file.
 type C:\Windows\System32\drivers\etc\hosts
find
Searches for a text string in files (basic).
 find "error" C:\logs\[Link]
findstr
Searches for strings in files (more powerful, supports regex).
  findstr /i /s /c:"password" C:\Users\*.txt (Case-insensitive, search subdirs, literal string)
 ipconfig /all | findstr /i "DNS Servers" (Pipe output to findstr)
sort
Sorts input (e.g., file contents) alphabetically.
 type [Link] | sort
 sort < [Link] > sorted_names.txt
comp / fc
Compares contents of files.
 comp [Link] [Link] (Binary comparison)
 fc [Link] [Link] (Text comparison, shows differences)
tree
Displays directory structure graphically.
 tree C:\Windows /F (Include files)
attrib
Displays or changes file attributes.
 attrib C:\Windows\System32\[Link] (Show attributes)
 attrib +h C:\[Link] (Hide file. Admin often required)
 attrib -r C:\[Link] (Remove read-only)
cipher
Displays or alters file encryption (EFS).
 cipher /c <filename> (Show encryption status)
 cipher /e /c:\SecretFolder (Encrypt folder - new files will be encrypted. Admin
Required)
 cipher /w:C: (Wipe free space - can take a long time. Admin Required)

Would you like me to find the usage of a specific command from this list, or perhaps list
the commands that require administrator privileges?