## 📋 Table of Contents
| # | Section | # | Section |
|---|---------|---|---------|
| 01 | [🔍 System Information](#-system-information) | 10 | [🔄 Windows Update & Activation](#-windows-update--activation) |
| 02 | [👤 User Account Management](#-user-account-management) | 11 | [🚀 Boot & Startup Repair](#-boot--startup-repair) |
| 03 | [🌐 Network Commands](#-network-commands) | 12 | [📋 Scheduled Tasks](#-scheduled-tasks) |
| 04 | [📁 Files & Directories](#-files--directories) | 13 | [🗝️ Registry Commands](#-registry-commands) |
| 05 | [🔎 Search & Forensics](#-search--forensics) | 14 | [📜 Event Log Management](#-event-log-management) |
| 06 | [⚙️ Process & Service Control](#-process--service-control) | 15 | [🛡️ Malware & Defender Tools](#-malware--defender-tools) |
| 07 | [🔐 Security & Permissions](#-security--permissions) | 16 | [💙 PowerShell Admin Tools](#-powershell-admin-tools) |
| 08 | [💽 Disk & System Utilities](#-disk--system-utilities) | 17 | [🔴 CMD Tips & Tricks](#-cmd-tips--tricks) |
| 09 | [🌍 Remote Access & Management](#-remote-access--management) | 18 | [🧰 Misc & Utilities](#-misc--utilities) |
## 🔍 System Information
whoami # Shows the currently logged-in user
hostname # Shows the computer's name
systeminfo # Full device and OS details — like the "About" section
ver # Shows the Windows version
set # Lists all environment variables (system-wide saved values)
echo %username% # Prints the current username
echo %COMPUTERNAME% # Prints the computer name as a variable
echo %OS% # Shows the OS name stored as an environment variable
echo %PROCESSOR_ARCHITECTURE% # Shows the CPU architecture (x86, AMD64, ARM64)
echo %APPDATA% # Shows the path to the current user's AppData folder
echo %TEMP% # Shows the path to the temp directory
date /t # Shows today's date without prompting to change it
time /t # Shows the current time without prompting to change it
driverquery # Lists all installed device drivers
driverquery /v # Shows verbose info about all drivers (version, state)
tasklist # Shows all currently running processes with PID
tasklist /svc # Same as tasklist but also shows services inside each process
tasklist /v # Verbose view of processes with memory and CPU info
wmic os get name # Shows the operating system name and edition
wmic os get version # Shows the OS version number
wmic os get osarchitecture # Shows 32-bit or 64-bit OS architecture
wmic os get lastbootuptime # Shows when the computer was last rebooted
wmic cpu get name # Shows the CPU model name
wmic cpu get numberofcores # Shows how many CPU cores the system has
wmic bios get serialnumber # Shows the BIOS serial number (useful for asset tracking)
wmic bios get version # Shows the BIOS version
wmic memorychip get capacity # Shows the RAM size of each memory stick
wmic diskdrive get model,size # Shows all physical disk drives and their sizes
wmic logicaldisk get name,size,freespace # Shows all drives with total and free space
wmic product get name,version # Lists all installed software with version numbers
wmic qfc # Lists installed Windows updates (hotfixes)
wmic /node: os get caption # Gets OS info from a remote computer
msinfo32 # Opens the System Information GUI tool
winver # Opens a popup showing the exact Windows version and build
## 👤 User Account Management
net user # Lists all local user accounts
net user # Shows detailed info about a specific user
net user /add # Creates a new local user account
net user /add # Creates a new user with a set password
net user /delete # Deletes a user account
net user administrator /active:yes # Enables the built-in Administrator account
net user administrator /active:no # Disables the built-in Administrator account
net user /active:no # Disables a specific user account
net user /active:yes # Re-enables a disabled user account
net user * # Prompts to change a user's password
net user /expires:MM/DD/YYYY # Sets an expiry date for a user account
net localgroup # Lists all local groups
net localgroup administrators # Shows all members of the Administrators group
net localgroup administrators /add # Adds a user to the Administrators group
net localgroup administrators /delete # Removes a user from the Administrators group
net localgroup # Shows members and details of a group
net localgroup /add # Creates a new local group
net localgroup /delete # Deletes a local group
whoami # Shows current user
whoami /groups # Shows all groups the current user belongs to
whoami /priv # Shows special privileges the current user has
whoami /all # Shows user, groups AND privileges in one output
query user # Shows all currently logged-in users and session info
net accounts # Shows the current password policy
net accounts /minpwlen:12 # Sets minimum password length to 12 characters
net accounts /maxpwage:30 # Forces password change every 30 days
net accounts /minpwage:1 # Sets minimum days before a password can be changed
net accounts /lockoutthreshold:5 # Locks account after 5 failed login attempts
runas /user: cmd # Opens CMD as a different user
runas /user:administrator cmd # Opens CMD as Administrator
control userpasswords2 # Opens the advanced user accounts settings window
lusrmgr.msc # Opens the Local Users and Groups Manager (GUI)
rundll32.exe user32.dll,LockWorkStation # Instantly locks the workstation
taskmgr # Opens Task Manager
eventvwr # Opens Event Viewer — view system and security logs
## 🌐 Network Commands
# ── IP Configuration ──────────────────────────────────────────────
ipconfig # Shows basic IP address info
ipconfig /all # Full network config (MAC, DNS, DHCP, gateway...)
ipconfig /release # Releases the current DHCP-assigned IP address
ipconfig /renew # Requests a new IP address from the DHCP server
ipconfig /displaydns # Shows the local DNS cache
ipconfig /flushdns # Clears the DNS cache
ipconfig /registerdns # Refreshes all DHCP leases and re-registers DNS names
# ── Netsh ──────────────────────────────────────────────────────────
netsh winsock reset # Resets Winsock (list of network protocol handlers)
netsh int ip reset # Resets the TCP/IP stack to default settings
netsh wlan show profile # Lists all saved Wi-Fi profiles
netsh wlan show profile key=clear # Shows Wi-Fi password for a saved profile
netsh wlan delete profile name= # Deletes a saved Wi-Fi profile
netsh wlan connect name= # Connects to a saved Wi-Fi profile
netsh wlan disconnect # Disconnects from the current Wi-Fi network
netsh interface show interface # Shows all network interfaces and their status
netsh interface ip show config # Shows detailed IP config of all interfaces
netsh advfirewall reset # Resets all firewall rules to default
netsh advfirewall show allprofiles # Shows firewall status for all profiles
netsh advfirewall firewall show rule name=all # Lists all firewall rules
netsh advfirewall set allprofiles state on # Turns on the firewall for all profiles
netsh advfirewall set allprofiles state off # Turns off the firewall for all profiles (use carefully)
netsh advfirewall firewall add rule name="Block Telnet" protocol=TCP dir=in localport=23 action=block # Block a port
# ── Physical & ARP ──────────────────────────────────────────────
getmac # Shows MAC (physical hardware) addresses
getmac /v # Verbose — shows MAC with adapter name
arp -a # Shows all LAN devices your PC has recently talked to
arp -d # Clears the ARP cache
arp -s # Adds a static ARP entry
# ── Routing ───────────────────────────────────────────────────────
route print # Shows the full routing table
route add mask # Adds a static route
route delete # Removes a route from the routing table
# ── Connections & Ports ──────────────────────────────────────────
netstat -an # Shows all active connections and open ports
netstat -ano # Same + shows PID for each connection
netstat -b # Same + shows executable (.exe) responsible
netstat -s # Shows per-protocol statistics (TCP, UDP, ICMP)
netstat -r # Shows the routing table (same as route print)
netstat -e # Shows Ethernet statistics (bytes sent/received)
# ── DNS & Connectivity ────────────────────────────────────────────
ping # Tests basic connectivity to a host
ping -t # Pings continuously until stopped (Ctrl+C)
ping -n 10 # Sends exactly 10 ping packets
ping -l 1000 # Sends a ping with a custom packet size (1000 bytes)
tracert # Traces the full path packets take to reach a host
pathping # Like tracert but also measures packet loss/latency
nslookup # Resolves a domain to its IP address
nslookup 8.8.8.8 # DNS lookup using a specific DNS server (Google)
nslookup -type=MX # Looks up mail exchange (MX) records for a domain
nslookup -type=TXT # Looks up TXT records (used for SPF, DMARC, etc.)
# ── Network Shares & Remote ───────────────────────────────────────
net view # Lists computers and shared resources on the LAN
net view \\ # Shows shared folders on a specific computer
nbtstat -n # Lists all local NetBIOS names registered
nbtstat -A # Shows NetBIOS info for a remote computer by IP
nbtstat -c # Shows the local NetBIOS name cache
net use # Shows all active mapped drives and connections
net use \\\ # Connects to a shared folder
net use Z: \\\ # Maps a shared folder to drive letter Z
net use Z: /delete # Disconnects a mapped drive
net share # Lists all shared folders on the local machine
net share =C:\path /grant:,full # Creates a new shared folder with permissions
# ── DHCP ──────────────────────────────────────────────────────────
net stop dhcp # Stops the DHCP client service
net start dhcp # Starts the DHCP client service
## 📁 Files & Directories
dir # Lists all files and folders in the current directory
dir /a # Lists everything including hidden and system files
dir /a:h # Lists only hidden files
dir /s # Lists files in all subdirectories recursively
dir /o:s # Lists files sorted by size (smallest first)
dir /o:-s # Lists files sorted by size (largest first)
dir /o:d # Lists files sorted by date (oldest first)
dir /b # Bare format — shows only file names, no extra info
dir *.exe # Lists only .exe files in the current directory
tree # Displays directory structure as a visual tree
tree /f # Shows tree including file names inside each folder
cd # Changes the current directory
cd .. # Goes one level up in the directory tree
cd \ # Goes directly to the root of the current drive
cd /d D:\folder # Changes both drive and directory at once
mkdir # Creates a new folder
mkdir C:\A\B\C # Creates nested folders all at once
rmdir # Removes an empty folder
rmdir /s /q # Removes a folder and all contents silently (no prompt)
del # Deletes a file
del /f /q # Force-deletes a file silently (even read-only)
del /f /s /q \*.* # Deletes all files in a folder and subfolders silently
copy # Copies a file to a destination
copy /y # Copies a file and overwrites without asking
move # Moves a file to a new location
rename # Renames a file
type file.txt # Prints the full content of a text file to the screen
more file.txt # Reads a text file page by page (great for large files)
echo Hello > file.txt # Creates a file and writes "Hello" into it
echo More text >> file.txt # Appends text to an existing file
attrib # Shows all file attributes (hidden, system, read-only...)
attrib +h # Hides a file (sets hidden attribute)
attrib -h # Unhides a file
attrib +r # Sets a file as read-only
attrib -r # Removes the read-only attribute
attrib +s # Sets the system attribute on a file
attrib -h -r -s /s /d *.* # Removes hidden, read-only, system attributes recursively
where # Finds the full path of a file or executable
assoc # Shows file extension associations
assoc .txt # Shows what program opens .txt files
ftype # Shows all registered file types and their open commands
mklink # Creates a symbolic link (shortcut) to a file or folder
mklink /d # Creates a symbolic link to a directory
expand # Extracts files from a CAB archive
## 🔎 Search & Forensics
find "text" file.txt # Searches for a specific string inside a file
find /i "text" file.txt # Same but case-insensitive
find /c "text" file.txt # Counts the number of lines containing the text
findstr "search phrase" file.txt # Searches for a phrase (supports regex, more powerful)
findstr /i "text" file.txt # Case-insensitive search
findstr /s "text" *.txt # Recursively searches all .txt files in subdirectories
findstr /r "reg.*ex" file.txt # Searches using a regular expression pattern
fc file1 file2 # Compares two files and shows the differences
fc /b file1 file2 # Compares two files in binary mode
dir /s # Searches for a file recursively in all subdirectories
dir /s /b *.log # Finds all .log files on the system (bare output)
dir /R # Lists files and any Alternate Data Streams (ADS) — forensic use
certutil -hashfile md5 # Generates an MD5 hash (quick integrity check)
certutil -hashfile sha1 # Generates a SHA-1 hash
certutil -hashfile sha256 # Generates a SHA-256 hash (most trusted — verify downloads)
certutil -urlcache -split -f