Windows Command Line Tools

regsvr32

This command-line tool registers .dll files as command components in the registry.

map

A Windows Recovery Console command used to display all drive letters, partition sizes, file system types, and relationships to actual physical hard drives on your computer.

bootrec

A Windows Recovery Environment troubleshooting and repair tool that repairs the master boot record, boot sector, or BCD store. It replaces the fixboot and fixmbr Recovery Console commands used in Windows XP and earlier operating systems.

cd

A command line argument used to change the current working directory in operating systems such as Unix, DOS, OS/2, AmigaOS (where if a bare path is given, cd is implied), Windows, and Linux.

netstat (Network Statistics)

A command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol statistics.

tasklist

A command-line version of the Task Manager

nbtstat

A diagnostic tool for NetBIOS over TCP/IP. Its primary design is to help troubleshoot NetBIOS name resolution problems.

dxdiag

A diagnostics tool used to test DirectX functionality and troubleshoot video- or sound-related hardware problems.

convert

Converts a drive from FAT or FAT32 to NTFS w/o losing any data Important Options: convert C: /fs:ntfs

Command Prompt

Text prompt for entering commands.

convert d: /fs:ntfs (then type hard drive name/label)

To change a hard drive to NTFS without losing data

nbtstat -a <device name>

Lists the remote machine's name table given its name

diskpart

A fully functioning command-line partitioning tool.

ping

A computer network administration utility used to test the reachability of a host on an Internet Protocol (IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer. -t (ping -t server1). On Windows-based systems, ping sends out only four ping requests by default, but the -t switch causes ping to continue until you stop it by pressing CTRL + C. You can see how this works on your system by using ping -t localhost. -a (ping -a 192.168.1.10). This attempts to resolve the IP address to a host name before it sends out ping requests. This requires an available method to perform reverse lookups. DNS servers can do this, but they aren't always configured to do so. You can see how this works on your system by using ping -a 127.0.0.1. -4 (ping server1 -4). This forces ping to use IPv4. You can see how this works on your system by using ping localhost -4. 2-6 (ping server1 -6). This forces ping to use IPv6. You can see how this works on your system by using ping localhost -6.

Recovery Console

A feature of the Windows 2000, Windows XP and Windows Server 2003 operating systems. It provides the means for administrators to perform a limited range of tasks using a command line interface. Its primary function is to enable administrators to recover from situations where Windows does not boot as far as presenting its graphical user interface. This feature is used to provide a way to access the hard drive in an emergency through the command prompt.

dig

A network administration command-line tool for querying Domain Name System (DNS) name servers. Dig is useful for network troubleshooting and for educational purposes. Dig can operate in interactive command line mode or in batch mode by reading requests from an operating system file. When a specific name server is not specified in the command invocation, it will use the operating systems default resolver, usually configured via the resolv.conf file. Without any arguments it queries the DNS root zone.

Command

A request, typed from a terminal or embedded in a file, to perform an operation or to execute a particular program.

MSconfig

A system utility used to troubleshoot the Microsoft Windows startup process. It can disable or re-enable software, device drivers and Windows services that run at startup, or change boot parameters.

autochk

A version of Chkdsk that runs only on NTFS disks and only before Windows starts. This command cannot be run directly from the command-line. Instead, it runs in the following situations: 1.) If you try to run Chkdsk on the boot volume 2.) If Chkdsk cannot gain exclusive use of the volume 3.) If the volume is flagged as dirty

Time to Live (TTL)

Also known as "hop limit", is a mechanism that limits the lifespan or lifetime of data in a computer or network. This mechanism may be implemented as a counter or timestamp attached to or embedded in the data.

net

Command in Windows that allows users to view a network without knowing the names of the other computers on that network

copy

Command in the command-line interface for making a copy of a file and pasting it in another location.

xcopy

Command in the command-line interface used to copy multiple directories at once, which the copy command could not do.

md (mkdir)

Command in the command-line interface used to create directories.

del (erase)

Command in the command-line interface used to delete/erase files.

format

Command in the command-line interface used to format a storage device.

rd (rmdir)

Command in the command-line interface used to remove directories.

nslookup

Command-line program in Windows used to determine exactly what information the DNS server is providing about a specific host name. This command is used to look for specific records in a DNS server. For example, it can query DNS to determine whether DNS can accurately resolve a host name to an IP address.

Windows Powershell

Command-line tool included with Windows 7 and available for earlier versions from Microsoft. Offers a number of powerful scripting tools for automating changes both on local machines and over networks.

sfc (System File Checker)

Command-prompt program (sfc.exe) that scans, detects, and restores Windows system files, folders and paths.

tracert

Commonly pronounced as "trace route," this command will show all the routers between two systems. If you can't connect to another networked system, tracert can help you identify where the connection stops.

dir

Displays a list of files and subdirectories in a directory.

netstat -a

Displays all active connections and listening ports

dir /s

Displays files in specified directory and all subdirectories.

ver

Displays the Windows version.

netstat -b

Displays the executables (binaries) involved in creating each connection or listening port. In some cases well-known executables host multiple independent components, and in these cases the sequence of components involved in creating the connection or listening port is displayed. In this case the executable name is in [ ] at the bottom, on top is the component it called, and so forth until TCP/IP was reached. Note that this option can be time-consuming and will fail unless you have sufficient permissions.

tree /f

Displays the names of the files in each folder.

netstat -n

Does not resolve hostnames. Instead displays addresses and port numbers in numerical form.

regedit

Enables you to view, search for, and change settings in your system registry, which contains information about how your computer runs.

shutdown

Executed within a command shell window, shutdown.exe is the command-line shutdown application that can shut down the user's computer or another computer on the user's network.

chkdsk /f

Fixes errors on the disk

tree

Graphically displays the folder structure of a drive or path.

chkdsk (Check Disk)

Hard drive error detection and, to a certain extent, correction utliity in Windows. Originally a DOS command (chkdsk.exe); also the executable for the graphical Error-checking tool.

Batch File

In DOS, OS/2, and also Microsoft Windows, this is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter.

mmc

Launches an extensible common presentation service for management applications.

nbtstat -n

Lists local NetBIOS names.

nbtstat -A <IP address>

Lists the remote machine's name table given its IP address

defrag

Locates and consolidates fragmented files on local volumes to improve system performance. Only to be used on platter-based hard drives. Do not use on SSD!

chkdsk /r

Locates bad sectors and recovers readable information Implies /f

Internet Control Message Protocol (ICMP)

One of the main protocols of the Internet Protocol Suite. It is used by network devices, like routers, to send error messages indicating, for example, that a requested service is not available or that a host or router could not be reached. This protocol can also be used to relay query messages.

Hop

One portion of the path between source and destination. Data packets pass through routers and gateways on the way. Each time packets are passed to the next device, a hop occurs. To see how many hops it takes to get from one host to another ping or traceroute/tracepath commands can be used.

fixmbr

Part of the Recovery Console that writes a new master boot record to a disk.

fixboot

Part of the Recovery Console that writes a new volume boot record to a volume.

ping -t

Ping continuously until stopped with Ctrl+C

robocopy

Powerful command-line utility for copying files and directories, even over a network.

/? (Information)

Provides options and syntax for command line utlities and programs.

bootrec /fixmbr

Repairs critical disk structures. /fixmbr option writes the master boot record of the system partition using the master boot record compatibile with Windows 7. This operation does not overwrite the existing partition table.

fixmbr [device-name]

Repairs the master boot record of the boot partition. Device-name is an optional name that specifies the device that needs a new MBR. If this is left blank then the boot device is used. Only supported on x86-based computers

ping -a

Resolves address to hostnames

bootrec /ScanOs

Scans all disks for installations compatible with Windows 7 and displays the entries that are currently not in the boot configuration store.

sfc /scannow

Scans integrity of all protected system files and repairs files with problems when possible.

bootcfg /rebuild

Scans the hard disks of the computer for Windows XP installations and then displays the results.

ping -n <count>

Sends a specified number of echo requests

ping -f

Sets Don't fragment flag in packet (IPv4 only)

msinfo32

Shows details about your computer's hardware configuration, computer components, and software, including drivers.

shutdown -r

Shutdown and restart the computer

mstsc -v <IP address>

Specifies the specific remote computer to connect to via RDP

copy /y

Suppresses prompting to confirm you want to overwrite an existing destination file

taskkill

Used by Microsoft Windows XP, Vista and 7 to terminate processes.

defrag -f

Used when needing to defrag a hard drive with less than 15% of its space free.

Command-Line Interface

User interface for an OS devoid of all graphical trappings.

tree /a

Uses ASCII text instead of extended characters.

Sysprep

Utility built into Windows for image deployment over the network. Preps the system to be moved as an image file.

copy /v

Verifies that new files are written correctly.

bootrec /fixboot [drive]

Writes a new boot sector onto the system partition using the boot sector compatible with Windows 7.

ipconfig

ipconfig /all command provides a wealth of information, including the media access control (MAC) address of the NIC. ipconfig /release. Release a DHCP lease ipconfig /renew. Renew a DHCP lease, and get a new IP address ipconfig /displaydns. Show all host name to IP address mappings that are in the DNS cache ipconfig /flushdns. Remove host name to IP address mappings provided from DNS from cache