100 Essential Windows Command-Line Tools for System Administration

1. System Management and Maintenance (30 commands)

systeminfo

– display detailed system information (install date, patches, memory, etc.) sfc /scannow – scan and repair corrupted system files [Administrator] chkdsk /f – check and fix disk errors (requires reboot) [Administrator] cleanmgr – launch Disk Cleanup utility defrag C: /O – optimize mechanical drive fragmentation (skip for SSD) msinfo32 – open System Information panel winver – show Windows version services.msc – open Services management console compmgmt.msc – open Computer Management diskmgmt.msc – open Disk Management devmgmt.msc – open Device Manager eventvwr – launch Event Viewer perfmon – open Performance Monitor taskschd.msc – open Task Scheduler lusrmgr.msc – open Local Users and Groups manager control – open Control Panel appwiz.cpl – open Programs and Features panel sysdm.cpl – open System Properties secpol.msc – open Local Security Policy editor rsop.msc – view Resultant Set of Policy slmgr.vbs -xpr – check Windows activation status wmic qfe list – list installed patches wmic bios get serialnumber – retrieve BIOS serial number powercfg /energy – generate power efficiency report ver – display OS version hostname – show computer name time – display or set system time date – display or set system date shutdown /r /t 0 – restart immediately shutdown /s /t 0 – shut down immediately

2. Network Diagnosis and Configuration (25 commands)

ipconfig /all

– show full network configuration ping 8.8.8.8 -t – continuously test connectivity tracert www.baidu.com – trace route to a host netstat -ano – list all network connections with process IDs nslookup www.qq.com – verify DNS resolution arp -a – display ARP cache table netsh interface ip show config – show NIC configuration netsh interface ip set dns "以太网" static 8.8.8.8 – set static DNS server netsh winsock reset – reset network protocol stack netsh advfirewall set allprofiles state off – temporarily disable firewall route print – display routing table net use K: \\192.168.1.100\share – map network drive netsh wlan show profiles – list saved Wi‑Fi profiles netsh wlan show profile name="Home" key=clear – reveal Wi‑Fi password netsh wlan connect ssid="Office" – connect to a specific Wi‑Fi network pathping www.taobao.com – combined route and packet loss test getmac /v – display detailed MAC address information net view – view shared resources on the LAN net share – manage shared folders ftp – launch FTP client telnet – launch Telnet client netsh trace start capture=yes – start network trace capture netsh trace stop – stop network trace capture ipconfig /flushdns – clear DNS cache ipconfig /registerdns – refresh DNS registration

3. File and Disk Operations (20 commands)

dir /s /ah

– recursively list directories and hidden files cd /d D:\logs – change drive and directory robocopy C:\src D:\backup /MIR /MT:8 – multithreaded mirror backup del /F /Q *.tmp – force delete temporary files rd /S /Q "D:\old" – delete non‑empty directory without prompts fsutil file createnew test.txt 1048576 – create a 1 MB test file type filename.txt – display text file contents copy file1.txt+file2.txt merged.txt – concatenate files find "error" log.txt – search for a string in a file tree /F – display directory tree with files md newfolder – create a new folder xcopy C:\data D:\backup /E /H /C – copy directory tree including empty dirs and hidden files move file.txt D:\newfolder – move a file ren old.txt new.txt – rename a file attrib +h secret.txt – set hidden attribute fc file1.txt file2.txt – compare file contents compact /c /s – enable NTFS compression on files diskpart – launch disk partition tool format E: /FS:NTFS /Q – quick format a volume cipher /W:D: – securely wipe free space on a drive diskpart → clean – (high‑risk) permanently erase a disk

4. Process and User Management (15 commands)

tasklist /svc

– list processes with associated services taskkill /F /IM chrome.exe – force‑kill a process taskkill /PID 1234 /T – terminate a process tree start notepad – launch an application net user Tech P@ssw0rd /add – create a new user net localgroup administrators Tech /add – add user to Administrators group net user Tech /delete – delete a user query session – view remote desktop sessions whoami – display current user runas /user:admin cmd – run a command as another user qwinsta – show terminal services sessions (same as query session) sc query – query service status sc stop WinDefend – stop a service sc config DiagTrack start= disabled – disable a service wmic process get name,processid – list processes with IDs

5. Operations Practical Commands (10 commands)

for /L %i in (1,1,100) do ping -n 1 192.168.1.%i

– batch ping scan of a subnet

forfiles /p "C:\logs" /s /m *.log /d -7 /c "cmd /c del @path"

– automatically clean logs older than 7 days auditpol /set /category:"Account Logon" /success:enable – enable successful login auditing wmic product get name,version > software.csv – export installed software list wmic memorychip get capacity,speed – retrieve memory module details wmic diskdrive get model,size – retrieve hard‑disk information

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

– view startup entries schtasks /query /fo LIST /v – show detailed scheduled tasks vssadmin list shadows – list volume shadow copies powercfg /batteryreport – generate battery health report

High‑Risk Operation Warning ⚠️

:: Permanent deletion (cannot be recovered)
format C: /FS:NTFS
diskpart → clean

:: Use with extreme caution
 del /F /S /Q *.*
 rd /S /Q C:\Windows

Operations Golden Rules

Test in a safe environment – run dangerous commands on a test machine first.

Principle of least privilege – avoid using administrator rights for routine tasks.

Double‑check before deletion or formatting – verify paths carefully.

Log critical actions – redirect output to a log file, e.g., > log.txt.

Operational Insight: Mastering these 100 commands gives you a "Swiss‑army knife" for Windows system administration; keep the list handy for quick reference.