SOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
Edit

70+ Essential Windows CMD Commands

File and Directory Commands

  1. dir Lists files/directories.

:: Basic: List all files with details
dir /a
:: Advanced: Find specific file types recursively
dir *.txt /s /p

  1. cd Changes directory.

:: Basic: Navigate to a folder
cd C:\Users
:: Advanced: Switch to path with spaces
cd "C:\Program Files (x86)"

  1. mkdir/md Creates a directory.

:: Basic: Create a single folder
mkdir Data
:: Advanced: Create nested folders
mkdir Parent\Child\Grandchild

  1. rmdir/rd Deletes a directory.

:: Basic: Remove empty folder
rmdir Data
:: Advanced: Delete non-empty folder
rmdir /s /q Data

  1. del Deletes files.

:: Basic: Delete a single file
del temp.txt
:: Advanced: Delete all .log files silently
del *.log /q

  1. copy Copies files.

:: Basic: Copy a file
copy file.txt D:\Backup
:: Advanced: Copy multiple files with overwrite
copy *.txt D:\Backup /y

  1. xcopy Extended copy for files/directories.

:: Basic: Copy a directory
xcopy Data D:\Backup
:: Advanced: Copy with hidden files and subdirs
xcopy Data D:\Backup /E /H

  1. move Moves/renames files.

:: Basic: Move a file
move file.txt D:\Archive
:: Advanced: Rename multiple files
move *.txt *.bak

  1. attrib Changes file attributes.

:: Basic: Hide a file
attrib +h secret.txt
:: Advanced: Make folder read-only and hidden
attrib +r +h Data

  1. ren Renames files/directories.

:: Basic: Rename a file
ren old.txt new.txt
:: Advanced: Bulk rename files
ren *2023*.txt *2024*.txt

System Information Commands

  1. systeminfo Shows system configuration.

:: Basic: Display OS name
systeminfo | find "OS Name"
:: Advanced: Export full info to file
systeminfo > sysinfo.txt

  1. hostname Shows computer name.

:: Basic: Get hostname
hostname
:: Advanced: Log device name in script
echo %COMPUTERNAME% > device.txt

  1. ver Shows Windows version.

:: Basic: Check version
ver
:: Advanced: Verify version in script
ver | findstr "10.0"

  1. set Manages environment variables.

:: Basic: View all variables
set
:: Advanced: Add custom path
set PATH=%PATH%;C:\Tools

  1. wmic Performs system admin tasks.

:: Basic: Get CPU info
wmic cpu get name
:: Advanced: List installed software
wmic product get name,version

  1. whoami Shows current user.

:: Basic: Display username
whoami
:: Advanced: Get user SID
whoami /user

  1. tasklist Lists running processes.

:: Basic: Show all processes
tasklist
:: Advanced: Filter specific process
tasklist /fi "IMAGENAME eq notepad.exe"

Network Commands

  1. ipconfig Shows IP configuration.

:: Basic: Display IP details
ipconfig
:: Advanced: Release and renew IP
ipconfig /release && ipconfig /renew

  1. ping Tests network connectivity.

:: Basic: Ping a website
ping google.com
:: Advanced: Continuous ping
ping -t google.com

  1. tracert Traces route to a host.

:: Basic: Trace to domain
tracert google.com
:: Advanced: Trace without DNS
tracert -d 8.8.8.8

  1. netstat Shows connections/ports.

:: Basic: List active connections
netstat -a
:: Advanced: Show process IDs
netstat -a -o

  1. nslookup Queries DNS.

:: Basic: Resolve domain
nslookup google.com
:: Advanced: Query specific DNS server
nslookup google.com 8.8.8.8

  1. arp Manages ARP cache.

:: Basic: Show ARP table
arp -a
:: Advanced: Delete ARP entry
arp -d 192.168.1.1

  1. route Manages routing table.

:: Basic: Display routing table
route print
:: Advanced: Add persistent route
route add 10.0.0.0 MASK 255.255.255.0 192.168.1.1 /p

  1. net use Maps network drives.

:: Basic: Map a drive
net use Z: \\server\share
:: Advanced: Map with credentials
net use Z: \\server\share /user:domain\user password

  1. netstat -an Shows connections numerically.

:: Basic: List listening ports
netstat -an | find "LISTENING"
:: Advanced: Log connections
netstat -an > netlog.txt

  1. netsh Configures network settings.

:: Basic: Show Wi-Fi profiles
netsh wlan show profiles
:: Advanced: Export Wi-Fi profile
netsh wlan export profile name="MyWiFi" folder=C:\WiFi

Disk and Drive Commands

  1. chkdsk Checks/repairs disk errors.

:: Basic: Scan drive
chkdsk C:
:: Advanced: Fix errors on reboot
chkdsk C: /f /r

  1. diskpart Manages disks/partitions.

:: Basic: List disks
diskpart
list disk
:: Advanced: Create partition
diskpart
select disk 1
create partition primary

  1. format Formats a drive.

:: Basic: Format USB
format D: /fs:NTFS
:: Advanced: Quick format with label
format D: /fs:NTFS /q /v:MyUSB

  1. label Sets volume label.

:: Basic: Change label
label D: MyDrive
:: Advanced: Remove label
label D:

  1. vol Shows volume info.

:: Basic: Display volume details
vol C:
:: Advanced: Pipe to file
vol C: > volume.txt

  1. fsutil Manages file system.

:: Basic: Check drive type
fsutil fsinfo drivetype C:
:: Advanced: Disable 8.3 names
fsutil 8dot3name set C: 0

Task and Process Management Commands

  1. taskkill Terminates processes.

:: Basic: Kill process by name
taskkill /IM notepad.exe
:: Advanced: Force-kill by PID
taskkill /PID 1234 /F

  • Investigation Context: Detect malicious taskkill use (e.g., targeting MsMpEng.exe) in Defender XDR/Sentinel.

DeviceProcessEvents
| where ProcessCommandLine contains "taskkill /IM MsMpEng.exe"
| project Timestamp, DeviceName, ProcessCommandLine

  1. schtasks Manages scheduled tasks.

:: Basic: Create daily task
schtasks /create /tn MyTask /tr notepad.exe /sc daily
:: Advanced: Delete task
schtasks /delete /tn MyTask /f

  1. sc Controls services.

:: Basic: Check service status
sc query wuauserv
:: Advanced: Start a service
sc start wuauserv

  1. shutdown Performs shutdown/restart/logoff.

:: Basic: Shutdown in 60s
shutdown /s /t 60
:: Advanced: Cancel shutdown
shutdown /a

  1. start Starts program in new window.

:: Basic: Open Notepad
start notepad
:: Advanced: Open URL in browser
start https://google.com

  1. pause Pauses batch file.

:: Basic: Pause script
pause
:: Advanced: Pause with message
echo Pausing... & pause

  1. timeout Adds delay in scripts.

:: Basic: Wait 10 seconds
timeout /t 10
:: Advanced: Non-interactive wait
timeout /t 10 /nobreak

User and Security Commands

  1. net user Manages user accounts.

:: Basic: Add user
net user JohnDoe Pass123 /add
:: Advanced: Disable user
net user JohnDoe /active:no

  1. net localgroup Manages group memberships.

:: Basic: Add to Administrators
net localgroup Administrators JohnDoe /add
:: Advanced: List group members
net localgroup Administrators

  1. runas Runs program as another user.

:: Basic: Run Notepad as Admin
runas /user:Admin notepad.exe
:: Advanced: Run with saved credentials
runas /user:Admin /savecred notepad.exe

  1. cacls Modifies file permissions.

:: Basic: Grant read access
cacls file.txt /e /p Everyone:r
:: Advanced: Deny write access
cacls file.txt /e /d Everyone

  1. icacls Advanced file permissions.

:: Basic: Grant full control
icacls file.txt /grant Users:F
:: Advanced: Remove permissions
icacls file.txt /remove Users

  1. lock Locks workstation.

:: Basic: Lock session
rundll32.exe user32.dll,LockWorkStation
:: Advanced: Lock in script
echo Locking... & rundll32.exe user32.dll,LockWorkStation

  1. gpupdate Updates Group Policy.

:: Basic: Refresh policy
gpupdate
:: Advanced: Force user and computer policy
gpupdate /force /target:both

  1. secedit Applies security templates.

:: Basic: Export current config
secedit /export /cfg sec.cfg
:: Advanced: Apply template
secedit /configure /db secedit.sdb /cfg security.inf

Power and Shutdown Commands

  1. powercfg Manages power settings.

:: Basic: Generate battery report
powercfg /batteryreport
:: Advanced: Set power plan
powercfg /setactive 381b4222-f694-41f0-9685-ff5bb260df2e

  1. shutdown /s /t 0 Immediate shutdown.

:: Basic: Shutdown now
shutdown /s /t 0
:: Advanced: Shutdown with message
shutdown /s /t 0 /c "System maintenance"

  1. shutdown /r /t 0 Immediate restart.

:: Basic: Restart now
shutdown /r /t 0
:: Advanced: Restart with message
shutdown /r /t 0 /c "Applying updates"

  1. shutdown /l Logs off user.

:: Basic: Log off
shutdown /l
:: Advanced: Log off in script
echo Logging off... & shutdown /l

Windows Troubleshooting Commands

  1. sfc /scannow Repairs system files.

:: Basic: Scan and repair
sfc /scannow
:: Advanced: Verify specific file
sfc /verifyfile C:\Windows\System32\kernel32.dll

  1. DISM Repairs Windows images.

:: Basic: Check health
DISM /Online /Cleanup-Image /CheckHealth
:: Advanced: Restore health
DISM /Online /Cleanup-Image /RestoreHealth

  1. cleanmgr Launches disk cleanup.

:: Basic: Open cleanup GUI
cleanmgr
:: Advanced: Auto-clean temporary files
cleanmgr /sagerun:1

  1. eventvwr Opens Event Viewer.

:: Basic: Launch Event Viewer
eventvwr
:: Advanced: Open specific log
eventvwr /c:System

  1. msinfo32 Shows system info.

:: Basic: Open System Information
msinfo32
:: Advanced: Export to file
msinfo32 /report sysinfo.txt

Advanced and Miscellaneous Commands

  1. tree Displays folder structure.

:: Basic: Show folder tree
tree C:\Data
:: Advanced: Include files
tree C:\Data /f

  1. echo Displays messages or toggles echoing.

:: Basic: Print message
echo Hello, World!
:: Advanced: Disable echoing
echo off

  1. cls Clears CMD screen.

:: Basic: Clear screen
cls
:: Advanced: Clear in script
echo Clearing... & cls

  1. title Sets CMD window title.

:: Basic: Set title
title My Script
:: Advanced: Dynamic title
title Backup_%DATE%

  1. color Changes CMD colors.

:: Basic: Green text on black
color 0A
:: Advanced: Blue on white
color 1F

  1. exit Closes Command Prompt.

:: Basic: Exit CMD
exit
:: Advanced: Exit with code
exit /b 1

  1. prompt Changes CMD prompt.

:: Basic: Set default prompt
prompt $P$G
:: Advanced: Custom prompt
prompt $T$G

  1. help Shows command help.

:: Basic: Help for dir
help dir
:: Advanced: List all commands
help

CMD Scripting and Batch Commands

  1. if Conditional logic in scripts.

:: Basic: Check file existence
if exist file.txt echo Found
:: Advanced: Compare values
if %ERRORLEVEL%==0 echo Success

  1. for Loops through values.

:: Basic: List .txt files
for %f in (*.txt) do echo %f
:: Advanced: Process files in script
for /R %%f in (*.txt) do copy %%f D:\Backup

  1. goto Jumps to labeled line.

:: Basic: Jump to end
goto :end
:end
echo Done
:: Advanced: Conditional jump
if %ERRORLEVEL%==1 goto :error
:error
echo Failed

  1. call Calls another script/function.

:: Basic: Call script
call myscript.bat
:: Advanced: Call subroutine
call :subroutine
:subroutine
echo Subroutine

  1. setlocal / endlocal Manages variable scope.

:: Basic: Local variable
setlocal
set MYVAR=123
endlocal
:: Advanced: Preserve variable
setlocal EnableDelayedExpansion
set MYVAR=!DATE!
endlocal & set GLOBALVAR=%MYVAR%

Bonus Useful Commands

  1. clip Redirects to clipboard.

:: Basic: Copy dir output
dir | clip
:: Advanced: Copy system info
systeminfo | clip

  1. find Searches text in files.

:: Basic: Find text
find "error" log.txt
:: Advanced: Case-sensitive search
find /i "error" log.txt

  1. assoc Manages file associations.

:: Basic: Show .txt association
assoc .txt
:: Advanced: Set association
assoc .txt=txtfile

  1. driverquery Lists installed drivers.

:: Basic: List drivers
driverquery
:: Advanced: Export to CSV
driverquery /fo csv > drivers.csv

  1. taskview Opens Task View.

:: Basic: Launch Task View
explorer.exe shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
:: Advanced: Scripted launch
echo Opening Task View... & explorer.exe shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
Previous70+ Essential Powershell Commands

Last updated