security-cheatsheet/cmd-command-cheat-sheet

CMD - Command Cheat Sheet ✅

Windows Command Prompt is an often ignored aspect of the modern Windows OSes. The
command prompt, also known as cmd.exe or cmd is a command line interpreter available
since the NT line of Windows OSes. While the majority reasons for which the command
prompt was used for can now be done through a graphical interface, this application has
remained with Windows and is still used by many. Although many of us might not have used
them, the fact that they still exist in modern day Windows is reason enough for us to be
familiar with it.

While the commands in Windows 10, 8, 7, Vista, and XP are called CMD commands or
Command Prompt commands, the commands in Windows 98/95 and MS-DOS are called
DOS commands. In this article, we have listed the most commonly used commands in the
Windows operating systems. In this source you can learn cmd commands and what they do.
If you have cmd commands you want to add, you can support it. 🙌🏻
Command Description

Allows programs to open data files in specified directories as if they were located in the current
append
directory.

assoc Displays or changes the file type associated with a particular file extension.
 Command Description

at Schedules commands and other programs to run at a specific date and time.

atmadm Displays connection information of the ATM adapter.

attrib Changes the attributes of a single file or a directory.

Auditpol Displays information about or performs functions to manipulate audit policies.

Configures the boot files on a PC or device to run the Windows operating system and to create a new
bcdboot
system BCD store.

bcdedit Used to view or make changes to Boot Configuration Data.

bdehdcfg Used to prepare a hard drive for BitLocker Drive Encryption.

bitsadmin Used to create, download or upload jobs and monitor their progress.

bootcfg Used to build, modify, or view the contents of the boot.ini file.

bootsect Updates the master boot code for hard disk partitions to switch between BOOTMGR and NTLDR.

break Sets or clears extended CTRL+C checking on DOS systems.

cacls Displays or changes access of the security descriptors on folders and files.

call Used to run a script or batch program from within another script or batch program.

Also known as chdir, is used to change the current working drive and/or directory in operating
cd
systems.
 Command Description

Used to perform various certification authority (CA) certificate requests, such as submit a request,
certreq
retrieve a response, create a new request, accept, sign, policy, sign and enrol.

Used to dump and display certification authority (CA) configuration information, configure Certificate
certutil
Services, backup and restore CA components, and verify certificates, key pairs, and certificate chains.

change Changes various terminal server settings like install modes, COM port mappings, and logons.

chcp Displays or configures the active code page number.

chdir Used to display the drive letter and folder that you are currently in.

checknetisolation Used to test apps that require network capabilities.

Enables or disables logons from client sessions on an RD Session Host (Remote Desktop Session
chglogon
Host) server, or displays current logon status.

chgport Can be used to display or change COM port mappings to be compatible with MS-DOS applications.

chgusr Used to change the install mode for the RD Session Host server.

chkdsk Verifies the file system integrity of a volume and fixes logical file system errors.

chkntfs Used to display or modify the checking of the disk drive using NTFS at boot time.

Allows batch files to prompt the user to select one item from a set of single-character choices and
choice
return the value of that choice to the program.

cipher Used to encrypt or decrypt files and folders on NTFS drives.

clip Copies the result of any command (stdin) to the clipboard in Windows.
 Command Description

Used to clear the screen or console window of all previously entered commands and any output
cls
generated by them.

cmd Starts a new instance of the cmd.exe command interpreter.

cmdkey Used to create, list and delete stored user names or credentials.

cmstp Used to install or uninstall a Connection Manager service profile.

color Changes the colors of the text and background within the Command Prompt window.

command Starts a new instance of the command.com command interpreter.

Performs a binary comparison of two set of files or multiple files and shows the differences between
comp
them.

compact Displays and changes the compression state of files or directories on NTFS partitions.

convert Used to convert volumes using the FAT or FAT32 formatted file systems to NTFS.

copy Copies one or more files from one directory to another.

cscript Provides command-line options for setting and executing script properties via Microsoft Script Host.

ctty Used to change the default input and output devices for the system.

date Used to show or change the current date.

driveSpace Initially known as DoubleSpace can be used to create or configure DoubleSpace compressed drives.

debug Starts Debug, a command line application used to test and edit programs.
 Command Description

defrag Used to defragment a drive you specify.

del Used to delete one or more files.

deltree Used to delete a directory and all the files and subdirectories within it.

dir Displays a list of files and folders contained inside the folder that you are currently working in.

diskcomp Used to compare contents of two floppy disks.

diskcopy Copies the entire contents of one floppy disk to another.

Prevents creating multi-partition layout for removable media such as flash drives and also used for
diskpart
partitioning internal hard drives..

Used to remotely enable or disable physical or logical disk performance counters on computers
diskperf
running Windows 2000.

Starts the DiskRAID command-line tool that allows to configure and manage redundant array of
diskraid
independent (or inexpensive) disks (RAID) storage subsystems.

dism Starts the Deployment Image Servicing and Management (DISM) tool.

dispdiag Used to output a log of information about the display system.

djoin Used to create a new computer account in a domain.

doskey Used to edit command lines, create macros, and recall previously entered commands.

dosshell Starts DOS Shell, a graphical file management tool for MS-DOS.
 Command Description

Used to start DOS Protected Mode Interface (DPMI), a special mode designed to give MS-DOS
dosx
applications access to more than the normally allowed 640 KB.

driverquery Displays a list of all installed device drivers and their properties.

drvspace Used to create or configure DriveSpace compressed drives.

Used in shell scripts and batch files to output status text to the screen or a file and also to turn the
echo
echoing feature on or off.

edit Starts the MS-DOS Editor tool that is used to create and modify text files.

edlin Starts the Edlin tool that is used to create and modify text files from the command line.

emm386 Used to give MS-DOS access to more than 640 KB of memory.

Ends localization of environment changes inside a batch or script file, restoring environment variables
endlocal
to their values before the matching setlocal command.

erase Used to delete one or more files.

esentutl Provides database utilities for the Extensible Storage Engine (ESE) for Windows Vista.

eventcreate Creates a custom event in an event log.

eventtriggers Displays and configures event triggers on local or remote machines.

exe2bin Converts a file of the EXE file type (executable file) to a binary file.

Used to end the cmd.exe (Windows) or command.com (MS-DOS) session that you’re currently working
exit
in.
 Command Description

expand Used to extract the files and folders contained in Microsoft Cabinet (CAB) files.

This command is actually a CAB extraction program for use by Internet Explorer but can be used to
extrac32
extract any Microsoft Cabinet file.

extract Used to extract the files and folders contained in Microsoft Cabinet (CAB) files.

fasthelp This command provides more detailed information on any of the other MS-DOS commands.

fastopen Used to add a program’s hard drive location to a special list stored in memory.

fc Used to compare two individual or sets of files and then show the differences between them.

fdisk Used to create, manage, and delete hard drive partitions.

find Used to search for a specified text string in one or more files.

findstr Used to find specific text string patterns in one or more files.

finger Used to find information about computer users.

fltmc Used to load, unload, list, and otherwise manage Filter drivers.

The fondue (Features on Demand User Experience) tool is used to install any of the several optional
fondue
Windows features from the command line.

for Used to run a specified command for each file in a set of files.

forcedos Used to start the specified program in the MS-DOS subsystem.

forfiles Selects one or more files and runs a command on them.

 Command Description

format Used to format a drive in the file system that you specify.

Performs tasks that are related to file allocation table (FAT) and NTFS file system, such as managing
fsutil
reparse points and sparse files, dismounting a volume, and extending a volume.

ftp Transfers files to and from another computer.

ftype Defines a default program to open a specified file type.

getmac Used to display the Media Access Control (MAC) address of all the network adapters in the computer.

goto Used in a batch or script file to direct the command process to a labelled line in the script.

gpresult Used to display group policy settings and resultant set of policy for a user.

gpupdate Refreshes local and Active Directory-based Group Policy settings, including security settings.

graftabl Used to enable the ability of Windows to display an extended character set in graphics mode.

graphics Used to load a program that can print graphics.

help Provides help information for Windows commands.

hostname Displays the host name portion of the full computer name of the computer.

hwrcomp Used to compile custom dictionaries for handwriting recognition.

hwrreg Used to install a previously compiled custom dictionary for handwriting recognition.

icacls Display, modify, backup, or restore ACLs for files and directories.
 Command Description

if Performs conditional functions in batch programs.

interlnk Connects two computers via a serial or parallel connection to share files and printers.

intersvr Starts interlnk server and to copy interlnk files from one computer to another.

Displays all current TCP/IP network configuration values and can modify Dynamic Host Configuration
ipconfig
Protocol (DHCP) and Domain Name System (DNS) settings.

ipxroute Used to display and change information about IPX routing tables.

irftp Used to transmit files over an infrared link.

iscsicli Starts the Microsoft iSCSI Initiator, used to manage iSCSI.

kb16 Used to support MS-DOS files that need to configure a keyboard for a specific language.

keyb Used to configure a keyboard for a specific language.

klist Used to list service tickets of Kerberos.

ksetup Used to configure connections to a Kerberos server.

ktmutil Starts the Kernel Transaction Manager utility.

label Used to manage the volume label of a disk.

lh Shorthand version of the loadhigh command.

Used to generate a text-based log and other data files that contain product activation and other
licensingdiag
Windows licensing information.
 Command Description

loadfix Used to load the specified program in the first 64K of memory and then runs the program.

loadhigh Used to load a program into high memory and is usually used from within the autoexec.bat file.

lock Used to lock a drive, enabling direct disk access for a program.

lodctr This is used to update registry values related to performance counters.

logman Used to create and manage Event Trace Session and Performance logs.

logoff Used to terminate a session.

lpq Displays the status of a print queue on a computer running Line Printer Daemon (LPD).

lpr Used to send a file to a computer running Line Printer Daemon (LPD).

makecab Used to create .cab files.

Manage-bde Used to configure BitLocker Drive Encryption from the command line.

Md Shorthand version of the mkdir command.

Shows information about used and free memory areas and programs that are currently loaded into
Mem
memory in the MS-DOS subsystem.

Memmaker Used to start MemMaker, a memory optimization tool.

Mkdir Used to create a new folder.

Mklink Creates a symbolic link.

 Command Description

Mode Used to configure system devices, most often COM and LPT ports.

Mofcomp This command properly displays the data within a Managed Object Format (MOF) file.

More Used to display the information contained in a text file.

Mount Used to mount Network File System (NFS) network shares.

Mountvol Used to display, create, or remove volume mount points.

Move Used to move one or files from one folder to another.

Mrinfo Used to provide information about a router’s interfaces and neighbors.

Msav This command starts Microsoft Antivirus.

Msbackup This command starts Microsoft Backup, a tool used to back up and restore one or more files.

Mscdex Used to provide CD-ROM access to MS-DOS.

Msd Starts Microsoft Diagnostics.

Msg Used to send a message to a user.

Msiexec Used to start Windows Installer, a tool used to install and configure software.

Muiunattend This command starts the Multilanguage User Interface unattended setup process.

This command is used to show TCP/IP information and other statistical information about a remote
Nbtstat
computer.
 Command Description

Net Used to display, configure, and correct a wide variety of network settings.

Net1 Used to display, configure, and correct a wide variety of network settings.

Netcfg Used to install the Windows Preinstallation Environment (WinPE),

Used to start Network Shell, a command-line utility used to manage the network configuration of the
Netsh
local, or a remote, computer.

Netstat This command is most commonly used to display all open network connections and listening ports.

Nfsadmin This command is used to manage Server for NFS or Client for NFS from the command line.

Nlsfunc Used to load information specific to a particular country or region.

Used to test secure channels between Windows computers in a domain and between domain
Nltest
controllers that are trusting other domains.

Nslookup The command is most commonly used to display the hostname of an entered IP address.

Ntbackup Used to perform various backup functions from the Command.

Ntsd Used to perform certain command line debugging tasks.

This command starts the Windows Optional Component Setup tool, used to install additional
Ocsetup
Windows features.

Openfiles Used to display and disconnect open files and folders on a system.

Path Used to display or set a specific path available to executable files.

 Command Description

Functions much like the tracert command, will also report information about network latency and loss
Pathping
at each hop.

Pause Used within a batch or script file to pause the processing of the file.

Pentnt Used to detect floating point division errors in the Intel Pentium chip.

The command sends an Internet Control Message Protocol (ICMP) Echo Request message to a
Ping
specified remote computer to verify IP-level connectivity.

Pkgmgr Used to start the Windows Package Manager from the Command Prompt.

Pnpunattend Used to automate the installation of hardware device drivers.

Used to start the Microsoft PnP Utility, a tool used to install a Plug and Play device from the command
Pnputil
line.

This command is used to change the current directory to the one most recently stored by the pushd
Popd
command.

Power Used to reduce the power consumed by a computer by monitoring software and hardware devices.

Powercfg Used to manage the Windows power management settings from the command line.

Print Used to print a specified text file to a specified printing device.

Prompt Used to customize the appearance of the prompt text in Command Prompt or MS-DOS.

Pushd Used to store a directory for use, most commonly from within a batch or script program.

Pwlauncher Used to enable, disable, or show the status of your Windows To Go start-up options.
 Command Description

Qappsrv Used to display all Remote Desktop Session Host servers available on the network.

This command starts QBasic, the MS-DOS based programming environment for the BASIC
Qbasic
programming language.

Qprocess Used to display information about running processes.

Query Used to display the status of a specified service.

Quser Used to display information about users currently logged on to the system.

Qwinsta Used to display information about open Remote Desktop Sessions.

Rasautou Used to manage Remote Access Dialer AutoDial addresses.

Rasdial Used to start or end a network connection for a Microsoft client.

Rcp Used to copy files between a Windows computer and a system running the rshd daemon.

Rd Shorthand version of the rmdir command.

Rdpsign Used to sign a Remote Desktop Protocol (RDP) file.

Reagentc Used to configure the Windows Recovery Environment (RE).

Recimg Used to create a custom refresh image.

Recover Used to recover readable data from a bad or defective disk.

Reg Used to manage the Windows Registryfrom the command line.

 Command Description

Regini Used to set or change registry permissions and registry values from the command line.

Register-
Used to register a Common Information Model (CIM) Provider in Windows.
cimprovider

Regsvr32 Used to register a DLL file as a command component in the Windows Registry.

Relog Used to create new performance logs from data in existing performance logs.

Rem Used to record comments or remarks in a batch or script file.

Ren The shorthand version of the rename command.

Rename Used to change the name of the individual file that you specify.

Repair-bde Used to repair or decrypt a damaged drive that’s been encrypted using BitLocker.

Replace Used to replace one or more files with one or more other files.

This command, executed as reset session, is used to reset the session subsystem software and
Reset
hardware to known initial values.

Restore Used to restore files that were backed up using the backup command.

Rexec Used to run commands on remote computers running the rexec daemon.

Rmdir Used to delete an existing or completely empty folder.

Robocopy Used to copy files and directories from one location to another.

Route Used to manipulate network routing tables.

 Command Description

Rpcinfo This command makes a remote procedure call (RPC) to an RPC server and reports what it finds.

Rpcping Used to ping a server using RPC.

Rsh Used to run commands on remote computers running the rsh daemon.

Rsm Used to manage media resources using Removable Storage.

Runas Used to execute a program using another user’s credentials.

Rwinsta Shorthand version of the reset session command.

Sc Used to configure information about services.

Scandisk Used to start Microsoft ScanDisk, a disk repair program.

Scanreg This command starts Windows Registry Checker, a basic registry repair program and backup utility.

Schtasks Used to schedule specified programs or commands to run a certain times.

Sdbinst Used to deploy customized SDB database files.

Used to configure and analyze system security by comparing the current security configuration to a
Secedit
template.

Set Used to display, enable, or disable environment variables in MS-DOS or from the Command Prompt.

Setlocal Used to start the localization of environment changes inside a batch or script file.

Setspn Used to manage the Service Principal Names (SPN) for an Active Directory (AD) service account.
 Command Description

Setver Used to set the MS-DOS version number that MS-DOS reports to a program.

Setx Used to create or change environment variables in the user environment or the system environment.

Sfc Used to verify and replace important Windows system files.

Shadow Used to monitor another Remote Desktop Services session.

Share Used to install file locking and file sharing functions in MS-DOS.

Shift Used to change the position of replaceable parameters in a batch or script file.

Showmount Used to display information about NFS mounted file systems.

Shutdown Used to shut down, restart, or log off the current system or a remote computer.

Smartdrv This command installs and configures SMARTDrive, a disk caching utility for MS-DOS.

Used to read data from a specified input, sort that data, and return the results of that sort to the
Sort
Command Prompt screen, a file, or another output device.

Start Used to open a new command line window to run a specified program or command.

Subst Used to associate a local path with a drive letter.

Sxstrace Used to start the WinSxs Tracing Utility, a programming diagnostic tool.

Sys Used to copy the MS-DOS system files and command interpreter to a disk.

Systeminfo Used to display basic Windows configuration information for the local or a remote computer.
 Command Description

Used to regain access to a file that that an administrator was denied access to when reassigning
Takeown
ownership of the file.

Taskkill Used to terminate a running task.

Displays a list of applications, services, and the Process ID (PID) currently running on either a local or
Tasklist
a remote computer.

Tcmsetup Used to setup or disable the Telephony Application Programming Interface (TAPI) client.

Telnet Used to communicate with remote computers that use the Telnet protocol.

Used to transfer files to and from a remote computer that’s running the Trivial File Transfer Protocol
Tftp
(TFTP) service or daemon.

Time Used to show or change the current time.

Timeout Used in a batch or script file to provide a specified timeout value during a procedure.

Title Used to set the Command Prompt window title.

Tlntadmn Used to administer a local or remote computer running Telnet Server.

Tpmvscmgr Used to create and destroy TPM virtual smart cards.

Tracerpt Used to process event trace logs or real-time data from instrumented event trace providers.

This command sends Internet Control Message Protocol (ICMP) Echo Request messages to a
Tracert specified remote computer with increasing Time to Live (TTL) field values and displays the IP address
and hostname, of the router interfaces between the source and destination.
 Command Description

Tree Used to graphically display the folder structure of a specified drive or path.

Tscon Used to attach a user session to a Remote Desktop session.

Tsdiscon Used to disconnect a Remote Desktop session.

Tskill Used to end the specified process.

Tsshutdn Used to remotely shut down or restart a terminal server.

Type Used to display the information contained in a text file.

This command displays performance data in the Command Prompt window or writes the data to
Typeperf
specified log file.

Tzutil Used to display or configure the current system’s time zone.

Umount Used to remove Network File System (NFS) mounted network shares.

Undelete Used to undo a deletion performed with the MS-DOS delete command.

Unformat Used to undo the formatting on a drive performed by the MS-DOS format command.

Unlock Used to unlock a drive, disabling direct disk access for a program.

Removes Explain text and Performance counter names for a service or device driver from the
Unlodctr
Windows Registry.

Vaultcmd Used to create, remove, and show stored credentials.

Ver Used to display the current Windows or MS-DOS version number.

 Command Description

Used to enable or disable the ability of Command Prompt, or MS-DOS, to verify that files are written
Verify
correctly to a disk.

Vol Shows the volume label and serial number of a specified disk, assuming this information exists.

Vsafe Used to start VSafe, a basic virus protection system for MS-DOS.

This command starts the Volume Shadow Copy Service administrative command line tool which
Vssadmin
displays current volume shadow copy backups and all installed shadow copy writers and providers.

W32tm Used to diagnose issues with Windows Time.

Waitfor Used to send or wait for a signal on a system.

Used start and stop backup jobs, display details about a previous backup, list the items within a
Wbadmin
backup, and report on the status of a currently running backup.

Used to manage subscriptions to events that are forwarded from WS-Management supported
Wecutil
computers.

This command starts the Windows Events Command Line Utility which is used to manage event logs
Wevtutil
and publishers.

Where Used to search for files that match a specified pattern.

Whoami Used to retrieve user name and group information on a network.

Winmgmt Starts the command line version of WMI, a scripting tool in Windows.

Used to start the command line version of Windows Remote Management, used to manage secure
Winrm
communications with local and remote computers using web services.
 Command Description

Winrs Used to open a secure command window with a remote host.

Starts the Windows System Assessment Tool, a program that assesses various features, attributes,
Winsat
and capabilities of a computer running Windows.

Starts the Windows Management Instrumentation Command line (WMIC), a scripting interface that
Wmic
simplifies the use of Windows Management Instrumentation (WMI) and systems managed via WMI.

Wsmanhttpconfig Used to manage aspects of the Windows Remote Management (WinRM) service.

Used to copy one or more files or directory trees from one location to another. The xcopy command is
Xcopy generally considered a more “powerful” version of the copy command though the robocopy command
trumps even xcopy.

This command, short for Extensible Wizard, is used to register data in Windows, often from a
Xwizard
preconfigured XML file.