60 useful command for Windows System Administrators

Basic commands

• cd – Change folder

• copy – Copy a file to a new location

• move – Cut and paste a file or folder to a new location

• ren – Rename a file

• dir – Displays the folder tree

• mkdir – Creates a folder

• xcopy – Copies folders and files

• rmdir – Deletes a folder

• del – Deletes a file

Support commands

• Get-Command – Lists PowerShell commands (cmdlets)

• Clear-Host - Clears the screen of previous commands. Alias: cls

• Start-transcript – Starts transcribing everything displayed in PowerShell

• Stop-transcript – Stops transcribing everything displayed in PowerShell

• ForEach and ForEach-Object – Loops actions over all objects inside a variable an array. Examples:

$processes = Get-process
foreach ($process in $processes)
{
$phrase = "ID: " + $process.Id
$phrase2 = "Process: " + $process.ProcessName
write-host $phrase - $phrase2
}

Get-Process | ForEach-Object {$_.ProcessName}

• Export-Csv – Exports information stored as an array/table to CSV. Example:

Get-Process | Export-Csv -Path C:\Temp\Processes.csv -Delimiter '|'

• Out-file – Exports the content to a file. Example:

dir | out-file C:\temp\dir.txt

• Format-List – Formats the information to be displayed as a list. Alias: fl Example:

 Get-Process | fl

• Format-Table – Formats the information to display as a table. Alias: ft Example:

Get-Date | ft

• findstr – Searches for lines containing the specified word or expression. Example:

get-hotfix | findstr KB5066128

• echo – Displays the specified value on the screen. A cmdlet with the same function is available: write-host

Informative commands

• whoami - Displays the user you are logged in as.

• whoami /groups – Displays the groups the user currently belongs to.

• hostname – Displays the computer name.

• winver - Displays the Windows version.

• Get-Hotfix – Displays the KB updates installed on the computer.

• Get-Process – Displays running processes. Similar to the tasklist command, but with more information.

• tasklist /svc - Retrieves the loaded processes and their associated services.

• dsregcmd /status - Shows whether the machine is joined to an on-premises domain, is in Azure AD, or is a hybrid machine.

• Set – Displays global variables and their values.

• Get-Date – Gets the current date and time.

• Ipconfig /all – Displays the current network configurations on the machine (IP address, subnet mask, DNS servers, gateway, etc.).

• Test-NetConnection – Tests network connectivity to the specified hostname or IP address. The -p parameter can be used to specify a port. The ping command is also available for similar tests. tnc is an alias for Test-NetConnection.

• Resolve-DnsName – Resolves a name to an IP address or vice versa. The nslookup command offers similar behavior.

Console's access

• lusrmgr - To access the local users and groups console.

• appwiz – Console for uninstalling programs.

• mmc – To access various consoles.

• regedit – Access to the Registry Editor.

• msconfig – Access to system configuration.

• msinfo32 - Access to system information.

Commands for registry keys and certificates

• reg – Allows us to perform operations on registry keys. Examples:

Create a registry value named Data with a value of 0x4 within the Netlogon key:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon" /t REG_DWORD /v Data /d 0x4

Display all values in the Netlogon key. Using /s also displays the values of registry subkeys:

reg query "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon” /s

Delete the Data registry value from the Netlogon registry key:

reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Netlogon" /v Data

• get-item | get-childitem | get-itempropertyvalue – Generic commands that retrieve information about folders, registry keys, certificates, or Active Directory objects, depending on the syntax used. The dir command is an abbreviation of get-childitem. Examples:

List the current folder:

get-item .

Display information about our user certificate:

get-item Cert:\CurrentUser\My\thumbprint | fl

Display current machine certificates:

Get-childitem Cert:\LocalMachine\My\

Get the CommonFilesDir registry value within the CurrentVersion registry key:

Get-ItemPropertyValue 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion' -Name CommonFilesDir

Other administrative commands

• Invoke-WebRequest - Calls a website to access or download a file. This is a potentially dangerous command if used without knowing what you are accessing or downloading. Alias: iwr Example:

Invoke-WebRequest -Uri "https://i.imgur.com/n9TWKnr.png" -Outfile “C:\temp\logo.png -UseBasicParsing”

• get-acl – Gets permissions for the folder. Similar command: icacls Example:

 get-acl C:\temp | fl

• shutdown - Shuts down or restarts a machine. To restart a computer remotely:

shutdown /r /m \\computer /t 0

• chkdsk – A utility that informs us about the health status of our disks and allows us to repair them in case of errors.

• sfc /scannow – Checks the integrity of system files. If it finds any corrupted files, it replaces them with one stored in the OS image.

• Sysprep – Creates an image of the current OS, which we can then use in new installations, reducing the time spent on configurations, forms, and Windows installation. Example to create an OS image and shut down the machine:

 sysprep /generalize /shutdown /oobe

• Import-module – Imports a pre-installed module into the current PowerShell session.

• Install-module – Downloads and installs a module (role or feature).

• Get-Module - Displays the modules imported into the current session.

• Rename-computer - Changes the name of our computer. Example:

Rename-computer -newname “server” -DomainCredential domain\user

• Start-Service – Stop-Service - Restart-service – Starts, stops, or restarts the specified service. The equivalents net start and net stop can also be used.

• Get-variable – Displays the values of variables in the current PowerShell session.

• Runas - Executes a command or program in the context of the specified user:

 Runas /user:domain\user cmd

• Get-executionpolicy – Gets the current execution policy on the computer.

• Set-ExecutionPolicy AllSigned – Modifies the file execution policy to only accept files signed by a trusted publisher.

• Set-AuthenticodeSignature – Signs a script with a Code Signing certificate. Example:

$cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert
Set-AuthenticodeSignature -FilePath .\script.ps1 -Certificate $cert