List Of CMD Commands & Usages
What is CMD
Command Prompt, also known as CMD, is a command-line interpreter for Windows operating system.
Cmd, in short, is used to run commands or scripts on Windows.
ARP
Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).
ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr] [-v]
-a Displays current ARP entries by interrogating the current
protocol data. If inet_addr is specified, the IP and Physical
addresses for only the specified computer are displayed. If
more than one network interface uses ARP, entries for each ARP
table are displayed.
-g Same as -a.
-v Displays current ARP entries in verbose mode. All invalid
entries and entries on the loop-back interface will be shown.
inet_addr Specifies an internet address.
-N if_addr Displays the ARP entries for the network interface specified
by if_addr.
-d Deletes the host specified by inet_addr. inet_addr may be
wildcarded with * to delete all hosts.
-s Adds the host and associates the Internet address inet_addr
with the Physical address eth_addr. The Physical address is
given as 6 hexadecimal bytes separated by hyphens. The entry
is permanent.
eth_addr Specifies a physical address.
if_addr If present, this specifies the Internet address of the
interface whose address translation table should be modified.
If not present, the first applicable interface will be used.
Example:
> arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry.
> arp -a .... Displays the arp table.
APPWIZ.CPL
This cmd command to open the Add/Remove Programs or Uninstall a program list on Windows.
ASSOC
Displays or modifies file extension associations
ASSOC [.ext[=[fileType]]]
.ext Specifies the file extension to associate the file type with
fileType Specifies the file type to associate with the file extension
Type ASSOC without parameters to display the current file associations.
If ASSOC is invoked with just a file extension, it displays the current
file association for that file extension. Specify nothing for the file
type and the command will delete the association for the file extension.
ATTRIB
Displays or changes file attributes.
ATTRIB [+R | -R] [+A | -A] [+S | -S] [+H | -H] [+O | -O] [+I | -I] [+X | -X] [+P | -P] [+U | -U]
[drive:][path][filename] [/S [/D]] [/L]
+ Sets an attribute.
- Clears an attribute.
R Read-only file attribute.
A Archive file attribute.
S System file attribute.
H Hidden file attribute.
O Offline attribute.
I Not content indexed file attribute.
X No scrub file attribute.
V Integrity attribute.
P Pinned attribute.
U Unpinned attribute.
B SMR Blob attribute.
[drive:][path][filename]
Specifies a file or files for attrib to process.
/S Processes matching files in the current folder
and all subfolders.
/D Processes folders as well.
/L Work on the attributes of the Symbolic Link versus
the target of the Symbolic Link
BCDEDIT
BCDEDIT - Boot Configuration Data Store Editor
The Bcdedit.exe command-line tool modifies the boot configuration data store.
The boot configuration data store contains boot configuration parameters and
controls how the operating system is booted. These parameters were previously
in the Boot.ini file (in BIOS-based operating systems) or in the nonvolatile
RAM entries (in Extensible Firmware Interface-based operating systems). You can
use Bcdedit.exe to add, delete, edit, and append entries in the boot
configuration data store.
For detailed command and option information, type bcdedit.exe /? <command>. For
example, to display detailed information about the /createstore command, type:
bcdedit.exe /? /createstore
For an alphabetical list of topics in this help file, run "bcdedit /? TOPICS".
Commands that operate on a store
================================
/store Used to specify a BCD store other than the current system default.
/createstore Creates a new and empty boot configuration data store.
/export Exports the contents of the system store to a file. This file
can be used later to restore the state of the system store.
/import Restores the state of the system store using a backup file
created with the /export command.
/sysstore Sets the system store device (only affects EFI systems, does
not persist across reboots, and is only used in cases where
the system store device is ambiguous).
Commands that operate on entries in a store
===========================================
/copy Makes copies of entries in the store.
/create Creates new entries in the store.
/delete Deletes entries from the store.
/mirror Creates mirror of entries in the store.
Run bcdedit /? ID for information about identifiers used by these commands.
Commands that operate on entry options
======================================
/deletevalue Deletes entry options from the store.
/set Sets entry option values in the store.
Run bcdedit /? TYPES for a list of datatypes used by these commands.
Run bcdedit /? FORMATS for a list of valid data formats.
Commands that control output
============================
/enum Lists entries in the store.
/v Command-line option that displays entry identifiers in full,
rather than using names for well-known identifiers.
Use /v by itself as a command to display entry identifiers
in full for the ACTIVE type.
Running "bcdedit" by itself is equivalent to running "bcdedit /enum ACTIVE".
Commands that control the boot manager
======================================
/bootsequence Sets the one-time boot sequence for the boot manager.
/default Sets the default entry that the boot manager will use.
/displayorder Sets the order in which the boot manager displays the
multiboot menu.
/timeout Sets the boot manager time-out value.
/toolsdisplayorder Sets the order in which the boot manager displays
the tools menu.
Commands that control Emergency Management Services for a boot application
==========================================================================
/bootems Enables or disables Emergency Management Services
for a boot application.
/ems Enables or disables Emergency Management Services for an
operating system entry.
/emssettings Sets the global Emergency Management Services parameters.
Command that control debugging
==============================
/bootdebug Enables or disables boot debugging for a boot application.
/dbgsettings Sets the global debugger parameters.
/debug Enables or disables kernel debugging for an operating system
entry.
/hypervisorsettings Sets the hypervisor parameters.
Command that control remote event logging
=========================================
/eventsettings Sets the global remote event logging parameters.
/event Enables or disables remote event logging for an operating
system entry.
BOOTCFG
BOOTCFG /parameter [arguments]
Description:
This command line tool can be used to configure, query, change or
delete the boot entry settings in the BOOT.INI file.
Parameter List:
/Copy Makes a copy of an existing boot entry.
/Delete Deletes an existing boot entry from the BOOT.INI file.
/Query Displays the current boot entries and their settings.
/Raw Allows the user to specify any switch to be added.
/Timeout Allows the user to change the Timeout value.
/Default Allows the user to change the Default boot entry.
/EMS Allows the user to configure the /redirect switch
for headless support.
/Debug Allows the user to specify the port and baudrate for
remote debugging.
/Addsw Allows the user to add predefined switches.
/Rmsw Allows the user to remove predefined switches.
/Dbg1394 Allows the user to configure 1394 port for debugging.
/? Displays this help message.
Examples:
BOOTCFG /Copy /?
BOOTCFG /Delete /?
BOOTCFG /Query /?
BOOTCFG /Raw /?
BOOTCFG /Timeout /?
BOOTCFG /EMS /?
BOOTCFG /Debug /?
BOOTCFG /Addsw /?
BOOTCFG /Rmsw /?
BOOTCFG /Dbg1394 /?
BOOTCFG /Default /?
BOOTCFG /?
WARNING: BOOT.INI is used for boot options on Windows XP and earlier
operating systems. Use the BCDEDIT command line tool to modify
Windows Vista boot options.
BREAK
Sets or Clears Extended CTRL+C checking on DOS system
This is present for Compatibility with DOS systems. It has no effect
under Windows.
If Command Extensions are enabled, and running on the Windows
platform, then the BREAK command will enter a hard coded breakpoint
if being debugged by a debugger.
CACLS
NOTE: Cacls is now deprecated, please use Icacls.
Displays or modifies access control lists (ACLs) of files
CACLS filename [/T] [/M] [/L] [/S[:SDDL]] [/E] [/C] [/G user:perm]
[/R user [...]] [/P user:perm [...]] [/D user [...]]
filename Displays ACLs.
/T Changes ACLs of specified files in
the current directory and all subdirectories.
/L Work on the Symbolic Link itself versus the target
/M Changes ACLs of volumes mounted to a directory
/S Displays the SDDL string for the DACL.
/S:SDDL Replaces the ACLs with those specified in the SDDL string
(not valid with /E, /G, /R, /P, or /D).
/E Edit ACL instead of replacing it.
/C Continue on access denied errors.
/G user:perm Grant specified user access rights.
Perm can be: R Read
W Write
C Change (write)
F Full control
/R user Revoke specified user's access rights (only valid with /E).
/P user:perm Replace specified user's access rights.
Perm can be: N None
R Read
W Write
C Change (write)
F Full control
/D user Deny specified user access.
Wildcards can be used to specify more than one file in a command.
You can specify more than one user in a command.
Abbreviations:
CI - Container Inherit.
The ACE will be inherited by directories.
OI - Object Inherit.
The ACE will be inherited by files.
IO - Inherit Only.
The ACE does not apply to the current file/directory.
ID - Inherited.
The ACE was inherited from the parent directory's ACL.
CALC
This cmd command to open Calculator on Windows.
CALL
Calls one batch program from another.
CALL [drive:][path]filename [batch-parameters]
batch-parameters Specifies any command-line information required by the
batch program.
If Command Extensions are enabled CALL changes as follows:
CALL command now accepts labels as the target of the CALL. The syntax
is:
CALL :label arguments
A new batch file context is created with the specified arguments and
control is passed to the statement after the label specified. You must
"exit" twice by reaching the end of the batch script file twice. The
first time you read the end, control will return to just after the CALL
statement. The second time will exit the batch script. Type GOTO /?
for a description of the GOTO :EOF extension that will allow you to
"return" from a batch script.
In addition, expansion of batch script argument references (%0, %1,
etc.) have been changed as follows:
%* in a batch script refers to all the arguments (e.g. %1 %2 %3
%4 %5 ...)
Substitution of batch parameters (%n) has been enhanced. You can
now use the following optional syntax:
%~1 - expands %1 removing any surrounding quotes (")
%~f1 - expands %1 to a fully qualified path name
%~d1 - expands %1 to a drive letter only
%~p1 - expands %1 to a path only
%~n1 - expands %1 to a file name only
%~x1 - expands %1 to a file extension only
%~s1 - expanded path contains short names only
%~a1 - expands %1 to file attributes
%~t1 - expands %1 to date/time of file
%~z1 - expands %1 to size of file
%~$PATH:1 - searches the directories listed in the PATH
environment variable and expands %1 to the fully
qualified name of the first one found. If the
environment variable name is not defined or the
file is not found by the search, then this
modifier expands to the empty string
The modifiers can be combined to get compound results:
%~dp1 - expands %1 to a drive letter and path only
%~nx1 - expands %1 to a file name and extension only
%~dp$PATH:1 - searches the directories listed in the PATH
environment variable for %1 and expands to the
drive letter and path of the first one found.
%~ftza1 - expands %1 to a DIR like output line
In the above examples %1 and PATH can be replaced by other
valid values. The %~ syntax is terminated by a valid argument
number. The %~ modifiers may not be used with %*
CD
Displays the name of or changes the current directory.
CHDIR [/D] [drive:][path]
CHDIR [..]
CD [/D] [drive:][path]
CD [..]
.. Specifies that you want to change to the parent directory.
Type CD drive: to display the current directory in the specified drive.
Type CD without parameters to display the current drive and directory.
Use the /D switch to change current drive in addition to changing current
directory for a drive.
If Command Extensions are enabled CHDIR changes as follows:
The current directory string is converted to use the same case as
the on disk names. So CD C:\TEMP would actually set the current
directory to C:\Temp if that is the case on disk.
CHDIR command does not treat spaces as delimiters, so it is possible to
CD into a subdirectory name that contains a space without surrounding
the name with quotes. For example:
cd \winnt\profiles\username\programs\start menu
is the same as:
cd "\winnt\profiles\username\programs\start menu"
which is what you would have to type if extensions were disabled.
CERTMGR.MSC
This cmd command to open Certificate Manager on Windows.
CHANGE
CHANGE { LOGON | PORT | USER }
CHARMAP.EXE
This cmd command to open Character Map on Windows.
CHCP
Displays or sets the active code page number.
CHCP [nnn]
nnn Specifies a code page number.
Type CHCP without a parameter to display the active code page number.
CHDIR
Displays the name of or changes the current directory.
CHDIR [/D] [drive:][path]
CHDIR [..]
CD [/D] [drive:][path]
CD [..]
.. Specifies that you want to change to the parent directory.
Type CD drive: to display the current directory in the specified drive.
Type CD without parameters to display the current drive and directory.
Use the /D switch to change current drive in addition to changing current
directory for a drive.
If Command Extensions are enabled CHDIR changes as follows:
The current directory string is converted to use the same case as
the on disk names. So CD C:\TEMP would actually set the current
directory to C:\Temp if that is the case on disk.
CHDIR command does not treat spaces as delimiters, so it is possible to
CD into a subdirectory name that contains a space without surrounding
the name with quotes. For example:
cd \winnt\profiles\username\programs\start menu
is the same as:
cd "\winnt\profiles\username\programs\start menu"
which is what you would have to type if extensions were disabled.
CHKDSK
Checks a disk and displays a status report.
CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]] [/B] [/scan] [/spotfix]
volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
filename FAT/FAT32 only: Specifies the files to check for
fragmentation.
/F Fixes errors on the disk.
/V On FAT/FAT32: Displays the full path and name of every
file on the disk.
On NTFS: Displays cleanup messages if any.
/R Locates bad sectors and recovers readable information
(implies /F, when /scan not specified).
/L:size NTFS only: Changes the log file size to the specified
number of kilobytes. If size is not specified, displays
current size.
/X Forces the volume to dismount first if necessary.
All opened handles to the volume would then be invalid
(implies /F).
/I NTFS only: Performs a less vigorous check of index
entries.
/C NTFS only: Skips checking of cycles within the folder
structure.
/B NTFS only: Re-evaluates bad clusters on the volume
(implies /R)
/scan NTFS only: Runs an online scan on the volume
/forceofflinefix NTFS only: (Must be used with "/scan")
Bypass all online repair; all defects found
are queued for offline repair (i.e. "chkdsk /spotfix").
/perf NTFS only: (Must be used with "/scan")
Uses more system resources to complete a scan as fast as
possible. This may have a negative performance impact on
other tasks running on the system.
/spotfix NTFS only: Runs spot fixing on the volume
/sdcleanup NTFS only: Garbage collect unneeded security descriptor
data (implies /F).
/offlinescanandfix Runs an offline scan and fix on the volume.
/freeorphanedchains FAT/FAT32/exFAT only: Frees any orphaned cluster chains
instead of recovering their contents.
/markclean FAT/FAT32/exFAT only: Marks the volume clean if no
corruption was detected, even if /F was not specified.
The /I or /C switch reduces the amount of time required to run Chkdsk by
skipping certain checks of the volume.
CHKNTFS
Displays or modifies the checking of disk at boot time.
CHKNTFS volume [...]
CHKNTFS /D
CHKNTFS /T[:time]
CHKNTFS /X volume [...]
CHKNTFS /C volume [...]
volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
/D Restores the machine to the default behavior; all drives are
checked at boot time and chkdsk is run on those that are
dirty.
/T:time Changes the AUTOCHK initiation countdown time to the
specified amount of time in seconds. If time is not
specified, displays the current setting.
/X Excludes a drive from the default boot-time check. Excluded
drives are not accumulated between command invocations.
/C Schedules a drive to be checked at boot time; chkdsk will run
if the drive is dirty.
If no switches are specified, CHKNTFS will display if the specified drive is
dirty or scheduled to be checked on next reboot.
CIPHER
Displays or alters the encryption of directories [files] on NTFS partitions.
CIPHER [/E | /D | /C]
[/S:directory] [/B] [/H] [pathname [...]]
CIPHER /K [/ECC:256|384|521]
CIPHER /R:filename [/SMARTCARD] [/ECC:256|384|521]
CIPHER /P:filename.cer
CIPHER /U [/N]
CIPHER /W:directory
CIPHER /X[:efsfile] [filename]
CIPHER /Y
CIPHER /ADDUSER [/CERTHASH:hash | /CERTFILE:filename | /USER:username]
[/S:directory] [/B] [/H] [pathname [...]]
CIPHER /FLUSHCACHE [/SERVER:servername]
CIPHER /REMOVEUSER /CERTHASH:hash
[/S:directory] [/B] [/H] [pathname [...]]
CIPHER /REKEY [pathname [...]]
/B Abort if an error is encountered. By default, CIPHER continues
executing even if errors are encountered.
/C Displays information on the encrypted file.
/D Decrypts the specified files or directories.
/E Encrypts the specified files or directories. Directories will be
marked so that files added afterward will be encrypted. The
encrypted file could become decrypted when it is modified if the
parent directory is not encrypted. It is recommended that you
encrypt the file and the parent directory.
/H Displays files with the hidden or system attributes. These files
are omitted by default.
/K Creates a new certificate and key for use with EFS. If this
option is chosen, all the other options will be ignored.
Note: By default, /K creates a certificate and key that conform
to current group policy. If ECC is specified, a self-signed
certificate will be created with the supplied key size.
/N This option only works with /U. This will prevent keys being
updated. This is used to find all the encrypted files on the
local drives.
/R Generates an EFS recovery key and certificate, then writes them
to a .PFX file (containing certificate and private key) and a
.CER file (containing only the certificate). An administrator may
add the contents of the .CER to the EFS recovery policy to create
the recovery key for users, and import the .PFX to recover
individual files. If SMARTCARD is specified, then writes the
recovery key and certificate to a smart card. A .CER file is
generated (containing only the certificate). No .PFX file is
generated.
Note: By default, /R creates an 2048-bit RSA recovery key and
certificate. If ECC is specified, it must be followed by a
key size of 256, 384, or 521.
/P Creates a base64-encoded recovery-policy blob from the passed-in
certificate. This blob can be used to set DRA policy for
MDM deployments.
/S Performs the specified operation on the given directory and all
files and subdirectories within it.
/U Tries to touch all the encrypted files on local drives. This will
update user's file encryption key or recovery keys to the current
ones if they are changed. This option does not work with other
options except /N.
/W Removes data from available unused disk space on the entire
volume. If this option is chosen, all other options are ignored.
The directory specified can be anywhere in a local volume. If it
is a mount point or points to a directory in another volume, the
data on that volume will be removed.
/X Backup EFS certificate and keys into file filename. If efsfile is
provided, the current user's certificate(s) used to encrypt the
file will be backed up. Otherwise, the user's current EFS
certificate and keys will be backed up.
/Y Displays your current EFS certificate thumbprint on the local PC.
/ADDUSER Adds a user to the specified encrypted file(s). If CERTHASH is
provided, cipher will search for a certificate with this SHA1
hash. If CERTFILE is provided, cipher will extract the
certificate from the file. If USER is provided, cipher will
try to locate the user's certificate in Active Directory Domain
Services.
/FLUSHCACHE
Clears the calling user's EFS key cache on the specified server.
If servername is not provided, cipher clears the user's key cache
on the local machine.
/REKEY Updates the specified encrypted file(s) to use the configured
EFS current key.
/REMOVEUSER
Removes a user from the specified file(s). CERTHASH must be the
SHA1 hash of the certificate to remove.
directory A directory path.
filename A filename without extensions.
pathname Specifies a pattern, file or directory.
efsfile An encrypted file path.
Used without parameters, CIPHER displays the encryption state of the
current directory and any files it contains. You may use multiple directory
names and wildcards. You must put spaces between multiple parameters.
CLEANMGR.EXE
This cmd command to open Disk Cleanup Manager on Windows.
CLS
Clears the screen.
CMD
Starts a new instance of the Windows command interpreter
CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
[[/S] [/C | /K] string]
/C Carries out the command specified by string and then terminates
/K Carries out the command specified by string but remains
/S Modifies the treatment of string after /C or /K (see below)
/Q Turns echo off
/D Disable execution of AutoRun commands from registry (see below)
/A Causes the output of internal commands to a pipe or file to be ANSI
/U Causes the output of internal commands to a pipe or file to be
Unicode
/T:fg Sets the foreground/background colors (see COLOR /? for more info)
/E:ON Enable command extensions (see below)
/E:OFF Disable command extensions (see below)
/F:ON Enable file and directory name completion characters (see below)
/F:OFF Disable file and directory name completion characters (see below)
/V:ON Enable delayed environment variable expansion using ! as the
delimiter. For example, /V:ON would allow !var! to expand the
variable var at execution time. The var syntax expands variables
at input time, which is quite a different thing when inside of a FOR
loop.
/V:OFF Disable delayed environment expansion.
Note that multiple commands separated by the command separator '&&'
are accepted for string if surrounded by quotes. Also, for compatibility
reasons, /X is the same as /E:ON, /Y is the same as /E:OFF and /R is the
same as /C. Any other switches are ignored.
If /C or /K is specified, then the remainder of the command line after
the switch is processed as a command line, where the following logic is
used to process quote (") characters:
1. If all of the following conditions are met, then quote characters
on the command line are preserved:
- no /S switch
- exactly two quote characters
- no special characters between the two quote characters,
where special is one of: &<>()@^|
- there are one or more whitespace characters between the
two quote characters
- the string between the two quote characters is the name
of an executable file.
2. Otherwise, old behavior is to see if the first character is
a quote character and if so, strip the leading character and
remove the last quote character on the command line, preserving
any text after the last quote character.
If /D was NOT specified on the command line, then when CMD.EXE starts, it
looks for the following REG_SZ/REG_EXPAND_SZ registry variables, and if
either or both are present, they are executed first.
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
Command Extensions are enabled by default. You may also disable
extensions for a particular invocation by using the /E:OFF switch. You
can enable or disable extensions for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
In a batch file, the SETLOCAL ENABLEEXTENSIONS or DISABLEEXTENSIONS arguments
takes precedence over the /E:ON or /E:OFF switch. See SETLOCAL /? for details.
The command extensions involve changes and/or additions to the following
commands:
DEL or ERASE
COLOR
CD or CHDIR
MD or MKDIR
PROMPT
PUSHD
POPD
SET
SETLOCAL
ENDLOCAL
IF
FOR
CALL
SHIFT
GOTO
START (also includes changes to external command invocation)
ASSOC
FTYPE
To get specific details, type commandname /? to view the specifics.
Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable delayed expansion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
In a batch file the SETLOCAL ENABLEDELAYEDEXPANSION or DISABLEDELAYEDEXPANSION
arguments takes precedence over the /V:ON or /V:OFF switch. See SETLOCAL /?
for details.
If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.
You can enable or disable file name completion for a particular
invocation of CMD.EXE with the /F:ON or /F:OFF switch. You can enable
or disable completion for all invocations of CMD.EXE on a machine and/or
user logon session by setting either or both of the following REG_DWORD
values in the registry using REGEDIT.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
with the hex value of a control character to use for a particular
function (e.g. 0x4 is Ctrl-D and 0x6 is Ctrl-F). The user specific
settings take precedence over the machine settings. The command line
switches take precedence over the registry settings.
If completion is enabled with the /F:ON switch, the two control
characters used are Ctrl-D for directory name completion and Ctrl-F for
file name completion. To disable a particular completion character in
the registry, use the value for space (0x20) as it is not a valid
control character.
Completion is invoked when you type either of the two control
characters. The completion function takes the path string to the left
of the cursor appends a wild card character to it if none is already
present and builds up a list of paths that match. It then displays the
first matching path. If no paths match, it just beeps and leaves the
display alone. Thereafter, repeated pressing of the same control
character will cycle through the list of matching paths. Pressing the
Shift key with the control character will move through the list
backwards. If you edit the line in any way and press the control
character again, the saved list of matching paths is discarded and a new
one generated. The same occurs if you switch between file and directory
name completion. The only difference between the two control characters
is the file completion character matches both file and directory names,
while the directory completion character only matches directory names.
If file completion is used on any of the built in directory commands
(CD, MD or RD) then directory completion is assumed.
The completion code deals correctly with file names that contain spaces
or other special characters by placing quotes around the matching path.
Also, if you back up, then invoke completion from within a line, the
text to the right of the cursor at the point completion was invoked is
discarded.
The special characters that require quotes are:
<space>
&()[]{}^=;!'+,`~
COLOR
Sets the default console foreground and background colors.
COLOR [attr]
attr Specifies color attribute of console output
Color attributes are specified by TWO hex digits -- the first
corresponds to the background; the second the foreground. Each digit
can be any of the following values:
0 = Black 8 = Gray
1 = Blue 9 = Light Blue
2 = Green A = Light Green
3 = Aqua B = Light Aqua
4 = Red C = Light Red
5 = Purple D = Light Purple
6 = Yellow E = Light Yellow
7 = White F = Bright White
If no argument is given, this command restores the color to what it was
when CMD.EXE started. This value either comes from the current console
window, the /T command line switch or from the DefaultColor registry
value.
The COLOR command sets ERRORLEVEL to 1 if an attempt is made to execute
the COLOR command with a foreground and background color that are the
same.
Example: "COLOR fc" produces light red on bright white
COMEXP.MSC
This cmd command to open Component Services on Windows.
COMP
Compares the contents of two files or sets of files.
COMP [data1] [data2] [/D] [/A] [/L] [/N=number] [/C] [/OFF[LINE]] [/M]
data1 Specifies location and name(s) of first file(s) to compare.
data2 Specifies location and name(s) of second files to compare.
/D Displays differences in decimal format.
/A Displays differences in ASCII characters.
/L Displays line numbers for differences.
/N=number Compares only the first specified number of lines in each file.
/C Disregards case of ASCII letters when comparing files.
/OFF[LINE] Do not skip files with offline attribute set.
/M Do not prompt for compare more files.
To compare sets of files, use wildcards in data1 and data2 parameters.
COMPACT
Displays or alters the compression of files on NTFS partitions.
COMPACT [/C | /U] [/S[:dir]] [/A] [/I] [/F] [/Q] [/EXE[:algorithm]]
[/CompactOs[:option] [/WinDir:dir]] [filename [...]]
/C Compresses the specified files. Directories will be marked
so that files added afterward will be compressed unless /EXE
is specified.
/U Uncompresses the specified files. Directories will be marked
so that files added afterward will not be compressed. If
/EXE is specified, only files compressed as executables will
be uncompressed; if this is omitted, only NTFS compressed
files will be uncompressed.
/S Performs the specified operation on files in the given
directory and all subdirectories. Default "dir" is the
current directory.
/A Displays files with the hidden or system attributes. These
files are omitted by default.
/I Continues performing the specified operation even after errors
have occurred. By default, COMPACT stops when an error is
encountered.
/F Forces the compress operation on all specified files, even
those which are already compressed. Already-compressed files
are skipped by default.
/Q Reports only the most essential information.
/EXE Use compression optimized for executable files which are read
frequently and not modified. Supported algorithms are:
XPRESS4K (fastest) (default)
XPRESS8K
XPRESS16K
LZX (most compact)
/CompactOs Set or query the system's compression state. Supported options are:
query - Query the system's Compact state.
always - Compress all OS binaries and set the system state to Compact
which remains unless administrator changes it.
never - Uncompress all OS binaries and set the system state to non
Compact which remains unless administrator changes it.
/WinDir Used with /CompactOs:query, when querying the offline OS. Specifies
the directory where Windows is installed.
filename Specifies a pattern, file, or directory.
Used without parameters, COMPACT displays the compression state of
the current directory and any files it contains. You may use multiple
filenames and wildcards. You must put spaces between multiple
parameters.
COMPMGMT.MSC
This cmd command to open Computer Management Console on Windows.
CONVERT
Converts a FAT volume to NTFS.
CONVERT volume /FS:NTFS [/V] [/CvtArea:filename] [/NoSecurity] [/X]
volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
/FS:NTFS Specifies that the volume will be converted to NTFS.
/V Specifies that Convert will be run in verbose mode.
/CvtArea:filename
Specifies a contiguous file in the root directory
that will be the place holder for NTFS system files.
/NoSecurity Specifies that the security settings on the converted
files and directories allow access by all users.
/X Forces the volume to dismount first if necessary.
All open handles to the volume will not be valid.
COPY
Copies one or more files to another location.
COPY [/D] [/V] [/N] [/Y | /-Y] [/Z] [/L] [/A | /B ] source [/A | /B]
[+ source [/A | /B] [+ ...]] [destination [/A | /B]]
source Specifies the file or files to be copied.
/A Indicates an ASCII text file.
/B Indicates a binary file.
/D Allow the destination file to be created decrypted
destination Specifies the directory and/or filename for the new file(s).
/V Verifies that new files are written correctly.
/N Uses short filename, if available, when copying a file with a
non-8dot3 name.
/Y Suppresses prompting to confirm you want to overwrite an
existing destination file.
/-Y Causes prompting to confirm you want to overwrite an
existing destination file.
/Z Copies networked files in restartable mode.
/L If the source is a symbolic link, copy the link to the target
instead of the actual file the source link points to.
The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless COPY command is being executed from
within a batch script.
To append files, specify a single file for destination, but multiple files
for source (using wildcards or file1+file2+file3 format).
CURL
Usage: curl [options...] <url>
--abstract-unix-socket <path> Connect via abstract Unix domain socket
--alt-svc <file name> Enable alt-svc with this cache file
--anyauth Pick any authentication method
-a, --append Append to target file when uploading
--aws-sigv4 <provider1[:provider2[:region[:service]]]> Use AWS V4 signature authentication
--basic Use HTTP Basic Authentication
--cacert <file> CA certificate to verify peer against
--capath <dir> CA directory to verify peer against
-E, --cert <certificate[:password]> Client certificate file and password
--cert-status Verify the status of the server cert via OCSP-staple
--cert-type <type> Certificate type (DER/PEM/ENG/P12)
--ciphers <list of ciphers> SSL ciphers to use
--compressed Request compressed response
--compressed-ssh Enable SSH compression
-K, --config <file> Read config from a file
--connect-timeout <fractional seconds> Maximum time allowed for connection
--connect-to <HOST1:PORT1:HOST2:PORT2> Connect to host
-C, --continue-at <offset> Resumed transfer offset
-b, --cookie <data|filename> Send cookies from string/file
-c, --cookie-jar <filename> Write cookies to <filename> after operation
--create-dirs Create necessary local directory hierarchy
--create-file-mode <mode> File mode for created files
--crlf Convert LF to CRLF in upload
--crlfile <file> Use this CRL list
--curves <algorithm list> (EC) TLS key exchange algorithm(s) to request
-d, --data <data> HTTP POST data
--data-ascii <data> HTTP POST ASCII data
--data-binary <data> HTTP POST binary data
--data-raw <data> HTTP POST data, '@' allowed
--data-urlencode <data> HTTP POST data URL encoded
--delegation <LEVEL> GSS-API delegation permission
--digest Use HTTP Digest Authentication
-q, --disable Disable .curlrc
--disable-eprt Inhibit using EPRT or LPRT
--disable-epsv Inhibit using EPSV
--disallow-username-in-url Disallow username in URL
--dns-interface <interface> Interface to use for DNS requests
--dns-ipv4-addr <address> IPv4 address to use for DNS requests
--dns-ipv6-addr <address> IPv6 address to use for DNS requests
--dns-servers <addresses> DNS server addrs to use
--doh-cert-status Verify the status of the DoH server cert via OCSP-staple
--doh-insecure Allow insecure DoH server connections
--doh-url <URL> Resolve host names over DoH
-D, --dump-header <filename> Write the received headers to <filename>
--egd-file <file> EGD socket path for random data
--engine <name> Crypto engine to use
--etag-compare <file> Pass an ETag from a file as a custom header
--etag-save <file> Parse ETag from a request and save it to a file
--expect100-timeout <seconds> How long to wait for 100-continue
-f, --fail Fail fast with no output on HTTP errors
--fail-early Fail on first transfer error, do not continue
--fail-with-body Fail on HTTP errors but save the body
--false-start Enable TLS False Start
-F, --form <name=content> Specify multipart MIME data
--form-escape Escape multipart form field/file names using backslash
--form-string <name=string> Specify multipart MIME data
--ftp-account <data> Account data string
--ftp-alternative-to-user <command> String to replace USER [name]
--ftp-create-dirs Create the remote dirs if not present
--ftp-method <method> Control CWD usage
--ftp-pasv Use PASV/EPSV instead of PORT
-P, --ftp-port <address> Use PORT instead of PASV
--ftp-pret Send PRET before PASV
--ftp-skip-pasv-ip Skip the IP address for PASV
--ftp-ssl-ccc Send CCC after authenticating
--ftp-ssl-ccc-mode <active/passive> Set CCC mode
--ftp-ssl-control Require SSL/TLS for FTP login, clear for transfer
-G, --get Put the post data in the URL and use GET
-g, --globoff Disable URL sequences and ranges using {} and []
--happy-eyeballs-timeout-ms <milliseconds> Time for IPv6 before trying IPv4
--haproxy-protocol Send HAProxy PROXY protocol v1 header
-I, --head Show document info only
-H, --header <header/@file> Pass custom header(s) to server
-h, --help <category> Get help for commands
--hostpubmd5 <md5> Acceptable MD5 hash of the host public key
--hostpubsha256 <sha256> Acceptable SHA256 hash of the host public key
--hsts <file name> Enable HSTS with this cache file
--http0.9 Allow HTTP 0.9 responses
-0, --http1.0 Use HTTP 1.0
--http1.1 Use HTTP 1.1
--http2 Use HTTP 2
--http2-prior-knowledge Use HTTP 2 without HTTP/1.1 Upgrade
--http3 Use HTTP v3
--ignore-content-length Ignore the size of the remote resource
-i, --include Include protocol response headers in the output
-k, --insecure Allow insecure server connections
--interface <name> Use network INTERFACE (or address)
-4, --ipv4 Resolve names to IPv4 addresses
-6, --ipv6 Resolve names to IPv6 addresses
--json <data> HTTP POST JSON
-j, --junk-session-cookies Ignore session cookies read from file
--keepalive-time <seconds> Interval time for keepalive probes
--key <key> Private key file name
--key-type <type> Private key file type (DER/PEM/ENG)
--krb <level> Enable Kerberos with security <level>
--libcurl <file> Dump libcurl equivalent code of this command line
--limit-rate <speed> Limit transfer speed to RATE
-l, --list-only List only mode
--local-port <num/range> Force use of RANGE for local port numbers
-L, --location Follow redirects
--location-trusted Like --location, and send auth to other hosts
--login-options <options> Server login options
--mail-auth <address> Originator address of the original email
--mail-from <address> Mail from this address
--mail-rcpt <address> Mail to this address
--mail-rcpt-allowfails Allow RCPT TO command to fail for some recipients
-M, --manual Display the full manual
--max-filesize <bytes> Maximum file size to download
--max-redirs <num> Maximum number of redirects allowed
-m, --max-time <fractional seconds> Maximum time allowed for transfer
--metalink Process given URLs as metalink XML file
--negotiate Use HTTP Negotiate (SPNEGO) authentication
-n, --netrc Must read .netrc for user name and password
--netrc-file <filename> Specify FILE for netrc
--netrc-optional Use either .netrc or URL
-:, --next Make next URL use its separate set of options
--no-alpn Disable the ALPN TLS extension
-N, --no-buffer Disable buffering of the output stream
--no-clobber Do not overwrite files that already exist
--no-keepalive Disable TCP keepalive on the connection
--no-npn Disable the NPN TLS extension
--no-progress-meter Do not show the progress meter
--no-sessionid Disable SSL session-ID reusing
--noproxy <no-proxy-list> List of hosts which do not use proxy
--ntlm Use HTTP NTLM authentication
--ntlm-wb Use HTTP NTLM authentication with winbind
--oauth2-bearer <token> OAuth 2 Bearer Token
-o, --output <file> Write to file instead of stdout
--output-dir <dir> Directory to save files in
-Z, --parallel Perform transfers in parallel
--parallel-immediate Do not wait for multiplexing (with --parallel)
--parallel-max <num> Maximum concurrency for parallel transfers
--pass <phrase> Pass phrase for the private key
--path-as-is Do not squash .. sequences in URL path
--pinnedpubkey <hashes> FILE/HASHES Public key to verify peer against
--post301 Do not switch to GET after following a 301
--post302 Do not switch to GET after following a 302
--post303 Do not switch to GET after following a 303
--preproxy [protocol://]host[:port] Use this proxy first
-#, --progress-bar Display transfer progress as a bar
--proto <protocols> Enable/disable PROTOCOLS
--proto-default <protocol> Use PROTOCOL for any URL missing a scheme
--proto-redir <protocols> Enable/disable PROTOCOLS on redirect
-x, --proxy [protocol://]host[:port] Use this proxy
--proxy-anyauth Pick any proxy authentication method
--proxy-basic Use Basic authentication on the proxy
--proxy-cacert <file> CA certificate to verify peer against for proxy
--proxy-capath <dir> CA directory to verify peer against for proxy
--proxy-cert <cert[:passwd]> Set client certificate for proxy
--proxy-cert-type <type> Client certificate type for HTTPS proxy
--proxy-ciphers <list> SSL ciphers to use for proxy
--proxy-crlfile <file> Set a CRL list for proxy
--proxy-digest Use Digest authentication on the proxy
--proxy-header <header/@file> Pass custom header(s) to proxy
--proxy-insecure Do HTTPS proxy connections without verifying the proxy
--proxy-key <key> Private key for HTTPS proxy
--proxy-key-type <type> Private key file type for proxy
--proxy-negotiate Use HTTP Negotiate (SPNEGO) authentication on the proxy
--proxy-ntlm Use NTLM authentication on the proxy
--proxy-pass <phrase> Pass phrase for the private key for HTTPS proxy
--proxy-pinnedpubkey <hashes> FILE/HASHES public key to verify proxy with
--proxy-service-name <name> SPNEGO proxy service name
--proxy-ssl-allow-beast Allow security flaw for interop for HTTPS proxy
--proxy-ssl-auto-client-cert Use auto client certificate for proxy (Schannel)
--proxy-tls13-ciphers <ciphersuite list> TLS 1.3 proxy cipher suites
--proxy-tlsauthtype <type> TLS authentication type for HTTPS proxy
--proxy-tlspassword <string> TLS password for HTTPS proxy
--proxy-tlsuser <name> TLS username for HTTPS proxy
--proxy-tlsv1 Use TLSv1 for HTTPS proxy
-U, --proxy-user <user:password> Proxy user and password
--proxy1.0 <host[:port]> Use HTTP/1.0 proxy on given port
-p, --proxytunnel Operate through an HTTP proxy tunnel (using CONNECT)
--pubkey <key> SSH Public key file name
-Q, --quote <command> Send command(s) to server before transfer
--random-file <file> File for reading random data from
-r, --range <range> Retrieve only the bytes within RANGE
--raw Do HTTP "raw"; no transfer decoding
-e, --referer <URL> Referrer URL
-J, --remote-header-name Use the header-provided filename
-O, --remote-name Write output to a file named as the remote file
--remote-name-all Use the remote file name for all URLs
-R, --remote-time Set the remote file's time on the local output
--remove-on-error Remove output file on errors
-X, --request <method> Specify request method to use
--request-target <path> Specify the target for this request
--resolve <[+]host:port:addr[,addr]...> Resolve the host+port to this address
--retry <num> Retry request if transient problems occur
--retry-all-errors Retry all errors (use with --retry)
--retry-connrefused Retry on connection refused (use with --retry)
--retry-delay <seconds> Wait time between retries
--retry-max-time <seconds> Retry only within this period
--sasl-authzid <identity> Identity for SASL PLAIN authentication
--sasl-ir Enable initial response in SASL authentication
--service-name <name> SPNEGO service name
-S, --show-error Show error even when -s is used
-s, --silent Silent mode
--socks4 <host[:port]> SOCKS4 proxy on given host + port
--socks4a <host[:port]> SOCKS4a proxy on given host + port
--socks5 <host[:port]> SOCKS5 proxy on given host + port
--socks5-basic Enable username/password auth for SOCKS5 proxies
--socks5-gssapi Enable GSS-API auth for SOCKS5 proxies
--socks5-gssapi-nec Compatibility with NEC SOCKS5 server
--socks5-gssapi-service <name> SOCKS5 proxy service name for GSS-API
--socks5-hostname <host[:port]> SOCKS5 proxy, pass host name to proxy
-Y, --speed-limit <speed> Stop transfers slower than this
-y, --speed-time <seconds> Trigger 'speed-limit' abort after this time
--ssl Try SSL/TLS
--ssl-allow-beast Allow security flaw to improve interop
--ssl-auto-client-cert Use auto client certificate (Schannel)
--ssl-no-revoke Disable cert revocation checks (Schannel)
--ssl-reqd Require SSL/TLS
--ssl-revoke-best-effort Ignore missing/offline cert CRL dist points
-2, --sslv2 Use SSLv2
-3, --sslv3 Use SSLv3
--stderr <file> Where to redirect stderr
--styled-output Enable styled output for HTTP headers
--suppress-connect-headers Suppress proxy CONNECT response headers
--tcp-fastopen Use TCP Fast Open
--tcp-nodelay Use the TCP_NODELAY option
-t, --telnet-option <opt=val> Set telnet option
--tftp-blksize <value> Set TFTP BLKSIZE option
--tftp-no-options Do not send any TFTP options
-z, --time-cond <time> Transfer based on a time condition
--tls-max <VERSION> Set maximum allowed TLS version
--tls13-ciphers <ciphersuite list> TLS 1.3 cipher suites to use
--tlsauthtype <type> TLS authentication type
--tlspassword <string> TLS password
--tlsuser <name> TLS user name
-1, --tlsv1 Use TLSv1.0 or greater
--tlsv1.0 Use TLSv1.0 or greater
--tlsv1.1 Use TLSv1.1 or greater
--tlsv1.2 Use TLSv1.2 or greater
--tlsv1.3 Use TLSv1.3 or greater
--tr-encoding Request compressed transfer encoding
--trace <file> Write a debug trace to FILE
--trace-ascii <file> Like --trace, but without hex output
--trace-time Add time stamps to trace/verbose output
--unix-socket <path> Connect through this Unix domain socket
-T, --upload-file <file> Transfer local FILE to destination
--url <url> URL to work with
-B, --use-ascii Use ASCII/text transfer
-u, --user <user:password> Server user and password
-A, --user-agent <name> Send User-Agent <name> to server
-v, --verbose Make the operation more talkative
-V, --version Show version number and quit
-w, --write-out <format> Use output FORMAT after completion
--xattr Store metadata in extended file attributes
CERTUTIL
Usage:
CertUtil [Options] [-dump]
CertUtil [Options] [-dump] [File]
Dump configuration information or file
Options:
-f -- Force overwrite
-user -- Use HKEY_CURRENT_USER keys or certificate store
-Unicode -- Write redirected output in Unicode
-gmt -- Display times as GMT
-seconds -- Display times with seconds and milliseconds
-Silent -- (-q) Use silent flag to acquire crypt context
-split -- Split embedded ASN.1 elements, and save to files
-v -- Verbose operation
-privatekey -- Display password and private key data
-pin PIN -- Smart Card PIN
-p Password -- Password
-t Timeout -- URL fetch timeout in milliseconds
-sid WELL_KNOWN_SID_TYPE -- Numeric SID
22 -- Local System
23 -- Local Service
24 -- Network Service
CertUtil -? -- Display a verb list (command list)
CertUtil -dump -? -- Display help text for the "dump" verb
CertUtil -v -? -- Display all help text for all verbs
CHGLOGON
Enable, disable, or drain session logins.
CHANGE LOGON {/QUERY | /ENABLE | /DISABLE | /DRAIN | /DRAINUNTILRESTART}
/QUERY Query current session login mode.
/ENABLE Enable user login from sessions.
/DISABLE Disable user login from sessions.
/DRAIN Disable new user logons, but allow reconnections to existing sessions.
/DRAINUNTILRESTART Disable new user logons until the server is restarted, but allow reconnections to existing sessions.
CHGUSR
Change Install Mode.
CHANGE USER {/EXECUTE | /INSTALL | /QUERY}
/EXECUTE Enable execute mode (default).
/INSTALL Enable install mode.
/QUERY Display current settings.
CHOICE
CHOICE [/C choices] [/N] [/CS] [/T timeout /D choice] [/M text]
Description:
This tool allows users to select one item from a list
of choices and returns the index of the selected choice.
Parameter List:
/C choices Specifies the list of choices to be created.
Default list is "YN".
/N Hides the list of choices in the prompt.
The message before the prompt is displayed
and the choices are still enabled.
/CS Enables case-sensitive choices to be selected.
By default, the utility is case-insensitive.
/T timeout The number of seconds to pause before a default
choice is made. Acceptable values are from 0 to
9999. If 0 is specified, there will be no pause
and the default choice is selected.
/D choice Specifies the default choice after nnnn seconds.
Character must be in the set of choices specified
by /C option and must also specify nnnn with /T.
/M text Specifies the message to be displayed before
the prompt. If not specified, the utility
displays only a prompt.
/? Displays this help message.
NOTE:
The ERRORLEVEL environment variable is set to the index of the
key that was selected from the set of choices. The first choice
listed returns a value of 1, the second a value of 2, and so on.
If the user presses a key that is not a valid choice, the tool
sounds a warning beep. If tool detects an error condition,
it returns an ERRORLEVEL value of 255. If the user presses
CTRL+BREAK or CTRL+C, the tool returns an ERRORLEVEL value
of 0. When you use ERRORLEVEL parameters in a batch program, list
them in decreasing order.
Examples:
CHOICE /?
CHOICE /C YNC /M "Press Y for Yes, N for No or C for Cancel."
CHOICE /T 10 /C ync /CS /D y
CHOICE /C ab /M "Select a for option 1 and b for option 2."
CHOICE /C ab /N /M "Select a for option 1 and b for option 2."
CLIP
Description:
Redirects output of command line tools to the Windows clipboard.
This text output can then be pasted into other programs.
Parameter List:
/? Displays this help message.
Examples:
DIR | CLIP Places a copy of the current directory
listing into the Windows clipboard.
CLIP < README.TXT Places a copy of the text from readme.txt
on to the Windows clipboard.
CSCRIPT
Usage: CScript scriptname.extension [option...] [arguments...]
Options:
//B Batch mode: Suppresses script errors and prompts from displaying
//D Enable Active Debugging
//E:engine Use engine for executing script
//H:CScript Changes the default script host to CScript.exe
//H:WScript Changes the default script host to WScript.exe (default)
//I Interactive mode (default, opposite of //B)
//Job:xxxx Execute a WSF job
//Logo Display logo (default)
//Nologo Prevent logo display: No banner will be shown at execution time
//S Save current command line options for this user
//T:nn Time out in seconds: Maximum time a script is permitted to run
//X Execute script in debugger
//U Use Unicode for redirected I/O from the console
DATE
Displays or sets the date.
DATE [/T | date]
Type DATE without parameters to display the current date setting and
a prompt for a new one. Press ENTER to keep the same date.
If Command Extensions are enabled the DATE command supports
the /T switch which tells the command to just output the
current date, without prompting for a new date.
DEFRAG
Defrag <Volumes> <Operations> [<Options>]
Volumes:
/C | /AllVolumes On each volume run only the preferred operations from
the given list of operations.
/E | /VolumesExcept <volume paths>
Perform all the given operations on each volume except.
those specified. If the exception list is empty, this
behaves as /AllVolumes.
volume paths Specifies the drive letter followed by a colon, mount point
or volume name. More than one volume can be specified. Run
all the given operations on each specified volume..
Operations:
/A | /Analyze Perform analysis.
/B | /BootOptimize Perform boot optimization to increase boot performance.
/D | /Defrag Perform traditional defrag (this is the default). On a tiered
volume, traditional defrag is performed only on the Capacity
tier.
/G | /TierOptimize On tiered volumes, optimize files to reside on the appropriate
storage tier.
/K | /SlabConsolidate On thinly provisioned volumes, perform slab consolidation to
increase slab usage efficiency.
/L | /Retrim On thinly provisioned volumes, perform retrim to release free
slabs. On SSDs perform retrim to improve write performance.
/O | /Optimize Perform the proper optimization for each media type.
/T | /TrackProgress Track progress of a running operation for a given volume. An
instance can show progress only for a single volume. To see
progress for another volume launch another instance.
/U | /PrintProgress Print the progress of the operation on the screen.
/V | /Verbose Print verbose output containing the fragmentation statistics.
/X | /FreespaceConsolidate
Perform free space consolidation, moves free space towards
the end of the volume (even on thin provisioned volumes). On
tiered volumes consolidation is performed only on the Capacity
tier.
Options:
/H | /NormalPriority Run the operation at normal priority (default is low).
/I | /MaxRuntime n Available only with TierOptimize. Tier optimization would
run for at most n seconds on each volume.
/LayoutFile <file path>
Available only with BootOptimize. This file contains the list
of files to be optimized. The default location is
%windir%\Prefetch\layout.ini.
/M | /MultiThread [n] Run the operation on each volume in parallel in the background.
For TierOptimize, at most n threads optimize the storage tiers
in parallel. Default value of n is 8. All other optimizations
ignore n.
/OnlyPreferred When volumes are specified explicitly, defrag performs all
the given operations on each specified volume. This switch
lets defrag run only the preferred operations, from the
given list of operations, on each specified volume.
Examples:
Defrag C: /U /V
Defrag C: D: /TierOptimize /MultiThread
Defrag C:\mountpoint /Analysis /U
Defrag /C /H /V
DEL
Deletes one or more files.
DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
names Specifies a list of one or more files or directories.
Wildcards may be used to delete multiple files. If a
directory is specified, all files within the directory
will be deleted.
/P Prompts for confirmation before deleting each file.
/F Force deleting of read-only files.
/S Delete specified files from all subdirectories.
/Q Quiet mode, do not ask if ok to delete on global wildcard
/A Selects files to delete based on attributes
attributes R Read-only files S System files
H Hidden files A Files ready for archiving
I Not content indexed Files L Reparse Points
O Offline files - Prefix meaning not
If Command Extensions are enabled DEL and ERASE change as follows:
The display semantics of the /S switch are reversed in that it shows
you only the files that are deleted, not the ones it could not find.
DESK.CPL
This cmd command to open Display Settings on Windows.
DEVMGMT.MSC
This cmd command to open Disk Manager on Windows.
DIR
Displays a list of files and subdirectories in a directory.
DIR [drive:][path][filename] [/A[[:]attributes]] [/B] [/C] [/D] [/L] [/N]
[/O[[:]sortorder]] [/P] [/Q] [/R] [/S] [/T[[:]timefield]] [/W] [/X] [/4]
[drive:][path][filename]
Specifies drive, directory, and/or files to list.
/A Displays files with specified attributes.
attributes D Directories R Read-only files
H Hidden files A Files ready for archiving
S System files I Not content indexed files
L Reparse Points O Offline files
- Prefix meaning not
/B Uses bare format (no heading information or summary).
/C Display the thousand separator in file sizes. This is the
default. Use /-C to disable display of separator.
/D Same as wide but files are list sorted by column.
/L Uses lowercase.
/N New long list format where filenames are on the far right.
/O List by files in sorted order.
sortorder N By name (alphabetic) S By size (smallest first)
E By extension (alphabetic) D By date/time (oldest first)
G Group directories first - Prefix to reverse order
/P Pauses after each screenful of information.
/Q Display the owner of the file.
/R Display alternate data streams of the file.
/S Displays files in specified directory and all subdirectories.
/T Controls which time field displayed or used for sorting
timefield C Creation
A Last Access
W Last Written
/W Uses wide list format.
/X This displays the short names generated for non-8dot3 file
names. The format is that of /N with the short name inserted
before the long name. If no short name is present, blanks are
displayed in its place.
/4 Displays four-digit years
Switches may be preset in the DIRCMD environment variable. Override
preset switches by prefixing any switch with - (hyphen)--for example, /-W.
DISKMGMT.MSC
This cmd command to open Disk Management on Windows.
DISKPART
ACTIVE - Mark the selected partition as active.
ADD - Add a mirror to a simple volume.
ASSIGN - Assign a drive letter or mount point to the selected volume.
ATTRIBUTES - Manipulate volume or disk attributes.
ATTACH - Attaches a virtual disk file.
AUTOMOUNT - Enable and disable automatic mounting of basic volumes.
BREAK - Break a mirror set.
CLEAN - Clear the configuration information, or all information, off the
disk.
COMPACT - Attempts to reduce the physical size of the file.
CONVERT - Convert between different disk formats.
CREATE - Create a volume, partition or virtual disk.
DELETE - Delete an object.
DETAIL - Provide details about an object.
DETACH - Detaches a virtual disk file.
EXIT - Exit DiskPart.
EXTEND - Extend a volume.
EXPAND - Expands the maximum size available on a virtual disk.
FILESYSTEMS - Display current and supported file systems on the volume.
FORMAT - Format the volume or partition.
GPT - Assign attributes to the selected GPT partition.
HELP - Display a list of commands.
IMPORT - Import a disk group.
INACTIVE - Mark the selected partition as inactive.
LIST - Display a list of objects.
MERGE - Merges a child disk with its parents.
ONLINE - Online an object that is currently marked as offline.
OFFLINE - Offline an object that is currently marked as online.
RECOVER - Refreshes the state of all disks in the selected pack.
Attempts recovery on disks in the invalid pack, and
resynchronizes mirrored volumes and RAID5 volumes
that have stale plex or parity data.
REM - Does nothing. This is used to comment scripts.
REMOVE - Remove a drive letter or mount point assignment.
REPAIR - Repair a RAID-5 volume with a failed member.
RESCAN - Rescan the computer looking for disks and volumes.
RETAIN - Place a retained partition under a simple volume.
SAN - Display or set the SAN policy for the currently booted OS.
SELECT - Shift the focus to an object.
SETID - Change the partition type.
SHRINK - Reduce the size of the selected volume.
UNIQUEID - Displays or sets the GUID partition table (GPT) identifier or
master boot record (MBR) signature of a disk.
DOSKEY
Edits command lines, recalls Windows commands, and creates macros.
DOSKEY [/REINSTALL] [/LISTSIZE=size] [/MACROS[:ALL | :exename]]
[/HISTORY] [/INSERT | /OVERSTRIKE] [/EXENAME=exename] [/MACROFILE=filename]
[macroname=[text]]
/REINSTALL Installs a new copy of Doskey.
/LISTSIZE=size Sets size of command history buffer.
/MACROS Displays all Doskey macros.
/MACROS:ALL Displays all Doskey macros for all executables which have
Doskey macros.
/MACROS:exename Displays all Doskey macros for the given executable.
/HISTORY Displays all commands stored in memory.
/INSERT Specifies that new text you type is inserted in old text.
/OVERSTRIKE Specifies that new text overwrites old text.
/EXENAME=exename Specifies the executable.
/MACROFILE=filename Specifies a file of macros to install.
macroname Specifies a name for a macro you create.
text Specifies commands you want to record.
UP and DOWN ARROWS recall commands; ESC clears command line; F7 displays
command history; ALT+F7 clears command history; F8 searches command
history; F9 selects a command by number; ALT+F10 clears macro definitions.
The following are some special codes in Doskey macro definitions:
$T Command separator. Allows multiple commands in a macro.
$1-$9 Batch parameters. Equivalent to %1-%9 in batch programs.
$* Symbol replaced by everything following macro name on command line.
DRIVERQUERY
DRIVERQUERY [/S system [/U username [/P [password]]]]
[/FO format] [/NH] [/SI] [/V]
Description:
Enables an administrator to display a list of
installed device drivers.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context
under which the command should execute.
/P [password] Specify the password for the given
user context.
/FO format Specifies the type of output to display.
Valid values to be passed with the
switch are "TABLE", "LIST", "CSV".
/NH Specifies that the "Column Header"
should not be displayed. Valid for
"TABLE" and "CSV" format only.
/SI Provides information about signed drivers.
/V Displays verbose output. Not valid
for signed drivers.
/? Displays this help message.
Examples:
DRIVERQUERY
DRIVERQUERY /FO CSV /SI
DRIVERQUERY /NH
DRIVERQUERY /S ipaddress /U user /V
DRIVERQUERY /S system /U domain\user /P password /FO LIST
DXDIAG.EXE
This cmd command to open DirectX Diagnostic Tool on Windows.
ECHO
Displays messages, or turns command-echoing on or off.
ECHO [ON | OFF]
ECHO [message]
Type ECHO without parameters to display the current echo setting.
ENDLOCAL
Ends localization of environment changes in a batch file.
Environment changes made after ENDLOCAL has been issued are
not local to the batch file; the previous settings are not
restored on termination of the batch file.
ENDLOCAL
If Command Extensions are enabled ENDLOCAL changes as follows:
If the corresponding SETLOCAL enable or disabled command extensions
using the new ENABLEEXTENSIONS or DISABLEEXTENSIONS options, then
after the ENDLOCAL, the enabled/disabled state of command extensions
will be restored to what it was prior to the matching SETLOCAL
command execution.
ERASE
Deletes one or more files.
DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] names
names Specifies a list of one or more files or directories.
Wildcards may be used to delete multiple files. If a
directory is specified, all files within the directory
will be deleted.
/P Prompts for confirmation before deleting each file.
/F Force deleting of read-only files.
/S Delete specified files from all subdirectories.
/Q Quiet mode, do not ask if ok to delete on global wildcard
/A Selects files to delete based on attributes
attributes R Read-only files S System files
H Hidden files A Files ready for archiving
I Not content indexed Files L Reparse Points
O Offline files - Prefix meaning not
If Command Extensions are enabled DEL and ERASE change as follows:
The display semantics of the /S switch are reversed in that it shows
you only the files that are deleted, not the ones it could not find.
EUDCEDIT.EXE
This cmd command to open Private Character Editor on Windows.
EVENTVWR.EXE
This cmd command to open Event Viewer on Windows.
EXIT
Quits the CMD.EXE program (command interpreter) or the current batch
script.
EXIT [/B] [exitCode]
/B specifies to exit the current batch script instead of
CMD.EXE. If executed from outside a batch script, it
will quit CMD.EXE
exitCode specifies a numeric number. if /B is specified, sets
ERRORLEVEL that number. If quitting CMD.EXE, sets the process
exit code with that number.
EXPAND
Expands one or more compressed files.
EXPAND [-R] Source Destination
EXPAND -R Source [Destination]
EXPAND -I Source [Destination]
EXPAND -D Source.cab [-F:Files]
EXPAND Source.cab -F:Files Destination
-R Rename expanded files.
-I Rename expanded files but ignore directory structure.
-D Display list of files in source.
Source Source file specification. Wildcards may be used.
-F:Files Name of files to expand from a .CAB.
Destination Destination file | path specification.
Destination may be a directory.
If Source is multiple files and -r is not specified,
Destination must be a directory.
EXPLORER.EXE
This cmd command to open File Explorer on Windows.
FC
Compares two files or sets of files and displays the differences between
them
FC [/A] [/C] [/L] [/LBn] [/N] [/OFF[LINE]] [/T] [/U] [/W] [/nnnn]
[drive1:][path1]filename1 [drive2:][path2]filename2
FC /B [drive1:][path1]filename1 [drive2:][path2]filename2
/A Displays only first and last lines for each set of differences.
/B Performs a binary comparison.
/C Disregards the case of letters.
/L Compares files as ASCII text.
/LBn Sets the maximum consecutive mismatches to the specified
number of lines.
/N Displays the line numbers on an ASCII comparison.
/OFF[LINE] Do not skip files with offline attribute set.
/T Does not expand tabs to spaces.
/U Compare files as UNICODE text files.
/W Compresses white space (tabs and spaces) for comparison.
/nnnn Specifies the number of consecutive lines that must match
after a mismatch.
[drive1:][path1]filename1
Specifies the first file or set of files to compare.
[drive2:][path2]filename2
Specifies the second file or set of files to compare.
FIND
Searches for a text string in a file or files.
FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]
/V Displays all lines NOT containing the specified string.
/C Displays only the count of lines containing the string.
/N Displays line numbers with the displayed lines.
/I Ignores the case of characters when searching for the string.
/OFF[LINE] Do not skip files with offline attribute set.
"string" Specifies the text string to find.
[drive:][path]filename
Specifies a file or files to search.
If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.
FINDSTR
Searches for strings in files.
FINDSTR [/B] [/E] [/L] [/R] [/S] [/I] [/X] [/V] [/N] [/M] [/O] [/P] [/F:file]
[/C:string] [/G:file] [/D:dir list] [/A:color attributes] [/OFF[LINE]]
strings [[drive:][path]filename[ ...]]
/B Matches pattern if at the beginning of a line.
/E Matches pattern if at the end of a line.
/L Uses search strings literally.
/R Uses search strings as regular expressions.
/S Searches for matching files in the current directory and all
subdirectories.
/I Specifies that the search is not to be case-sensitive.
/X Prints lines that match exactly.
/V Prints only lines that do not contain a match.
/N Prints the line number before each line that matches.
/M Prints only the filename if a file contains a match.
/O Prints character offset before each matching line.
/P Skip files with non-printable characters.
/OFF[LINE] Do not skip files with offline attribute set.
/A:attr Specifies color attribute with two hex digits. See "color /?"
/F:file Reads file list from the specified file(/ stands for console).
/C:string Uses specified string as a literal search string.
/G:file Gets search strings from the specified file(/ stands for console).
/D:dir Search a semicolon delimited list of directories
strings Text to be searched for.
[drive:][path]filename
Specifies a file or files to search.
Use spaces to separate multiple search strings unless the argument is prefixed
with /C. For example, 'FINDSTR "hello there" x.y' searches for "hello" or
"there" in file x.y. 'FINDSTR /C:"hello there" x.y' searches for
"hello there" in file x.y.
Regular expression quick reference:
. Wildcard: any character
* Repeat: zero or more occurrences of previous character or class
^ Line position: beginning of line
$ Line position: end of line
[class] Character class: any one character in set
[^class] Inverse class: any one character not in set
[x-y] Range: any characters within the specified range
\x Escape: literal use of metacharacter x
\<xyz Word position: beginning of word
xyz\> Word position: end of word
For full information on FINDSTR regular expressions refer to the online Command
Reference.
FOR
Runs a specified command for each file in a set of files.
FOR %variable IN (set) DO command [command-parameters]
%variable Specifies a single letter replaceable parameter.
(set) Specifies a set of one or more files. Wildcards may be used.
command Specifies the command to carry out for each file.
command-parameters
Specifies parameters or switches for the specified command.
To use the FOR command in a batch program, specify %%variable instead
of %variable. Variable names are case sensitive, so %i is different
from %I.
If Command Extensions are enabled, the following additional
forms of the FOR command are supported:
FOR /D %variable IN (set) DO command [command-parameters]
If set contains wildcards, then specifies to match against directory
names instead of file names.
FOR /R [[drive:]path] %variable IN (set) DO command [command-parameters]
Walks the directory tree rooted at [drive:]path, executing the FOR
statement in each directory of the tree. If no directory
specification is specified after /R then the current directory is
assumed. If set is just a single period (.) character then it
will just enumerate the directory tree.
FOR /L %variable IN (start,step,end) DO command [command-parameters]
The set is a sequence of numbers from start to end, by step amount.
So (1,1,5) would generate the sequence 1 2 3 4 5 and (5,-1,1) would
generate the sequence (5 4 3 2 1)
FOR /F ["options"] %variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %variable IN ("string") DO command [command-parameters]
FOR /F ["options"] %variable IN ('command') DO command [command-parameters]
or, if usebackq option present:
FOR /F ["options"] %variable IN (file-set) DO command [command-parameters]
FOR /F ["options"] %variable IN ('string') DO command [command-parameters]
FOR /F ["options"] %variable IN (`command`) DO command [command-parameters]
file-set is one or more file names. Each file is opened, read
and processed before going on to the next file in file-set.
Processing consists of reading in the file, breaking it up into
individual lines of text and then parsing each line into zero or
more tokens. The body of the for loop is then called with the
variable value(s) set to the found token string(s). By default, /F
passes the first blank separated token from each line of each file.
Blank lines are skipped. You can override the default parsing
behavior by specifying the optional "options" parameter. This
is a quoted string which contains one or more keywords to specify
different parsing options. The keywords are:
eol=c - specifies an end of line comment character
(just one)
skip=n - specifies the number of lines to skip at the
beginning of the file.
delims=xxx - specifies a delimiter set. This replaces the
default delimiter set of space and tab.
tokens=x,y,m-n - specifies which tokens from each line are to
be passed to the for body for each iteration.
This will cause additional variable names to
be allocated. The m-n form is a range,
specifying the mth through the nth tokens. If
the last character in the tokens= string is an
asterisk, then an additional variable is
allocated and receives the remaining text on
the line after the last token parsed.
usebackq - specifies that the new semantics are in force,
where a back quoted string is executed as a
command and a single quoted string is a
literal string command and allows the use of
double quotes to quote file names in
file-set.
Some examples might help:
FOR /F "eol=; tokens=2,3* delims=, " %i in (myfile.txt) do @echo %i %j %k
would parse each line in myfile.txt, ignoring lines that begin with
a semicolon, passing the 2nd and 3rd token from each line to the for
body, with tokens delimited by commas and/or spaces. Notice the for
body statements reference %i to get the 2nd token, %j to get the
3rd token, and %k to get all remaining tokens after the 3rd. For
file names that contain spaces, you need to quote the filenames with
double quotes. In order to use double quotes in this manner, you also
need to use the usebackq option, otherwise the double quotes will be
interpreted as defining a literal string to parse.
%i is explicitly declared in the for statement and the %j and %k
are implicitly declared via the tokens= option. You can specify up
to 26 tokens via the tokens= line, provided it does not cause an
attempt to declare a variable higher than the letter 'z' or 'Z'.
Remember, FOR variables are single-letter, case sensitive, global,
and you can't have more than 52 total active at any one time.
You can also use the FOR /F parsing logic on an immediate string, by
making the file-set between the parenthesis a quoted string,
using single quote characters. It will be treated as a single line
of input from a file and parsed.
Finally, you can use the FOR /F command to parse the output of a
command. You do this by making the file-set between the
parenthesis a back quoted string. It will be treated as a command
line, which is passed to a child CMD.EXE and the output is captured
into memory and parsed as if it was a file. So the following
example:
FOR /F "usebackq delims==" %i IN (`set`) DO @echo %i
would enumerate the environment variable names in the current
environment.
In addition, substitution of FOR variable references has been enhanced.
You can now use the following optional syntax:
%~I - expands %I removing any surrounding quotes (")
%~fI - expands %I to a fully qualified path name
%~dI - expands %I to a drive letter only
%~pI - expands %I to a path only
%~nI - expands %I to a file name only
%~xI - expands %I to a file extension only
%~sI - expanded path contains short names only
%~aI - expands %I to file attributes of file
%~tI - expands %I to date/time of file
%~zI - expands %I to size of file
%~$PATH:I - searches the directories listed in the PATH
environment variable and expands %I to the
fully qualified name of the first one found.
If the environment variable name is not
defined or the file is not found by the
search, then this modifier expands to the
empty string
The modifiers can be combined to get compound results:
%~dpI - expands %I to a drive letter and path only
%~nxI - expands %I to a file name and extension only
%~fsI - expands %I to a full path name with short names only
%~dp$PATH:I - searches the directories listed in the PATH
environment variable for %I and expands to the
drive letter and path of the first one found.
%~ftzaI - expands %I to a DIR like output line
In the above examples %I and PATH can be replaced by other valid
values. The %~ syntax is terminated by a valid FOR variable name.
Picking upper case variable names like %I makes it more readable and
avoids confusion with the modifiers, which are not case sensitive.
FORMAT
Formats a disk for use with Windows.
FORMAT volume [/FS:file-system] [/V:label] [/Q] [/L[:state]] [/A:size] [/C] [/I:state] [/X] [/P:passes] [/S:state]
FORMAT volume [/V:label] [/Q] [/F:size] [/P:passes]
FORMAT volume [/V:label] [/Q] [/T:tracks /N:sectors] [/P:passes]
FORMAT volume [/V:label] [/Q] [/P:passes]
FORMAT volume [/Q]
volume Specifies the drive letter (followed by a colon),
mount point, or volume name.
/FS:filesystem Specifies the type of the file system (FAT, FAT32, exFAT,
NTFS, UDF, ReFS).
/V:label Specifies the volume label.
/Q Performs a quick format. Note that this switch overrides /P.
/C NTFS only: Files created on the new volume will be compressed
by default.
/X Forces the volume to dismount first if necessary. All opened
handles to the volume would no longer be valid.
/R:revision UDF only: Forces the format to a specific UDF version
(1.02, 1.50, 2.00, 2.01, 2.50). The default
revision is 2.01.
/D UDF 2.50 only: Metadata will be duplicated.
/L[:state] NTFS Only: Overrides the default size of file record.
By default, a non-tiered volume will be formatted with small
size file records and a tiered volume will be formatted with
large size file records. /L and /L:enable forces format to
use large size file records and /L:disable forces format to
use small size file records.
/A:size Overrides the default allocation unit size. Default settings
are strongly recommended for general use.
ReFS supports 4096, 64K.
NTFS supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
128K, 256K, 512K, 1M, 2M.
FAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
(128K, 256K for sector size > 512 bytes).
FAT32 supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
(128K, 256K for sector size > 512 bytes).
exFAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
128K, 256K, 512K, 1M, 2M, 4M, 8M, 16M, 32M.
Note that the FAT and FAT32 files systems impose the
following restrictions on the number of clusters on a volume:
FAT: Number of clusters <= 65526
FAT32: 65526 < Number of clusters < 4177918
Format will immediately stop processing if it decides that
the above requirements cannot be met using the specified
cluster size.
NTFS compression is not supported for allocation unit sizes
above 4096.
/F:size Specifies the size of the floppy disk to format (1.44)
/T:tracks Specifies the number of tracks per disk side.
/N:sectors Specifies the number of sectors per track.
/P:count Zero every sector on the volume. After that, the volume
will be overwritten "count" times using a different
random number each time. If "count" is zero, no additional
overwrites are made after zeroing every sector. This switch
is ignored when /Q is specified.
/S:state Specifies support for short filenames (enable, disable)
Short names are disabled by default
/TXF:state Specifies txf is enabled/disabled (enabled, disabled)
TxF is enabled by default
/I:state ReFS only: Specifies whether integrity should be enabled on
the new volume. "state" is either "enable" or "disable"
Integrity is enabled on storage that supports data redundancy
by default.
/DAX[:state] NTFS Only: Enable direct access storage (DAX) mode for this
volume. In DAX mode, the volume is accessed via the memory
bus, boosting IO performance. A volume can be formatted
with DAX mode only if the hardware is DAX capable.
State can specify "enable" or "disable". /DAX is considered
as /DAX:enable.
/LogSize[:size] NTFS Only: Specifies the size for NTFS log file in kilobytes.
The minimum supported size is 2MB, so specifying size smaller
than 2MB will result in a 2MB log file. Zero indicates the
default value which generally depend on the volume size.
/NoRepairLogs NTFS Only: Disables NTFS repair logs. If the flag is set
spotfix (i.e. chkdsk /spotfix) will not work.
FSMGMT.MSC
This cmd command to open Shared Folders on Windows.
FTP
Transfers files to and from a computer running an FTP server service
(sometimes called a daemon). Ftp can be used interactively.
FTP [-v] [-d] [-i] [-n] [-g] [-s:filename] [-a] [-A] [-x:sendbuffer] [-r:recvbuffer] [-b:asyncbuffers] [-w:windowsize] [host]
-v Suppresses display of remote server responses.
-n Suppresses auto-login upon initial connection.
-i Turns off interactive prompting during multiple file
transfers.
-d Enables debugging.
-g Disables filename globbing (see GLOB command).
-s:filename Specifies a text file containing FTP commands; the
commands will automatically run after FTP starts.
-a Use any local interface when binding data connection.
-A login as anonymous.
-x:send sockbuf Overrides the default SO_SNDBUF size of 8192.
-r:recv sockbuf Overrides the default SO_RCVBUF size of 8192.
-b:async count Overrides the default async count of 3
-w:windowsize Overrides the default transfer buffer size of 65535.
host Specifies the host name or IP address of the remote
host to connect to.
Notes:
- mget and mput commands take y/n/q for yes/no/quit.
- Use Control-C to abort commands.
FTYPE
Displays or modifies file types used in file extension associations
FTYPE [fileType[=[openCommandString]]]
fileType Specifies the file type to examine or change
openCommandString Specifies the open command to use when launching files
of this type.
Type FTYPE without parameters to display the current file types that
have open command strings defined. FTYPE is invoked with just a file
type, it displays the current open command string for that file type.
Specify nothing for the open command string and the FTYPE command will
delete the open command string for the file type. Within an open
command string %0 or %1 are substituted with the file name being
launched through the assocation. %* gets all the parameters and %2
gets the 1st parameter, %3 the second, etc. %~n gets all the remaining
parameters starting with the nth parameter, where n may be between 2 and 9,
inclusive. For example:
ASSOC .pl=PerlScript
FTYPE PerlScript=perl.exe %1 %*
would allow you to invoke a Perl script as follows:
script.pl 1 2 3
If you want to eliminate the need to type the extensions, then do the
following:
set PATHEXT=.pl;%PATHEXT%
and the script could be invoked as follows:
script 1 2 3
FORFILES
FORFILES [/P pathname] [/M searchmask] [/S]
[/C command] [/D [+ | -] {dd.MM.yyyy | dd}]
Description:
Selects a file (or set of files) and executes a
command on that file. This is helpful for batch jobs.
Parameter List:
/P pathname Indicates the path to start searching.
The default folder is the current working
directory (.).
/M searchmask Searches files according to a searchmask.
The default searchmask is '*' .
/S Instructs forfiles to recurse into
subdirectories. Like "DIR /S".
/C command Indicates the command to execute for each file.
Command strings should be wrapped in double
quotes.
The default command is "cmd /c echo @file".
The following variables can be used in the
command string:
@file - returns the name of the file.
@fname - returns the file name without
extension.
@ext - returns only the extension of the
file.
@path - returns the full path of the file.
@relpath - returns the relative path of the
file.
@isdir - returns "TRUE" if a file type is
a directory, and "FALSE" for files.
@fsize - returns the size of the file in
bytes.
@fdate - returns the last modified date of the
file.
@ftime - returns the last modified time of the
file.
To include special characters in the command
line, use the hexadecimal code for the character
in 0xHH format (ex. 0x09 for tab). Internal
CMD.exe commands should be preceded with
"cmd /c".
/D date Selects files with a last modified date greater
than or equal to (+), or less than or equal to
(-), the specified date using the
"dd.MM.yyyy" format; or selects files with a
last modified date greater than or equal to (+)
the current date plus "dd" days, or less than or
equal to (-) the current date minus "dd" days. A
valid "dd" number of days can be any number in
the range of 0 - 32768.
"+" is taken as default sign if not specified.
/? Displays this help message.
Examples:
FORFILES /?
FORFILES
FORFILES /P C:\WINDOWS /S /M DNS*.*
FORFILES /S /M *.txt /C "cmd /c type @file | more"
FORFILES /P C:\ /S /M *.bat
FORFILES /D -30 /M *.exe
/C "cmd /c echo @path 0x09 was changed 30 days ago"
FORFILES /D 01.01.2001
/C "cmd /c echo @fname is new since Jan 1st 2001"
FORFILES /D +11.9.2022 /C "cmd /c echo @fname is new today"
FORFILES /M *.exe /D +1
FORFILES /S /M *.doc /C "cmd /c echo @fsize"
FORFILES /M *.txt /C "cmd /c if @isdir==FALSE notepad.exe @file"
GETMAC
GETMAC [/S system [/U username [/P [password]]]] [/FO format] [/NH] [/V]
Description:
This tool enables an administrator to display the MAC address
for network adapters on a system.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under
which the command should execute.
/P [password] Specifies the password for the given
user context. Prompts for input if omitted.
/FO format Specifies the format in which the output
is to be displayed.
Valid values: "TABLE", "LIST", "CSV".
/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for TABLE and CSV formats.
/V Specifies that verbose output is displayed.
/? Displays this help message.
Examples:
GETMAC /?
GETMAC /FO csv
GETMAC /S system /NH /V
GETMAC /S system /U user
GETMAC /S system /U domain\user /P password /FO list /V
GETMAC /S system /U domain\user /P password /FO table /NH
GOTO
Directs cmd.exe to a labeled line in a batch program.
GOTO label
label Specifies a text string used in the batch program as a label.
You type a label on a line by itself, beginning with a colon.
If Command Extensions are enabled GOTO changes as follows:
GOTO command now accepts a target label of :EOF which transfers control
to the end of the current batch script file. This is an easy way to
exit a batch script file without defining a label. Type CALL /? for a
description of extensions to the CALL command that make this feature
useful.
GPEDIT.MSC
This cmd command to open Group Policy Editor on Windows.
GPRESULT
GPRESULT [/S system [/U username [/P [password]]]] [/SCOPE scope]
[/USER targetusername] [/R | /V | /Z] [(/X | /H) <filename> [/F]]
Description:
This command line tool displays the Resultant Set of Policy (RSoP)
information for a target user and computer.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which the
command should run.
Can not be used with /X, /H.
/P [password] Specifies the password for the given user
context. Prompts for input if omitted.
Cannot be used with /X, /H.
/SCOPE scope Specifies whether the user or the
computer settings need to be displayed.
Valid values: "USER", "COMPUTER".
/USER [domain\]user Specifies the user name for which the
RSoP data is to be displayed.
/X <filename> Saves the report in XML format at the
location and with the file name specified
by the <filename> parameter. (valid in Windows
Vista SP1 and later and Windows Server 2008 and later)
/H <filename> Saves the report in HTML format at the
location and with the file name specified by
the <filename> parameter. (valid in Windows
at least Vista SP1 and at least Windows Server 2008)
/F Forces Gpresult to overwrite the file name
specified in the /X or /H command.
/R Displays RSoP summary data.
/V Specifies that verbose information should
be displayed. Verbose information provides
additional detailed settings that have
been applied with a precedence of 1.
/Z Specifies that the super-verbose
information should be displayed. Super-
verbose information provides additional
detailed settings that have been applied
with a precedence of 1 and higher. This
allows you to see if a setting was set in
multiple places. See the Group Policy
online help topic for more information.
/? Displays this help message.
Examples:
GPRESULT /R
GPRESULT /H GPReport.html
GPRESULT /USER targetusername /V
GPRESULT /S system /USER targetusername /SCOPE COMPUTER /Z
GPRESULT /S system /U username /P password /SCOPE USER /V
GPUPDATE
Description: Updates multiple Group Policy settings.
Syntax: Gpupdate [/Target:{Computer | User}] [/Force] [/Wait:<value>]
[/Logoff] [/Boot] [/Sync]
Parameters:
Value Description
/Target:{Computer | User} Specifies that only User or only Computer
policy settings are updated. By default,
both User and Computer policy settings are
updated.
/Force Reapplies all policy settings. By default,
only policy settings that have changed are
applied.
/Wait:{value} Sets the number of seconds to wait for policy
processing to finish. The default is 600
seconds. The value '0' means not to wait.
The value '-1' means to wait indefinitely.
When the time limit is exceeded, the command
prompt returns, but policy processing
continues.
/Logoff Causes a logoff after the Group Policy settings
have been updated. This is required for
those Group Policy client-side extensions
that do not process policy on a background
update cycle but do process policy when a
user logs on. Examples include user-targeted
Software Installation and Folder Redirection.
This option has no effect if there are no
extensions called that require a logoff.
/Boot Causes a computer restart after the Group Policy settings
are applied. This is required for those
Group Policy client-side extensions that do
not process policy on a background update cycle
but do process policy at computer startup.
Examples include computer-targeted Software
Installation. This option has no effect if
there are no extensions called that require
a restart.
/Sync Causes the next foreground policy application to
be done synchronously. Foreground policy
applications occur at computer start up and user
logon. You can specify this for the user,
computer or both using the /Target parameter.
The /Force and /Wait parameters will be ignored
if specified.
GPUPDATE
Description: Updates multiple Group Policy settings.
Syntax: Gpupdate [/Target:{Computer | User}] [/Force] [/Wait:<value>]
[/Logoff] [/Boot] [/Sync]
Parameters:
Value Description
/Target:{Computer | User} Specifies that only User or only Computer
policy settings are updated. By default,
both User and Computer policy settings are
updated.
/Force Reapplies all policy settings. By default,
only policy settings that have changed are
applied.
/Wait:{value} Sets the number of seconds to wait for policy
processing to finish. The default is 600
seconds. The value '0' means not to wait.
The value '-1' means to wait indefinitely.
When the time limit is exceeded, the command
prompt returns, but policy processing
continues.
/Logoff Causes a logoff after the Group Policy settings
have been updated. This is required for
those Group Policy client-side extensions
that do not process policy on a background
update cycle but do process policy when a
user logs on. Examples include user-targeted
Software Installation and Folder Redirection.
This option has no effect if there are no
extensions called that require a logoff.
/Boot Causes a computer restart after the Group Policy settings
are applied. This is required for those
Group Policy client-side extensions that do
not process policy on a background update cycle
but do process policy at computer startup.
Examples include computer-targeted Software
Installation. This option has no effect if
there are no extensions called that require
a restart.
/Sync Causes the next foreground policy application to
be done synchronously. Foreground policy
applications occur at computer start up and user
logon. You can specify this for the user,
computer or both using the /Target parameter.
The /Force and /Wait parameters will be ignored
if specified.
HDWWIZ.CPL
This cmd command to open Add Hardware on Windows.
HELP
For more information on a specific command, type HELP command-name
Etc.
$help
$help <command>
HOSTNAME
Prints the name of the current host.
hostname
IEXPRESS.EXE
This cmd command to open IExpress Wizard on Windows.
IF
Performs conditional processing in batch programs.
IF [NOT] ERRORLEVEL number command
IF [NOT] string1==string2 command
IF [NOT] EXIST filename command
NOT Specifies that Windows should carry out
the command only if the condition is false.
ERRORLEVEL number Specifies a true condition if the last program run
returned an exit code equal to or greater than the number
specified.
string1==string2 Specifies a true condition if the specified text strings
match.
EXIST filename Specifies a true condition if the specified filename
exists.
command Specifies the command to carry out if the condition is
met. Command can be followed by ELSE command which
will execute the command after the ELSE keyword if the
specified condition is FALSE
The ELSE clause must occur on the same line as the command after the IF. For
example:
IF EXIST filename. (
del filename.
) ELSE (
echo filename. missing.
)
The following would NOT work because the del command needs to be terminated
by a newline:
IF EXIST filename. del filename. ELSE echo filename. missing
Nor would the following work, since the ELSE command must be on the same line
as the end of the IF command:
IF EXIST filename. del filename.
ELSE echo filename. missing
The following would work if you want it all on one line:
IF EXIST filename. (del filename.) ELSE echo filename. missing
If Command Extensions are enabled IF changes as follows:
IF [/I] string1 compare-op string2 command
IF CMDEXTVERSION number command
IF DEFINED variable command
where compare-op may be one of:
EQU - equal
NEQ - not equal
LSS - less than
LEQ - less than or equal
GTR - greater than
GEQ - greater than or equal
and the /I switch, if specified, says to do case insensitive string
compares. The /I switch can also be used on the string1==string2 form
of IF. These comparisons are generic, in that if both string1 and
string2 are both comprised of all numeric digits, then the strings are
converted to numbers and a numeric comparison is performed.
The CMDEXTVERSION conditional works just like ERRORLEVEL, except it is
comparing against an internal version number associated with the Command
Extensions. The first version is 1. It will be incremented by one when
significant enhancements are added to the Command Extensions.
CMDEXTVERSION conditional is never true when Command Extensions are
disabled.
The DEFINED conditional works just like EXIST except it takes an
environment variable name and returns true if the environment variable
is defined.
%ERRORLEVEL% will expand into a string representation of
the current value of ERRORLEVEL, provided that there is not already
an environment variable with the name ERRORLEVEL, in which case you
will get its value instead. After running a program, the following
illustrates ERRORLEVEL use:
goto answer%ERRORLEVEL%
:answer0
echo Program had return code 0
:answer1
echo Program had return code 1
You can also use numerical comparisons above:
IF %ERRORLEVEL% LEQ 1 goto okay
%CMDCMDLINE% will expand into the original command line passed to
CMD.EXE prior to any processing by CMD.EXE, provided that there is not
already an environment variable with the name CMDCMDLINE, in which case
you will get its value instead.
%CMDEXTVERSION% will expand into a string representation of the
current value of CMDEXTVERSION, provided that there is not already
an environment variable with the name CMDEXTVERSION, in which case you
will get its value instead.
INETCPL.CPL
This cmd command to open Internet Properties on Windows.
INTL.CPL
This cmd command to open Region on Windows.
IPCONFIG
USAGE:
ipconfig [/allcompartments] [/? | /all |
/renew [adapter] | /release [adapter] |
/renew6 [adapter] | /release6 [adapter] |
/flushdns | /displaydns | /registerdns |
/showclassid adapter |
/setclassid adapter [classid] |
/showclassid6 adapter |
/setclassid6 adapter [classid] ]
where
adapter Connection name
(wildcard characters * and ? allowed, see examples)
Options:
/? Display this help message
/all Display full configuration information.
/release Release the IPv4 address for the specified adapter.
/release6 Release the IPv6 address for the specified adapter.
/renew Renew the IPv4 address for the specified adapter.
/renew6 Renew the IPv6 address for the specified adapter.
/flushdns Purges the DNS Resolver cache.
/registerdns Refreshes all DHCP leases and re-registers DNS names
/displaydns Display the contents of the DNS Resolver Cache.
/showclassid Displays all the dhcp class IDs allowed for adapter.
/setclassid Modifies the dhcp class id.
/showclassid6 Displays all the IPv6 DHCP class IDs allowed for adapter.
/setclassid6 Modifies the IPv6 DHCP class id.
The default is to display only the IP address, subnet mask and
default gateway for each adapter bound to TCP/IP.
For Release and Renew, if no adapter name is specified, then the IP address
leases for all adapters bound to TCP/IP will be released or renewed.
For Setclassid and Setclassid6, if no ClassId is specified, then the ClassId is removed.
Examples:
> ipconfig ... Show information
> ipconfig /all ... Show detailed information
> ipconfig /renew ... renew all adapters
> ipconfig /renew EL* ... renew any connection that has its
name starting with EL
> ipconfig /release *Con* ... release all matching connections,
eg. "Wired Ethernet Connection 1" or
"Wired Ethernet Connection 2"
> ipconfig /allcompartments ... Show information about all
compartments
> ipconfig /allcompartments /all ... Show detailed information about all
compartments
JOY.CPL
This cmd command to open Game Controllers on Windows.
LABEL
Access Denied as you do not have sufficient privileges or
the disk may be locked by another process.
You have to invoke this utility running in elevated mode
and make sure the disk is unlocked.
LOGOFF
LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V] [/VM]
sessionname The name of the session.
sessionid The ID of the session.
/SERVER:servername Specifies the Remote Desktop server containing the user
session to log off (default is current).
/V Displays information about the actions performed.
/VM Logs off a session on server or within virtual machine. The unique ID of the session needs to be specified.
MAGNIFY.EXE
This cmd command to open Magnifier on Windows.
MAIN.CPL
This cmd command to open Mouse Properties on Windows.
MKDIR
Creates a directory.
MKDIR [drive:]path
MD [drive:]path
If Command Extensions are enabled MKDIR changes as follows:
MKDIR creates any intermediate directories in the path, if needed.
For example, assume \a does not exist then:
mkdir \a\b\c\d
is the same as:
mkdir \a
chdir \a
mkdir b
chdir b
mkdir c
chdir c
mkdir d
which is what you would have to type if extensions were disabled.
MKLINK
Creates a symbolic link.
MKLINK [[/D] | [/H] | [/J]] Link Target
/D Creates a directory symbolic link. Default is a file
symbolic link.
/H Creates a hard link instead of a symbolic link.
/J Creates a Directory Junction.
Link Specifies the new symbolic link name.
Target Specifies the path (relative or absolute) that the new link
refers to.
MMSYS.CPL
This cmd command to open Sound Settings on Windows.
MOBSYNC.EXE
This cmd command to open Sync Center on Windows.
MODE
Configures system devices.
Serial port: MODE COMm[:] [BAUD=b] [PARITY=p] [DATA=d] [STOP=s]
[to=on|off] [xon=on|off] [odsr=on|off]
[octs=on|off] [dtr=on|off|hs]
[rts=on|off|hs|tg] [idsr=on|off]
Device Status: MODE [device] [/STATUS]
Redirect printing: MODE LPTn[:]=COMm[:]
Select code page: MODE CON[:] CP SELECT=yyy
Code page status: MODE CON[:] CP [/STATUS]
Display mode: MODE CON[:] [COLS=c] [LINES=n]
Typematic rate: MODE CON[:] [RATE=r DELAY=d]
MORE
Displays output one screen at a time.
MORE [/E [/C] [/P] [/S] [/Tn] [+n]] < [drive:][path]filename
command-name | MORE [/E [/C] [/P] [/S] [/Tn] [+n]]
MORE /E [/C] [/P] [/S] [/Tn] [+n] [files]
[drive:][path]filename Specifies a file to display one
screen at a time.
command-name Specifies a command whose output
will be displayed.
/E Enable extended features
/C Clear screen before displaying page
/P Expand FormFeed characters
/S Squeeze multiple blank lines into a single line
/Tn Expand tabs to n spaces (default 8)
Switches can be present in the MORE environment
variable.
+n Start displaying the first file at line n
files List of files to be displayed. Files in the list
are separated by blanks.
If extended features are enabled, the following commands
are accepted at the -- More -- prompt:
P n Display next n lines
S n Skip next n lines
F Display next file
Q Quit
= Show line number
? Show help line
<space> Display next page
<ret> Display next line
MOUNTVOL
Creates, deletes, or lists a volume mount point.
MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E
MOUNTVOL drive: /S
path Specifies the existing NTFS directory where the mount
point will reside.
VolumeName Specifies the volume name that is the target of the mount
point.
/D Removes the volume mount point from the specified directory.
/L Lists the mounted volume name for the specified directory.
/P Removes the volume mount point from the specified directory,
dismounts the volume, and makes the volume not mountable.
You can make the volume mountable again by creating a volume
mount point.
/R Removes volume mount point directories and registry settings
for volumes that are no longer in the system.
/N Disables automatic mounting of new volumes.
/E Re-enables automatic mounting of new volumes.
/S Mount the EFI System Partition on the given drive.
Possible values for VolumeName along with current mount points are:
\\?\Volume{153520a2-4226-4a4b-81c2-ecb1eaddf224}\
C:\
\\?\Volume{e4e66d56-8432-4538-97c6-aa70af8f8d55}\
*** NO MOUNT POINTS ***
\\?\Volume{761f187e-7baf-4f40-81b5-c24357b26256}\
*** NO MOUNT POINTS ***
MOVE
Moves files and renames files and directories.
To move one or more files:
MOVE [/Y | /-Y] [drive:][path]filename1[,...] destination
To rename a directory:
MOVE [/Y | /-Y] [drive:][path]dirname1 dirname2
[drive:][path]filename1 Specifies the location and name of the file
or files you want to move.
destination Specifies the new location of the file. Destination
can consist of a drive letter and colon, a
directory name, or a combination. If you are moving
only one file, you can also include a filename if
you want to rename the file when you move it.
[drive:][path]dirname1 Specifies the directory you want to rename.
dirname2 Specifies the new name of the directory.
/Y Suppresses prompting to confirm you want to
overwrite an existing destination file.
/-Y Causes prompting to confirm you want to overwrite
an existing destination file.
The switch /Y may be present in the COPYCMD environment variable.
This may be overridden with /-Y on the command line. Default is
to prompt on overwrites unless MOVE command is being executed from
within a batch script.
MSCONFIG.EXE
This cmd command to open System Configuration on Windows.
MSG
Send a message to a user.
MSG {username | sessionname | sessionid | @filename | *}
[/SERVER:servername] [/TIME:seconds] [/V] [/W] [message]
username Identifies the specified username.
sessionname The name of the session.
sessionid The ID of the session.
@filename Identifies a file containing a list of usernames,
sessionnames, and sessionids to send the message to.
* Send message to all sessions on specified server.
/SERVER:servername server to contact (default is current).
/TIME:seconds Time delay to wait for receiver to acknowledge msg.
/V Display information about actions being performed.
/W Wait for response from user, useful with /V.
message Message to send. If none specified, prompts for it
or reads from stdin.
MSHTA
Mshta command is a Windows-native binary designed to execute Microsoft HTML Application (HTA) files.
With this command, run JavaScript or VBA on Windows.
Etc.
$ mshta javascript:alert("hi");close()
MSIEXEC
msiexec /Option <Required Parameter> [Optional Parameter]
Install Options
</package | /i> <Product.msi>
Installs or configures a product
/a <Product.msi>
Administrative install - Installs a product on the network
/j<u|m> <Product.msi> [/t <Transform List>] [/g <Language ID>]
Advertises a product - m to all users, u to current user
</uninstall | /x> <Product.msi | ProductCode>
Uninstalls the product
Display Options
/quiet
Quiet mode, no user interaction
/passive
Unattended mode - progress bar only
/q[n|b|r|f]
Sets user interface level
n - No UI
b - Basic UI
r - Reduced UI
f - Full UI (default)
/help
Help information
Restart Options
/norestart
Do not restart after the installation is complete
/promptrestart
Prompts the user for restart if necessary
/forcerestart
Always restart the computer after installation
Logging Options
/l[i|w|e|a|r|u|c|m|o|p|v|x|+|!|*] <LogFile>
i - Status messages
w - Nonfatal warnings
e - All error messages
a - Start up of actions
r - Action-specific records
u - User requests
c - Initial UI parameters
m - Out-of-memory or fatal exit information
o - Out-of-disk-space messages
p - Terminal properties
v - Verbose output
x - Extra debugging information
+ - Append to existing log file
! - Flush each line to the log
* - Log all information, except for v and x options
/log <LogFile>
Equivalent of /l* <LogFile>
Update Options
/update <Update1.msp>[;Update2.msp]
Applies update(s)
/uninstall <PatchCodeGuid>[;Update2.msp] /package <Product.msi | ProductCode>
Remove update(s) for a product
Repair Options
/f[p|e|c|m|s|o|d|a|u|v] <Product.msi | ProductCode>
Repairs a product
p - only if file is missing
o - if file is missing or an older version is installed (default)
e - if file is missing or an equal or older version is installed
d - if file is missing or a different version is installed
c - if file is missing or checksum does not match the calculated value
a - forces all files to be reinstalled
u - all required user-specific registry entries (default)
m - all required computer-specific registry entries (default)
s - all existing shortcuts (default)
v - runs from source and recaches local package
Setting Public Properties
[PROPERTY=PropertyValue]
MSINFO32
This cmd command to open System Information on Windows.
MSPAINT.EXE
This cmd command to open Paint on Windows.
MSTSC
This cmd command to open Remote Desktop Connection on Windows.
NARRATOR.EXE
This cmd command to open Narrator on Windows.
NETSH
Usage: NETSH [-a AliasFile] [-c Context] [-r RemoteMachine] [-u [DomainName\]UserName] [-p Password | *]
[Command | -f ScriptFile]
The following commands are available:
Commands in this context:
? - Displays a list of commands.
add - Adds a configuration entry to a list of entries.
advfirewall - Changes to the `netsh advfirewall' context.
branchcache - Changes to the `netsh branchcache' context.
bridge - Changes to the `netsh bridge' context.
delete - Deletes a configuration entry from a list of entries.
dhcpclient - Changes to the `netsh dhcpclient' context.
dnsclient - Changes to the `netsh dnsclient' context.
dump - Displays a configuration script.
exec - Runs a script file.
firewall - Changes to the `netsh firewall' context.
help - Displays a list of commands.
http - Changes to the `netsh http' context.
interface - Changes to the `netsh interface' context.
ipsec - Changes to the `netsh ipsec' context.
lan - Changes to the `netsh lan' context.
mbn - Changes to the `netsh mbn' context.
namespace - Changes to the `netsh namespace' context.
netio - Changes to the `netsh netio' context.
p2p - Changes to the `netsh p2p' context.
ras - Changes to the `netsh ras' context.
rpc - Changes to the `netsh rpc' context.
set - Updates configuration settings.
show - Displays information.
trace - Changes to the `netsh trace' context.
wcn - Changes to the `netsh wcn' context.
wfp - Changes to the `netsh wfp' context.
winhttp - Changes to the `netsh winhttp' context.
winsock - Changes to the `netsh winsock' context.
wlan - Changes to the `netsh wlan' context.
The following sub-contexts are available:
advfirewall branchcache bridge dhcpclient dnsclient firewall http interface ipsec lan mbn namespace netio p2p ras rpc trace wcn wfp winhttp winsock wlan
To view help for a command, type the command, followed by a space, and then
type ?.
NETSTAT
Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [-x] [-y] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-f Displays Fully Qualified Domain Names (FQDN) for foreign
addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-q Displays all connections, listening ports, and bound
nonlistening TCP ports. Bound nonlistening ports may or may not
be associated with an active connection.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
-t Displays the current connection offload state.
-x Displays NetworkDirect connections, listeners, and shared
endpoints.
-y Displays the TCP connection template for all connections.
Cannot be combined with the other options.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.
NSLOOKUP
Usage:
nslookup [-opt ...] # interactive mode using default server
nslookup [-opt ...] - server # interactive mode using 'server'
nslookup [-opt ...] host # just look up 'host' using default server
nslookup [-opt ...] host server # just look up 'host' using 'server'
ODBCAD32.EXE
This cmd command to open ODBC Data Source Administrator on Windows.
OPENFILES
OPENFILES /parameter [arguments]
Description:
Enables an administrator to list or disconnect files and folders
that have been opened on a system.
Parameter List:
/Disconnect Disconnects one or more open files.
/Query Displays files opened locally or from shared
folders.
/Local Enables / Disables the display of local open files.
/? Displays this help message.
Examples:
OPENFILES /Disconnect /?
OPENFILES /Query /?
OPENFILES /Local /?
OSK.EXE
This cmd command to open On-Screen Keyboard on Windows.
PATH
Displays or sets a search path for executable files.
PATH [[drive:]path[;...][;%PATH%]
PATH ;
Type PATH ; to clear all search-path settings and direct cmd.exe to search
only in the current directory.
Type PATH without parameters to display the current path.
Including %PATH% in the new path setting causes the old path to be
appended to the new setting.
PATHPING
Usage: pathping [-g host-list] [-h maximum_hops] [-i address] [-n]
[-p period] [-q num_queries] [-w timeout]
[-4] [-6] target_name
Options:
-g host-list Loose source route along host-list.
-h maximum_hops Maximum number of hops to search for target.
-i address Use the specified source address.
-n Do not resolve addresses to hostnames.
-p period Wait period milliseconds between pings.
-q num_queries Number of queries per hop.
-w timeout Wait timeout milliseconds for each reply.
-4 Force using IPv4.
-6 Force using IPv6.
PAUSE
Suspends processing of a batch program and displays the message
Press any key to continue . . .
PERFMON
This cmd command to open Performance Monitor on Windows.
PING
Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
[-r count] [-s count] [[-j host-list] | [-k host-list]]
[-w timeout] [-R] [-S srcaddr] [-c compartment] [-p]
[-4] [-6] target_name
Options:
-t Ping the specified host until stopped.
To see statistics and continue - type Control-Break;
To stop - type Control-C.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don't Fragment flag in packet (IPv4-only).
-i TTL Time To Live.
-v TOS Type Of Service (IPv4-only. This setting has been deprecated
and has no effect on the type of service field in the IP
Header).
-r count Record route for count hops (IPv4-only).
-s count Timestamp for count hops (IPv4-only).
-j host-list Loose source route along host-list (IPv4-only).
-k host-list Strict source route along host-list (IPv4-only).
-w timeout Timeout in milliseconds to wait for each reply.
-R Use routing header to test reverse route also (IPv6-only).
Per RFC 5095 the use of this routing header has been
deprecated. Some systems may drop echo requests if
this header is used.
-S srcaddr Source address to use.
-c compartment Routing compartment identifier.
-p Ping a Hyper-V Network Virtualization provider address.
-4 Force using IPv4.
-6 Force using IPv6.
POWERCFG
POWERCFG /COMMAND [ARGUMENTS]
Description:
Enables users to control power settings on a local system.
For detailed command and option information, run "POWERCFG /? <COMMAND>"
Command List:
/LIST, /L Lists all power schemes.
/QUERY, /Q Displays the contents of a power scheme.
/CHANGE, /X Modifies a setting value in the current power scheme.
/CHANGENAME Modifies the name and description of a power scheme.
/DUPLICATESCHEME Duplicates a power scheme.
/DELETE, /D Deletes a power scheme.
/DELETESETTING Deletes a power setting.
/SETACTIVE, /S Makes a power scheme active on the system.
/GETACTIVESCHEME Retrieves the currently active power scheme.
/SETACVALUEINDEX Sets the value associated with a power setting
while the system is powered by AC power.
/SETDCVALUEINDEX Sets the value associated with a power setting
while the system is powered by DC power.
/IMPORT Imports all power settings from a file.
/EXPORT Exports a power scheme to a file.
/ALIASES Displays all aliases and their corresponding GUIDs.
/GETSECURITYDESCRIPTOR
Gets a security descriptor associated with a specified
power setting, power scheme, or action.
/SETSECURITYDESCRIPTOR
Sets a security descriptor associated with a
power setting, power scheme, or action.
/HIBERNATE, /H Enables and disables the hibernate feature.
/AVAILABLESLEEPSTATES, /A
Reports the sleep states available on the system.
/DEVICEQUERY Returns a list of devices that meet specified criteria.
/DEVICEENABLEWAKE Enables a device to wake the system from a sleep state.
/DEVICEDISABLEWAKE Disables a device from waking the system from a sleep
state.
/LASTWAKE Reports information about what woke the system from the
last sleep transition.
/WAKETIMERS Enumerates active wake timers.
/REQUESTS Enumerates application and driver Power Requests.
/REQUESTSOVERRIDE Sets a Power Request override for a particular Process,
Service, or Driver.
/ENERGY Analyzes the system for common energy-efficiency and
battery life problems.
/BATTERYREPORT Generates a report of battery usage.
/SLEEPSTUDY Generates a diagnostic system power transition report.
/SRUMUTIL Dumps Energy Estimation data from System Resource Usage
Monitor (SRUM).
/SYSTEMSLEEPDIAGNOSTICS
Generates a diagnostic report of system sleep transitions.
/SYSTEMPOWERREPORT Generates a diagnostic system power transition report.
/POWERTHROTTLING Control power throttling for an application.
PRINT
Prints a text file.
PRINT [/D:device] [[drive:][path]filename[...]]
/D:device Specifies a print device.
PROMPT
Changes the cmd.exe command prompt.
PROMPT [text]
text Specifies a new command prompt.
Prompt can be made up of normal characters and the following special codes:
$A & (Ampersand)
$B | (pipe)
$C ( (Left parenthesis)
$D Current date
$E Escape code (ASCII code 27)
$F ) (Right parenthesis)
$G > (greater-than sign)
$H Backspace (erases previous character)
$L < (less-than sign)
$N Current drive
$P Current drive and path
$Q = (equal sign)
$S (space)
$T Current time
$V Windows version number
$_ Carriage return and linefeed
$$ $ (dollar sign)
If Command Extensions are enabled the PROMPT command supports
the following additional formatting characters:
$+ zero or more plus sign (+) characters depending upon the
depth of the PUSHD directory stack, one character for each
level pushed.
$M Displays the remote name associated with the current drive
letter or the empty string if current drive is not a network
drive.
POWERSHELL
This cmd command call Powershell.
RASPHONE.EXE
This cmd command to open Network Connections on Windows.
RD
Removes (deletes) a directory.
RMDIR [/S] [/Q] [drive:]path
RD [/S] [/Q] [drive:]path
/S Removes all directories and files in the specified directory
in addition to the directory itself. Used to remove a directory
tree.
/Q Quiet mode, do not ask if ok to remove a directory tree with /S
RECOVER
Recovers readable information from a bad or defective disk.
RECOVER [drive:][path]filename
Consult the online Command Reference in Windows Help
before using the RECOVER command.
REG
REG Operation [Parameter List]
Operation [ QUERY | ADD | DELETE | COPY |
SAVE | LOAD | UNLOAD | RESTORE |
COMPARE | EXPORT | IMPORT | FLAGS ]
Return Code: (Except for REG COMPARE)
0 - Successful
1 - Failed
For help on a specific operation type:
REG Operation /?
Examples:
REG QUERY /?
REG ADD /?
REG DELETE /?
REG COPY /?
REG SAVE /?
REG RESTORE /?
REG LOAD /?
REG UNLOAD /?
REG COMPARE /?
REG EXPORT /?
REG IMPORT /?
REG FLAGS /?
REGEDIT
This cmd command to open Registry Editor on Windows.
REGINI
usage: REGINI [-m \\machinename | -h hivefile hiveroot]
[-i n] [-o outputWidth]
[-b] textFiles...
where: -m specifies a remote Windows NT machine whose registry is to be manipulated.
-h specifies a specify local hive to manipulate.
-i n specifies the display indentation multiple. Default is 4
-o outputWidth specifies how wide the output is to be. By default the
outputWidth is set to the width of the console window if standard
output has not been redirected to a file. In the latter case, an
outputWidth of 240 is used.
-b specifies that REGINI should be backward compatible with older
versions of REGINI that did not strictly enforce line continuations
and quoted strings Specifically, REG_BINARY, REG_RESOURCE_LIST and
REG_RESOURCE_REQUIREMENTS_LIST data types did not need line
continuations after the first number that gave the size of the data.
It just kept looking on following lines until it found enough data
values to equal the data length or hit invalid input. Quoted
strings were only allowed in REG_MULTI_SZ. They could not be
specified around key or value names, or around values for REG_SZ or
REG_EXPAND_SZ Finally, the old REGINI did not support the semicolon
as an end of line comment character.
textFiles is one or more ANSI or Unicode text files with registry data.
Some general rules are:
Semicolon character is an end-of-line comment character, provided it
is the first non-blank character on a line
Backslash character is a line continuation character. All
characters from the backslash up to but not including the first
non-blank character of the next line are ignored. If there is more
than one space before the line continuation character, it is
replaced by a single space.
Indentation is used to indicate the tree structure of registry keys
The REGDMP program uses indentation in multiples of 4. You may use
hard tab characters for indentation, but embedded hard tab
characters are converted to a single space regardless of their
position
Values should come before child keys, as they are associated with
the previous key at or above the value's indentation level.
For key names, leading and trailing space characters are ignored and
not included in the key name, unless the key name is surrounded by
quotes. Imbedded spaces are part of a key name.
Key names can be followed by an Access Control List (ACL) which is a
series of decimal numbers, separated by spaces, bracketed by a
square brackets (e.g. [8 4 17]). The valid numbers and their
meanings are:
1 - Administrators Full Access
2 - Administrators Read Access
3 - Administrators Read and Write Access
4 - Administrators Read, Write and Delete Access
5 - Creator Full Access
6 - Creator Read and Write Access
7 - World Full Access
8 - World Read Access
9 - World Read and Write Access
10 - World Read, Write and Delete Access
11 - Power Users Full Access
12 - Power Users Read and Write Access
13 - Power Users Read, Write and Delete Access
14 - System Operators Full Access
15 - System Operators Read and Write Access
16 - System Operators Read, Write and Delete Access
17 - System Full Access
18 - System Read and Write Access
19 - System Read Access
20 - Administrators Read, Write and Execute Access
21 - Interactive User Full Access
22 - Interactive User Read and Write Access
23 - Interactive User Read, Write and Delete Access
If there is an equal sign on the same line as a left square bracket
then the equal sign takes precedence, and the line is treated as a
registry value. If the text between the square brackets is the
string DELETE with no spaces, then REGINI will delete the key and
any values and keys under it.
For registry values, the syntax is:
value Name = type data
Leading spaces, spaces on either side of the equal sign and spaces
between the type keyword and data are ignored, unless the value name
is surrounded by quotes. If the text to the right of the equal sign
is the string DELETE, then REGINI will delete the value.
The value name may be left off or be specified by an at-sign
character which is the same thing, namely the empty value name. So
the following two lines are identical:
= type data
@ = type data
This syntax means that you can't create a value with leading or
trailing spaces, an equal sign or an at-sign in the value name,
unless you put the name in quotes.
Valid value types and format of data that follows are:
REG_SZ text
REG_EXPAND_SZ text
REG_MULTI_SZ "string1" "str""ing2" ...
REG_DATE mm/dd/yyyy HH:MM DayOfWeek
REG_DWORD numberDWORD
REG_BINARY numberOfBytes numberDWORD(s)...
REG_NONE (same format as REG_BINARY)
REG_RESOURCE_LIST (same format as REG_BINARY)
REG_RESOURCE_REQUIREMENTS (same format as REG_BINARY)
REG_RESOURCE_REQUIREMENTS_LIST (same format as REG_BINARY)
REG_FULL_RESOURCE_DESCRIPTOR (same format as REG_BINARY)
REG_QWORD numberQWORD
REG_MULTISZ_FILE fileName
REG_BINARYFILE fileName
If no value type is specified, default is REG_SZ
For REG_SZ and REG_EXPAND_SZ, if you want leading or trailing spaces
in the value text, surround the text with quotes. The value text
can contain any number of imbedded quotes, and REGINI will ignore
them, as it only looks at the first and last character for quote
characters.
For REG_MULTI_SZ, each component string is surrounded by quotes. If
you want an imbedded quote character, then double quote it, as in
string2 above.
For REG_BINARY, the value data consists of one or more numbers The
default base for numbers is decimal. Hexidecimal may be specified
by using 0x prefix. The first number is the number of data bytes,
excluding the first number. After the first number must come enough
numbers to fill the value. Each number represents one DWORD or 4
bytes. So if the first number was 0x5 you would need two more
numbers after that to fill the 5 bytes. The high order 3 bytes
of the second DWORD would be ignored.
Whenever specifying a registry path, either on the command line
or in an input file, the following prefix strings can be used:
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_USER
USER:
Each of these strings can stand alone as the key name or be followed
a backslash and a subkey path.
REGSVR32
Regsvr32 command is a utility to register and unregister OLE controls, such as DLLs and ActiveX controls in the Windows Registry.
REM
Records comments (remarks) in a batch file or CONFIG.SYS.
REM [comment]
REN
Renames a file or files.
RENAME [drive:][path]filename1 filename2.
REN [drive:][path]filename1 filename2.
Note that you cannot specify a new drive or path for your destination file.
RENAME
Renames a file or files.
RENAME [drive:][path]filename1 filename2.
REN [drive:][path]filename1 filename2.
Note that you cannot specify a new drive or path for your destination file.
REPAIR-BDE
BitLocker Drive Encryption: Repair Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
Usage:
repair-bde[.exe] InputVolume
{ OutputVolumeOrImage }
{ {-RecoveryPassword|-rp} NumericalPassword |
{-RecoveryKey|-rk} PathToExternalKeyFile |
{-Password|-pw} }
[{-KeyPackage|-kp} PathToKeyPackage]
[{-LogFile|-lf} PathToLogFile]
[{-?|/?}]
Description:
Attempts to repair or decrypt a damaged BitLocker-encrypted volume using the
supplied recovery information. If BitLocker was in the process of encryption
or decryption or had been suspended prior to volume failure a clear key will
be present on the volume. Repair-bde attempts to use this clear key by
default if another key is not specified.
WARNING! To avoid additional data loss, you should have a spare hard drive
available. Use this spare drive to store decrypted output or to back up the
contents of the damaged volume.
Parameters:
InputVolume
The BitLocker-encrypted volume to repair.
Example: "C:",
"\\?\Volume{26a21bda-a627-11d7-9931-806e6f6e6963}".
OutputVolumeOrImage
The volume to store decrypted contents, or the file
location to create an image file of the contents.
Examples: "D:", "D:\imagefile.img".
WARNING! All information on this output volume will be
overwritten.
-rk or -RecoveryKey
Provide an external key to unlock the volume.
Example: "F:\RecoveryKey.bek".
-rp or -RecoveryPassword
Provide a numerical password to unlock the volume.
Example: "111111-222222-333333-...".
-pw or -Password
Provide a password to unlock the volume.
-kp or -KeyPackage
Optional. Provide a key package to unlock the volume.
Example: "F:\ExportedKeyPackage"
If this option is blank, the tool will look for the key package
automatically. This option is needed only if required by the tool.
-lf or -LogFile
Optional. Provide a path to a file that will store progress
information. Example: "F:\log.txt".
-f or -Force
Optional. When used, forces a volume to be dismounted even if
it cannot be locked. This option is needed only if required by
the tool.
-? or /?
Shows this screen.
Examples:
repair-bde C: D: -rk F:\RecoveryKey.bek -Force
repair-bde C: D: -rp 111111-222222-[...] -lf F:\log.txt
repair-bde C: D: -kp F:\KeyPackage -rp 111111-222222-[...]
repair-bde C: D:\imagefile.img -kp F:\KeyPackage -rk F:\RecoveryKey.bek
repair-bde C: D: -pw
REPLACE
Replaces files.
REPLACE [drive1:][path1]filename [drive2:][path2] [/A] [/P] [/R] [/W]
REPLACE [drive1:][path1]filename [drive2:][path2] [/P] [/R] [/S] [/W] [/U]
[drive1:][path1]filename Specifies the source file or files.
[drive2:][path2] Specifies the directory where files are to be
replaced.
/A Adds new files to destination directory. Cannot
use with /S or /U switches.
/P Prompts for confirmation before replacing a file or
adding a source file.
/R Replaces read-only files as well as unprotected
files.
/S Replaces files in all subdirectories of the
destination directory. Cannot use with the /A
switch.
/W Waits for you to insert a disk before beginning.
/U Replaces (updates) only files that are older than
source files. Cannot use with the /A switch.
RMDIR
Removes (deletes) a directory.
RMDIR [/S] [/Q] [drive:]path
RD [/S] [/Q] [drive:]path
/S Removes all directories and files in the specified directory
in addition to the directory itself. Used to remove a directory
tree.
/Q Quiet mode, do not ask if ok to remove a directory tree with /S
ROBOCOPY
-------------------------------------------------------------------------------
ROBOCOPY :: Robust File Copy for Windows
-------------------------------------------------------------------------------
Started : 11 Eylül 2022 Pazar 10:09:18
Usage :: ROBOCOPY source destination [file [file]...] [options]
source :: Source Directory (drive:\path or \\server\share\path).
destination :: Destination Dir (drive:\path or \\server\share\path).
file :: File(s) to copy (names/wildcards: default is "*.*").
::
:: Copy options :
::
/S :: copy Subdirectories, but not empty ones.
/E :: copy subdirectories, including Empty ones.
/LEV:n :: only copy the top n LEVels of the source directory tree.
/Z :: copy files in restartable mode.
/B :: copy files in Backup mode.
/ZB :: use restartable mode; if access denied use Backup mode.
/J :: copy using unbuffered I/O (recommended for large files).
/EFSRAW :: copy all encrypted files in EFS RAW mode.
/COPY:copyflag[s] :: what to COPY for files (default is /COPY:DAT).
(copyflags : D=Data, A=Attributes, T=Timestamps, X=Skip alt data streams).
(S=Security=NTFS ACLs, O=Owner info, U=aUditing info).
/SEC :: copy files with SECurity (equivalent to /COPY:DATS).
/COPYALL :: COPY ALL file info (equivalent to /COPY:DATSOU).
/NOCOPY :: COPY NO file info (useful with /PURGE).
/SECFIX :: FIX file SECurity on all files, even skipped files.
/TIMFIX :: FIX file TIMes on all files, even skipped files.
/PURGE :: delete dest files/dirs that no longer exist in source.
/MIR :: MIRror a directory tree (equivalent to /E plus /PURGE).
/MOV :: MOVe files (delete from source after copying).
/MOVE :: MOVE files AND dirs (delete from source after copying).
/A+:[RASHCNET] :: add the given Attributes to copied files.
/A-:[RASHCNET] :: remove the given Attributes from copied files.
/CREATE :: CREATE directory tree and zero-length files only.
/FAT :: create destination files using 8.3 FAT file names only.
/256 :: turn off very long path (> 256 characters) support.
/MON:n :: MONitor source; run again when more than n changes seen.
/MOT:m :: MOnitor source; run again in m minutes Time, if changed.
/RH:hhmm-hhmm :: Run Hours - times when new copies may be started.
/PF :: check run hours on a Per File (not per pass) basis.
/IPG:n :: Inter-Packet Gap (ms), to free bandwidth on slow lines.
/SJ :: copy Junctions as junctions instead of as the junction targets.
/SL :: copy Symbolic Links as links instead of as the link targets.
/MT[:n] :: Do multi-threaded copies with n threads (default 8).
n must be at least 1 and not greater than 128.
This option is incompatible with the /IPG and /EFSRAW options.
Redirect output using /LOG option for better performance.
/DCOPY:copyflag[s] :: what to COPY for directories (default is /DCOPY:DA).
(copyflags : D=Data, A=Attributes, T=Timestamps, E=EAs, X=Skip alt data streams).
/NODCOPY :: COPY NO directory info (by default /DCOPY:DA is done).
/NOOFFLOAD :: copy files without using the Windows Copy Offload mechanism.
/COMPRESS :: Request network compression during file transfer, if applicable.
::
:: File Selection Options :
::
/A :: copy only files with the Archive attribute set.
/M :: copy only files with the Archive attribute and reset it.
/IA:[RASHCNETO] :: Include only files with any of the given Attributes set.
/XA:[RASHCNETO] :: eXclude files with any of the given Attributes set.
/XF file [file]... :: eXclude Files matching given names/paths/wildcards.
/XD dirs [dirs]... :: eXclude Directories matching given names/paths.
/XC :: eXclude Changed files.
/XN :: eXclude Newer files.
/XO :: eXclude Older files.
/XX :: eXclude eXtra files and directories.
/XL :: eXclude Lonely files and directories.
/IS :: Include Same files.
/IT :: Include Tweaked files.
/MAX:n :: MAXimum file size - exclude files bigger than n bytes.
/MIN:n :: MINimum file size - exclude files smaller than n bytes.
/MAXAGE:n :: MAXimum file AGE - exclude files older than n days/date.
/MINAGE:n :: MINimum file AGE - exclude files newer than n days/date.
/MAXLAD:n :: MAXimum Last Access Date - exclude files unused since n.
/MINLAD:n :: MINimum Last Access Date - exclude files used since n.
(If n < 1900 then n = n days, else n = YYYYMMDD date).
/FFT :: assume FAT File Times (2-second granularity).
/DST :: compensate for one-hour DST time differences.
/XJ :: eXclude symbolic links (for both files and directories) and Junction points.
/XJD :: eXclude symbolic links for Directories and Junction points.
/XJF :: eXclude symbolic links for Files.
/IM :: Include Modified files (differing change times).
::
:: Retry Options :
::
/R:n :: number of Retries on failed copies: default 1 million.
/W:n :: Wait time between retries: default is 30 seconds.
/REG :: Save /R:n and /W:n in the Registry as default settings.
/TBD :: Wait for sharenames To Be Defined (retry error 67).
/LFSM :: Operate in low free space mode, enabling copy pause and resume (see Remarks).
/LFSM:n[KMG] :: /LFSM, specifying the floor size in n [K:kilo,M:mega,G:giga] bytes.
::
:: Logging Options :
::
/L :: List only - don't copy, timestamp or delete any files.
/X :: report all eXtra files, not just those selected.
/V :: produce Verbose output, showing skipped files.
/TS :: include source file Time Stamps in the output.
/FP :: include Full Pathname of files in the output.
/BYTES :: Print sizes as bytes.
/NS :: No Size - don't log file sizes.
/NC :: No Class - don't log file classes.
/NFL :: No File List - don't log file names.
/NDL :: No Directory List - don't log directory names.
/NP :: No Progress - don't display percentage copied.
/ETA :: show Estimated Time of Arrival of copied files.
/LOG:file :: output status to LOG file (overwrite existing log).
/LOG+:file :: output status to LOG file (append to existing log).
/UNILOG:file :: output status to LOG file as UNICODE (overwrite existing log).
/UNILOG+:file :: output status to LOG file as UNICODE (append to existing log).
/TEE :: output to console window, as well as the log file.
/NJH :: No Job Header.
/NJS :: No Job Summary.
/UNICODE :: output status as UNICODE.
::
:: Job Options :
::
/JOB:jobname :: take parameters from the named JOB file.
/SAVE:jobname :: SAVE parameters to the named job file
/QUIT :: QUIT after processing command line (to view parameters).
/NOSD :: NO Source Directory is specified.
/NODD :: NO Destination Directory is specified.
/IF :: Include the following Files.
::
:: Remarks :
::
Using /PURGE or /MIR on the root directory of the volume formerly caused
robocopy to apply the requested operation on files inside the System
Volume Information directory as well. This is no longer the case; if
either is specified, robocopy will skip any files or directories with that
name in the top-level source and destination directories of the copy session.
The modified files classification applies only when both source
and destination filesystems support change timestamps (e.g., NTFS)
and the source and destination files have different change times but are
otherwise the same. These files are not copied by default; specify /IM
to include them.
The /DCOPY:E flag requests that extended attribute copying should be
attempted for directories. Note that currently robocopy will continue
if a directory's EAs could not be copied. This flag is also not included
in /COPYALL.
Using /LFSM requests robocopy to operate in 'low free space mode'.
In that mode, robocopy will pause whenever a file copy would cause the
destination volume's free space to go below a 'floor' value, which
can be explicitly specified by the LFSM:n[KMG] form of the flag.
If /LFSM is specified with no explicit floor value, the floor is set to
ten percent of the destination volume's size.
Low free space mode is incompatible with /MT, /EFSRAW, /B, and /ZB.
ROUTE
Manipulates network routing tables.
ROUTE [-f] [-p] [-4|-6] command [destination]
[MASK netmask] [gateway] [METRIC metric] [IF interface]
-f Clears the routing tables of all gateway entries. If this is
used in conjunction with one of the commands, the tables are
cleared prior to running the command.
-p When used with the ADD command, makes a route persistent across
boots of the system. By default, routes are not preserved
when the system is restarted. Ignored for all other commands,
which always affect the appropriate persistent routes.
-4 Force using IPv4.
-6 Force using IPv6.
command One of these:
PRINT Prints a route
ADD Adds a route
DELETE Deletes a route
CHANGE Modifies an existing route
destination Specifies the host.
MASK Specifies that the next parameter is the 'netmask' value.
netmask Specifies a subnet mask value for this route entry.
If not specified, it defaults to 255.255.255.255.
gateway Specifies gateway.
interface the interface number for the specified route.
METRIC specifies the metric, ie. cost for the destination.
All symbolic names used for destination are looked up in the network database
file NETWORKS. The symbolic names for gateway are looked up in the host name
database file HOSTS.
If the command is PRINT or DELETE. Destination or gateway can be a wildcard,
(wildcard is specified as a star '*'), or the gateway argument may be omitted.
If Dest contains a * or ?, it is treated as a shell pattern, and only
matching destination routes are printed. The '*' matches any string,
and '?' matches any one char. Examples: 157.*.1, 157.*, 127.*, *224*.
Pattern match is only allowed in PRINT command.
Diagnostic Notes:
Invalid MASK generates an error, that is when (DEST & MASK) != DEST.
Example> route ADD 157.0.0.0 MASK 155.0.0.0 157.55.80.1 IF 1
The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination.
Examples:
> route PRINT
> route PRINT -4
> route PRINT -6
> route PRINT 157* .... Only prints those matching 157*
> route ADD 157.0.0.0 MASK 255.0.0.0 157.55.80.1 METRIC 3 IF 2
destination^ ^mask ^gateway metric^ ^
Interface^
If IF is not given, it tries to find the best interface for a given
gateway.
> route ADD 3ffe::/32 3ffe::1
> route CHANGE 157.0.0.0 MASK 255.0.0.0 157.55.80.5 METRIC 2 IF 2
CHANGE is used to modify gateway and/or metric only.
> route DELETE 157.0.0.0
> route DELETE 3ffe::/32
RUNAS
RUNAS USAGE:
RUNAS [ [/noprofile | /profile] [/env] [/savecred | /netonly] ]
/user:<UserName> program
RUNAS [ [/noprofile | /profile] [/env] [/savecred] ]
/smartcard [/user:<UserName>] program
RUNAS /trustlevel:<TrustLevel> program
/noprofile specifies that the user's profile should not be loaded.
This causes the application to load more quickly, but
can cause some applications to malfunction.
/profile specifies that the user's profile should be loaded.
This is the default.
/env to use current environment instead of user's.
/netonly use if the credentials specified are for remote
access only.
/savecred to use credentials previously saved by the user.
/smartcard use if the credentials are to be supplied from a
smartcard.
/user <UserName> should be in form USER@DOMAIN or DOMAIN\USER
/showtrustlevels displays the trust levels that can be used as arguments
to /trustlevel.
/trustlevel <Level> should be one of levels enumerated
in /showtrustlevels.
program command line for EXE. See below for examples
Examples:
> runas /noprofile /user:mymachine\administrator cmd
> runas /profile /env /user:mydomain\admin "mmc %windir%\system32\dsa.msc"
> runas /env /user:user@domain.microsoft.com "notepad \"my file.txt\""
NOTE: Enter user's password only when prompted.
NOTE: /profile is not compatible with /netonly.
NOTE: /savecred is not compatible with /smartcard.
REPAIR
Usage:
repair [flags]
repair [command]
Available Commands:
caches Invalidate caches when called with `--clear` flag
hashes generates(-g) or checks(-c) IDE installation integrity
help Help about any command
log Check the idea.log file for errors
plugins Check if broken, or old plugins are installed
runtime Check the runtime that starts IDE
vmoptions Check for problems in .vmoptions file used to start the IDE
Flags:
--debug Enable debug
-h, --help help for repair
-n, --no Only check the installation. All the fixes will be skipped.
--path string path to the IDE (default is the IDE where the script is located)
-y, --yes Apply all the suggested fixes automatically
Use "repair [command] --help" for more information about a command.
RESET
RESET { SESSION }
SC
DESCRIPTION:
SC is a command line program used for communicating with the
Service Control Manager and services.
USAGE:
sc <server> [command] [service name] <option1> <option2>...
The option <server> has the form "\\ServerName"
Further help on commands can be obtained by typing: "sc [command]"
Commands:
query-----------Queries the status for a service, or
enumerates the status for types of services.
queryex---------Queries the extended status for a service, or
enumerates the status for types of services.
start-----------Starts a service.
pause-----------Sends a PAUSE control request to a service.
interrogate-----Sends an INTERROGATE control request to a service.
continue--------Sends a CONTINUE control request to a service.
stop------------Sends a STOP request to a service.
config----------Changes the configuration of a service (persistent).
description-----Changes the description of a service.
failure---------Changes the actions taken by a service upon failure.
failureflag-----Changes the failure actions flag of a service.
sidtype---------Changes the service SID type of a service.
privs-----------Changes the required privileges of a service.
managedaccount--Changes the service to mark the service account
password as managed by LSA.
qc--------------Queries the configuration information for a service.
qdescription----Queries the description for a service.
qfailure--------Queries the actions taken by a service upon failure.
qfailureflag----Queries the failure actions flag of a service.
qsidtype--------Queries the service SID type of a service.
qprivs----------Queries the required privileges of a service.
qtriggerinfo----Queries the trigger parameters of a service.
qpreferrednode--Queries the preferred NUMA node of a service.
qmanagedaccount-Queries whether a services uses an account with a
password managed by LSA.
qprotection-----Queries the process protection level of a service.
quserservice----Queries for a local instance of a user service template.
delete----------Deletes a service (from the registry).
create----------Creates a service. (adds it to the registry).
control---------Sends a control to a service.
sdshow----------Displays a service's security descriptor.
sdset-----------Sets a service's security descriptor.
showsid---------Displays the service SID string corresponding to an arbitrary name.
triggerinfo-----Configures the trigger parameters of a service.
preferrednode---Sets the preferred NUMA node of a service.
GetDisplayName--Gets the DisplayName for a service.
GetKeyName------Gets the ServiceKeyName for a service.
EnumDepend------Enumerates Service Dependencies.
The following commands don't require a service name:
sc <server> <command> <option>
boot------------(ok | bad) Indicates whether the last boot should
be saved as the last-known-good boot configuration
Lock------------Locks the Service Database
QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
sc start MyService
QUERY and QUERYEX OPTIONS:
If the query command is followed by a service name, the status
for that service is returned. Further options do not apply in
this case. If the query command is followed by nothing or one of
the options listed below, the services are enumerated.
type= Type of services to enumerate (driver, service, userservice, all)
(default = service)
state= State of services to enumerate (inactive, all)
(default = active)
bufsize= The size (in bytes) of the enumeration buffer
(default = 4096)
ri= The resume index number at which to begin the enumeration
(default = 0)
group= Service group to enumerate
(default = all groups)
SYNTAX EXAMPLES
sc query - Enumerates status for active services & drivers
sc query eventlog - Displays status for the eventlog service
sc queryex eventlog - Displays extended status for the eventlog service
sc query type= driver - Enumerates only active drivers
sc query type= service - Enumerates only Win32 services
sc query state= all - Enumerates all services & drivers
sc query bufsize= 50 - Enumerates with a 50 byte buffer
sc query ri= 14 - Enumerates with resume index = 14
sc queryex group= "" - Enumerates active services not in a group
sc query type= interact - Enumerates all interactive services
sc query type= driver group= NDIS - Enumerates all NDIS drivers
SCHTASKS
SCHTASKS /parameter [arguments]
Description:
Enables an administrator to create, delete, query, change, run and
end scheduled tasks on a local or remote system.
Parameter List:
/Create Creates a new scheduled task.
/Delete Deletes the scheduled task(s).
/Query Displays all scheduled tasks.
/Change Changes the properties of scheduled task.
/Run Runs the scheduled task on demand.
/End Stops the currently running scheduled task.
/ShowSid Shows the security identifier corresponding to a scheduled task name.
/? Displays this help message.
Examples:
SCHTASKS
SCHTASKS /?
SCHTASKS /Run /?
SCHTASKS /End /?
SCHTASKS /Create /?
SCHTASKS /Delete /?
SCHTASKS /Query /?
SCHTASKS /Change /?
SCHTASKS /ShowSid /?
SECPOL.MSC
This cmd command to open Local Security Policy on Windows.
SERVICES.MSC
This cmd command to open Services on Windows.
SET
Displays, sets, or removes cmd.exe environment variables.
SET [variable=[string]]
variable Specifies the environment-variable name.
string Specifies a series of characters to assign to the variable.
Type SET without parameters to display the current environment variables.
If Command Extensions are enabled SET changes as follows:
SET command invoked with just a variable name, no equal sign or value
will display the value of all variables whose prefix matches the name
given to the SET command. For example:
SET P
would display all variables that begin with the letter 'P'
SET command will set the ERRORLEVEL to 1 if the variable name is not
found in the current environment.
SET command will not allow an equal sign to be part of the name of
a variable.
Two new switches have been added to the SET command:
SET /A expression
SET /P variable=[promptString]
The /A switch specifies that the string to the right of the equal sign
is a numerical expression that is evaluated. The expression evaluator
is pretty simple and supports the following operations, in decreasing
order of precedence:
() - grouping
! ~ - - unary operators
* / % - arithmetic operators
+ - - arithmetic operators
<< >> - logical shift
& - bitwise and
^ - bitwise exclusive or
| - bitwise or
= *= /= %= += -= - assignment
&= ^= |= <<= >>=
, - expression separator
If you use any of the logical or modulus operators, you will need to
enclose the expression string in quotes. Any non-numeric strings in the
expression are treated as environment variable names whose values are
converted to numbers before using them. If an environment variable name
is specified but is not defined in the current environment, then a value
of zero is used. This allows you to do arithmetic with environment
variable values without having to type all those % signs to get their
values. If SET /A is executed from the command line outside of a
command script, then it displays the final value of the expression. The
assignment operator requires an environment variable name to the left of
the assignment operator. Numeric values are decimal numbers, unless
prefixed by 0x for hexadecimal numbers, and 0 for octal numbers.
So 0x12 is the same as 18 is the same as 022. Please note that the octal
notation can be confusing: 08 and 09 are not valid numbers because 8 and
9 are not valid octal digits.
The /P switch allows you to set the value of a variable to a line of input
entered by the user. Displays the specified promptString before reading
the line of input. The promptString can be empty.
Environment variable substitution has been enhanced as follows:
%PATH:str1=str2%
would expand the PATH environment variable, substituting each occurrence
of "str1" in the expanded result with "str2". "str2" can be the empty
string to effectively delete all occurrences of "str1" from the expanded
output. "str1" can begin with an asterisk, in which case it will match
everything from the beginning of the expanded output to the first
occurrence of the remaining portion of str1.
May also specify substrings for an expansion.
%PATH:~10,5%
would expand the PATH environment variable, and then use only the 5
characters that begin at the 11th (offset 10) character of the expanded
result. If the length is not specified, then it defaults to the
remainder of the variable value. If either number (offset or length) is
negative, then the number used is the length of the environment variable
value added to the offset or length specified.
%PATH:~-10%
would extract the last 10 characters of the PATH variable.
%PATH:~0,-2%
would extract all but the last 2 characters of the PATH variable.
Finally, support for delayed environment variable expansion has been
added. This support is always disabled by default, but may be
enabled/disabled via the /V command line switch to CMD.EXE. See CMD /?
Delayed environment variable expansion is useful for getting around
the limitations of the current expansion which happens when a line
of text is read, not when it is executed. The following example
demonstrates the problem with immediate variable expansion:
set VAR=before
if "%VAR%" == "before" (
set VAR=after
if "%VAR%" == "after" @echo If you see this, it worked
)
would never display the message, since the %VAR% in BOTH IF statements
is substituted when the first IF statement is read, since it logically
includes the body of the IF, which is a compound statement. So the
IF inside the compound statement is really comparing "before" with
"after" which will never be equal. Similarly, the following example
will not work as expected:
set LIST=
for %i in (*) do set LIST=%LIST% %i
echo %LIST%
in that it will NOT build up a list of files in the current directory,
but instead will just set the LIST variable to the last file found.
Again, this is because the %LIST% is expanded just once when the
FOR statement is read, and at that time the LIST variable is empty.
So the actual FOR loop we are executing is:
for %i in (*) do set LIST= %i
which just keeps setting LIST to the last file found.
Delayed environment variable expansion allows you to use a different
character (the exclamation mark) to expand environment variables at
execution time. If delayed variable expansion is enabled, the above
examples could be written as follows to work as intended:
set VAR=before
if "%VAR%" == "before" (
set VAR=after
if "!VAR!" == "after" @echo If you see this, it worked
)
set LIST=
for %i in (*) do set LIST=!LIST! %i
echo %LIST%
If Command Extensions are enabled, then there are several dynamic
environment variables that can be expanded but which don't show up in
the list of variables displayed by SET. These variable values are
computed dynamically each time the value of the variable is expanded.
If the user explicitly defines a variable with one of these names, then
that definition will override the dynamic one described below:
%CD% - expands to the current directory string.
%DATE% - expands to current date using same format as DATE command.
%TIME% - expands to current time using same format as TIME command.
%RANDOM% - expands to a random decimal number between 0 and 32767.
%ERRORLEVEL% - expands to the current ERRORLEVEL value
%CMDEXTVERSION% - expands to the current Command Processor Extensions
version number.
%CMDCMDLINE% - expands to the original command line that invoked the
Command Processor.
%HIGHESTNUMANODENUMBER% - expands to the highest NUMA node number
on this machine.
SETLOCAL
Begins localization of environment changes in a batch file. Environment
changes made after SETLOCAL has been issued are local to the batch file.
ENDLOCAL must be issued to restore the previous settings. When the end
of a batch script is reached, an implied ENDLOCAL is executed for any
outstanding SETLOCAL commands issued by that batch script.
SETLOCAL
If Command Extensions are enabled SETLOCAL changes as follows:
SETLOCAL batch command now accepts optional arguments:
ENABLEEXTENSIONS / DISABLEEXTENSIONS
enable or disable command processor extensions. These
arguments takes precedence over the CMD /E:ON or /E:OFF
switches. See CMD /? for details.
ENABLEDELAYEDEXPANSION / DISABLEDELAYEDEXPANSION
enable or disable delayed environment variable
expansion. These arguments takes precedence over the CMD
/V:ON or /V:OFF switches. See CMD /? for details.
These modifications last until the matching ENDLOCAL command,
regardless of their setting prior to the SETLOCAL command.
The SETLOCAL command will set the ERRORLEVEL value if given
an argument. It will be zero if one of the two valid arguments
is given and one otherwise. You can use this in batch scripts
to determine if the extensions are available, using the following
technique:
VERIFY OTHER 2>nul
SETLOCAL ENABLEEXTENSIONS
IF ERRORLEVEL 1 echo Unable to enable extensions
This works because on old versions of CMD.EXE, SETLOCAL does NOT
set the ERRORLEVEL value. The VERIFY command with a bad argument
initializes the ERRORLEVEL value to a non-zero value.
SFC
Scans the integrity of all protected system files and replaces incorrect versions with
correct Microsoft versions.
SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
[/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory> [/OFFLOGFILE=<log file path>]]
/SCANNOW Scans integrity of all protected system files and repairs files with
problems when possible.
/VERIFYONLY Scans integrity of all protected system files. No repair operation is
performed.
/SCANFILE Scans integrity of the referenced file, repairs file if problems are
identified. Specify full path <file>
/VERIFYFILE Verifies the integrity of the file with full path <file>. No repair
operation is performed.
/OFFBOOTDIR For offline repair, specify the location of the offline boot directory
/OFFWINDIR For offline repair, specify the location of the offline windows directory
/OFFLOGFILE For offline repair, optionally enable logging by specifying a log file path
e.g.
sfc /SCANNOW
sfc /VERIFYFILE=c:\windows\system32\kernel32.dll
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows /OFFLOGFILE=c:\log.txt
sfc /VERIFYONLY
SHIFT
Changes the position of replaceable parameters in a batch file.
SHIFT [/n]
If Command Extensions are enabled the SHIFT command supports
the /n switch which tells the command to start shifting at the
nth argument, where n may be between zero and eight. For example:
SHIFT /2
would shift %3 to %2, %4 to %3, etc. and leave %0 and %1 unaffected.
SHRPUBW.EXE
This cmd command to open Create Shared Folder Wizard on Windows.
SHUTDOWN
Usage: SHUTDOWN [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft] [/fw] [/f]
[/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]
No args Display help. This is the same as typing /?.
/? Display help. This is the same as not typing any options.
/i Display the graphical user interface (GUI).
This must be the first option.
/l Log off. This cannot be used with /m or /d options.
/s Shutdown the computer.
/sg Shutdown the computer. On the next boot, if Automatic Restart Sign-On
is enabled, automatically sign in and lock last interactive user.
After sign in, restart any registered applications.
/r Full shutdown and restart the computer.
/g Full shutdown and restart the computer. After the system is rebooted,
if Automatic Restart Sign-On is enabled, automatically sign in and
lock last interactive user.
After sign in, restart any registered applications.
/a Abort a system shutdown.
This can only be used during the time-out period.
Combine with /fw to clear any pending boots to firmware.
/p Turn off the local computer with no time-out or warning.
Can be used with /d and /f options.
/h Hibernate the local computer.
Can be used with the /f option.
/hybrid Performs a shutdown of the computer and prepares it for fast startup.
Must be used with /s option.
/fw Combine with a shutdown option to cause the next boot to go to the
firmware user interface.
/e Document the reason for an unexpected shutdown of a computer.
/o Go to the advanced boot options menu and restart the computer.
Must be used with /r option.
/m \\computer Specify the target computer.
/t xxx Set the time-out period before shutdown to xxx seconds.
The valid range is 0-315360000 (10 years), with a default of 30.
If the timeout period is greater than 0, the /f parameter is
implied.
/c "comment" Comment on the reason for the restart or shutdown.
Maximum of 512 characters allowed.
/f Force running applications to close without forewarning users.
The /f parameter is implied when a value greater than 0 is
specified for the /t parameter.
/d [p|u:]xx:yy Provide the reason for the restart or shutdown.
p indicates that the restart or shutdown is planned.
u indicates that the reason is user defined.
If neither p nor u is specified the restart or shutdown is
unplanned.
xx is the major reason number (positive integer less than 256).
yy is the minor reason number (positive integer less than 65536).
Reasons on this computer:
(E = Expected U = Unexpected P = planned, C = customer defined)
Type Major Minor Title
U 0 0 Other (Unplanned)
E 0 0 Other (Unplanned)
E P 0 0 Other (Planned)
U 0 5 Other Failure: System Unresponsive
E 1 1 Hardware: Maintenance (Unplanned)
E P 1 1 Hardware: Maintenance (Planned)
E 1 2 Hardware: Installation (Unplanned)
E P 1 2 Hardware: Installation (Planned)
E 2 2 Operating System: Recovery (Unplanned)
E P 2 2 Operating System: Recovery (Planned)
P 2 3 Operating System: Upgrade (Planned)
E 2 4 Operating System: Reconfiguration (Unplanned)
E P 2 4 Operating System: Reconfiguration (Planned)
P 2 16 Operating System: Service pack (Planned)
2 17 Operating System: Hot fix (Unplanned)
P 2 17 Operating System: Hot fix (Planned)
2 18 Operating System: Security fix (Unplanned)
P 2 18 Operating System: Security fix (Planned)
E 4 1 Application: Maintenance (Unplanned)
E P 4 1 Application: Maintenance (Planned)
E P 4 2 Application: Installation (Planned)
E 4 5 Application: Unresponsive
E 4 6 Application: Unstable
U 5 15 System Failure: Stop error
U 5 19 Security issue (Unplanned)
E 5 19 Security issue (Unplanned)
E P 5 19 Security issue (Planned)
E 5 20 Loss of network connectivity (Unplanned)
U 6 11 Power Failure: Cord Unplugged
U 6 12 Power Failure: Environment
P 7 0 Legacy API shutdown
SLMGR
This cmd command to open Windows Licensing Managament Tool on Windows.
SORT
SORT [/R] [/+n] [/M kilobytes] [/L locale] [/REC recordbytes]
[[drive1:][path1]filename1] [/T [drive2:][path2]]
[/O [drive3:][path3]filename3]
/+n Specifies the character number, n, to
begin each comparison. /+3 indicates that
each comparison should begin at the 3rd
character in each line. Lines with fewer
than n characters collate before other lines.
By default comparisons start at the first
character in each line.
/L[OCALE] locale Overrides the system default locale with
the specified one. The ""C"" locale yields
the fastest collating sequence and is
currently the only alternative. The sort
is always case insensitive.
/M[EMORY] kilobytes Specifies amount of main memory to use for
the sort, in kilobytes. The memory size is
always constrained to be a minimum of 160
kilobytes. If the memory size is specified
the exact amount will be used for the sort,
regardless of how much main memory is
available.
The best performance is usually achieved by
not specifying a memory size. By default the
sort will be done with one pass (no temporary
file) if it fits in the default maximum
memory size, otherwise the sort will be done
in two passes (with the partially sorted data
being stored in a temporary file) such that
the amounts of memory used for both the sort
and merge passes are equal. The default
maximum memory size is 90% of available main
memory if both the input and output are
files, and 45% of main memory otherwise.
/REC[ORD_MAXIMUM] characters Specifies the maximum number of characters
in a record (default 4096, maximum 65535).
/R[EVERSE] Reverses the sort order; that is,
sorts Z to A, then 9 to 0.
[drive1:][path1]filename1 Specifies the file to be sorted. If not
specified, the standard input is sorted.
Specifying the input file is faster than
redirecting the same file as standard input.
/T[EMPORARY]
[drive2:][path2] Specifies the path of the directory to hold
the sort's working storage, in case the data
does not fit in main memory. The default is
to use the system temporary directory.
/O[UTPUT]
[drive3:][path3]filename3 Specifies the file where the sorted input is
to be stored. If not specified, the data is
written to the standard output. Specifying
the output file is faster than redirecting
standard output to the same file.
START
Starts a separate window to run a specified program or command.
START ["title"] [/D path] [/I] [/MIN] [/MAX] [/SEPARATE | /SHARED]
[/LOW | /NORMAL | /HIGH | /REALTIME | /ABOVENORMAL | /BELOWNORMAL]
[/NODE <NUMA node>] [/AFFINITY <hex affinity mask>] [/WAIT] [/B]
[command/program] [parameters]
"title" Title to display in window title bar.
path Starting directory.
B Start application without creating a new window. The
application has ^C handling ignored. Unless the application
enables ^C processing, ^Break is the only way to interrupt
the application.
I The new environment will be the original environment passed
to the cmd.exe and not the current environment.
MIN Start window minimized.
MAX Start window maximized.
SEPARATE Start 16-bit Windows program in separate memory space.
SHARED Start 16-bit Windows program in shared memory space.
LOW Start application in the IDLE priority class.
NORMAL Start application in the NORMAL priority class.
HIGH Start application in the HIGH priority class.
REALTIME Start application in the REALTIME priority class.
ABOVENORMAL Start application in the ABOVENORMAL priority class.
BELOWNORMAL Start application in the BELOWNORMAL priority class.
NODE Specifies the preferred Non-Uniform Memory Architecture (NUMA)
node as a decimal integer.
AFFINITY Specifies the processor affinity mask as a hexadecimal number.
The process is restricted to running on these processors.
The affinity mask is interpreted differently when /AFFINITY and
/NODE are combined. Specify the affinity mask as if the NUMA
node's processor mask is right shifted to begin at bit zero.
The process is restricted to running on those processors in
common between the specified affinity mask and the NUMA node.
If no processors are in common, the process is restricted to
running on the specified NUMA node.
WAIT Start application and wait for it to terminate.
command/program
If it is an internal cmd command or a batch file then
the command processor is run with the /K switch to cmd.exe.
This means that the window will remain after the command
has been run.
If it is not an internal cmd command or batch file then
it is a program and will run as either a windowed application
or a console application.
parameters These are the parameters passed to the command/program.
NOTE: The SEPARATE and SHARED options are not supported on 64-bit platforms.
Specifying /NODE allows processes to be created in a way that leverages memory
locality on NUMA systems. For example, two processes that communicate with
each other heavily through shared memory can be created to share the same
preferred NUMA node in order to minimize memory latencies. They allocate
memory from the same NUMA node when possible, and they are free to run on
processors outside the specified node.
start /NODE 1 application1.exe
start /NODE 1 application2.exe
These two processes can be further constrained to run on specific processors
within the same NUMA node. In the following example, application1 runs on the
low-order two processors of the node, while application2 runs on the next two
processors of the node. This example assumes the specified node has at least
four logical processors. Note that the node number can be changed to any valid
node number for that computer without having to change the affinity mask.
start /NODE 1 /AFFINITY 0x3 application1.exe
start /NODE 1 /AFFINITY 0xc application2.exe
If Command Extensions are enabled, external command invocation
through the command line or the START command changes as follows:
non-executable files may be invoked through their file association just
by typing the name of the file as a command. (e.g. WORD.DOC would
launch the application associated with the .DOC file extension).
See the ASSOC and FTYPE commands for how to create these
associations from within a command script.
When executing an application that is a 32-bit GUI application, CMD.EXE
does not wait for the application to terminate before returning to
the command prompt. This new behavior does NOT occur if executing
within a command script.
When executing a command line whose first token is the string "CMD "
without an extension or path qualifier, then "CMD" is replaced with
the value of the COMSPEC variable. This prevents picking up CMD.EXE
from the current directory.
When executing a command line whose first token does NOT contain an
extension, then CMD.EXE uses the value of the PATHEXT
environment variable to determine which extensions to look for
and in what order. The default value for the PATHEXT variable
is:
.COM;.EXE;.BAT;.CMD
Notice the syntax is the same as the PATH variable, with
semicolons separating the different elements.
When searching for an executable, if there is no match on any extension,
then looks to see if the name matches a directory name. If it does, the
START command launches the Explorer on that path. If done from the
command line, it is the equivalent to doing a CD /D to that path.
SUBST
Associates a path with a drive letter.
SUBST [drive1: [drive2:]path]
SUBST drive1: /D
drive1: Specifies a virtual drive to which you want to assign a path.
[drive2:]path Specifies a physical drive and path you want to assign to
a virtual drive.
/D Deletes a substituted (virtual) drive.
Type SUBST with no parameters to display a list of current virtual drives
SYSTEMINFO
SYSTEMINFO [/S system [/U username [/P [password]]]] [/FO format] [/NH]
Description:
This tool displays operating system configuration information for
a local or remote machine, including service pack levels.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which
the command should execute.
/P [password] Specifies the password for the given
user context. Prompts for input if omitted.
/FO format Specifies the format in which the output
is to be displayed.
Valid values: "TABLE", "LIST", "CSV".
/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for "TABLE" and "CSV" formats.
/? Displays this help message.
Examples:
SYSTEMINFO
SYSTEMINFO /?
SYSTEMINFO /S system
SYSTEMINFO /S system /U user
SYSTEMINFO /S system /U domain\user /P password /FO TABLE
SYSTEMINFO /S system /FO LIST
SYSTEMINFO /S system /FO CSV /NH
TAKEOWN
TAKEOWN [/S system [/U username [/P [password]]]]
/F filename [/A] [/R [/D prompt]]
Description:
This tool allows an administrator to recover access to a file that
was denied by re-assigning file ownership.
Parameter List:
/S system Specifies the remote system to
connect to.
/U [domain\]user Specifies the user context under
which the command should execute.
/P [password] Specifies the password for the
given user context.
Prompts for input if omitted.
/F filename Specifies the filename or directory
name pattern. Wildcard "*" can be used
to specify the pattern. Allows
sharename\filename.
/A Gives ownership to the administrators
group instead of the current user.
/R Recurse: instructs tool to operate on
files in specified directory and all
subdirectories.
/D prompt Default answer used when the current user
does not have the "list folder" permission
on a directory. This occurs while operating
recursively (/R) on sub-directories. Valid
values "Y" to take ownership or "N" to skip.
/SKIPSL Do not follow symbolic links.
Only applicable with /R.
/? Displays this help message.
NOTE: 1) If /A is not specified, file ownership will be given to the
current logged on user.
2) Mixed patterns using "?" and "*" are not supported.
3) /D is used to suppress the confirmation prompt.
Examples:
TAKEOWN /?
TAKEOWN /F lostfile
TAKEOWN /F \\system\share\lostfile /A
TAKEOWN /F directory /R /D N
TAKEOWN /F directory /R /A
TAKEOWN /F *
TAKEOWN /F C:\Windows\System32\acme.exe
TAKEOWN /F %windir%\*.txt
TAKEOWN /S system /F MyShare\Acme*.doc
TAKEOWN /S system /U user /F MyShare\MyBinary.dll
TAKEOWN /S system /U domain\user /P password /F share\filename
TAKEOWN /S system /U user /P password /F Doc\Report.doc /A
TAKEOWN /S system /U user /P password /F Myshare\*
TAKEOWN /S system /U user /P password /F Home\Logon /R
TAKEOWN /S system /U user /P password /F Myshare\directory /R /A
TAR
Usage:
List: TAR -tf <archive-filename>
Extract: TAR -xf <archive-filename>
Create: TAR -cf <archive-filename> [filenames...]
Help: TAR --help
TASKKILL
TASKKILL [/S system [/U username [/P [password]]]]
{ [/FI filter] [/PID processid | /IM imagename] } [/T] [/F]
Description:
This tool is used to terminate tasks by process id (PID) or image name.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which the
command should execute.
/P [password] Specifies the password for the given user
context. Prompts for input if omitted.
/FI filter Applies a filter to select a set of tasks.
Allows "*" to be used. ex. imagename eq acme*
/PID processid Specifies the PID of the process to be terminated.
Use TaskList to get the PID.
/IM imagename Specifies the image name of the process
to be terminated. Wildcard '*' can be used
to specify all tasks or image names.
/T Terminates the specified process and any
child processes which were started by it.
/F Specifies to forcefully terminate the process(es).
/? Displays this help message.
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- -------------------------
STATUS eq, ne RUNNING |
NOT RESPONDING | UNKNOWN
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number.
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
MODULES eq, ne DLL name
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
NOTE
----
1) Wildcard '*' for /IM switch is accepted only when a filter is applied.
2) Termination of remote processes will always be done forcefully (/F).
3) "WINDOWTITLE" and "STATUS" filters are not considered when a remote
machine is specified.
Examples:
TASKKILL /IM notepad.exe
TASKKILL /PID 1230 /PID 1241 /PID 1253 /T
TASKKILL /F /IM cmd.exe /T
TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*"
TASKKILL /F /FI "USERNAME eq NT AUTHORITY\SYSTEM" /IM notepad.exe
TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM *
TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"
TASKLIST
TASKLIST [/S system [/U username [/P [password]]]]
[/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]
Description:
This tool displays a list of currently running processes on
either a local or remote machine.
Parameter List:
/S system Specifies the remote system to connect to.
/U [domain\]user Specifies the user context under which
the command should execute.
/P [password] Specifies the password for the given
user context. Prompts for input if omitted.
/M [module] Lists all tasks currently using the given
exe/dll name. If the module name is not
specified all loaded modules are displayed.
/SVC Displays services hosted in each process.
/APPS Displays Store Apps and their associated processes.
/V Displays verbose task information.
/FI filter Displays a set of tasks that match a
given criteria specified by the filter.
/FO format Specifies the output format.
Valid values: "TABLE", "LIST", "CSV".
/NH Specifies that the "Column Header" should
not be displayed in the output.
Valid only for "TABLE" and "CSV" formats.
/? Displays this help message.
Filters:
Filter Name Valid Operators Valid Value(s)
----------- --------------- --------------------------
STATUS eq, ne RUNNING | SUSPENDED
NOT RESPONDING | UNKNOWN
IMAGENAME eq, ne Image name
PID eq, ne, gt, lt, ge, le PID value
SESSION eq, ne, gt, lt, ge, le Session number
SESSIONNAME eq, ne Session name
CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
of hh:mm:ss.
hh - hours,
mm - minutes, ss - seconds
MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
USERNAME eq, ne User name in [domain\]user
format
SERVICES eq, ne Service name
WINDOWTITLE eq, ne Window title
MODULES eq, ne DLL name
NOTE: "WINDOWTITLE" and "STATUS" filters are not supported when querying
a remote machine.
Examples:
TASKLIST
TASKLIST /M
TASKLIST /V /FO CSV
TASKLIST /SVC /FO LIST
TASKLIST /APPS /FI "STATUS eq RUNNING"
TASKLIST /M wbem*
TASKLIST /S system /FO LIST
TASKLIST /S system /U domain\username /FO CSV /NH
TASKLIST /S system /U username /P password /FO TABLE /NH
TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"
ETASKMGR.XE
This cmd command to open Task Manager on Windows.
TELNET
telnet [-a][-e escape char][-f log file][-l user][-t term][host [port]]
-a Attempt automatic logon. Same as -l option except uses
the currently logged on user's name.
-e Escape character to enter telnet client prompt.
-f File name for client side logging
-l Specifies the user name to log in with on the remote system.
Requires that the remote system support the TELNET ENVIRON option.
-t Specifies terminal type.
Supported term types are vt100, vt52, ansi and vtnt only.
host Specifies the hostname or IP address of the remote computer
to connect to.
port Specifies a port number or service name.
TIME
Displays or sets the system time.
TIME [/T | time]
Type TIME with no parameters to display the current time setting and a prompt
for a new one. Press ENTER to keep the same time.
If Command Extensions are enabled the TIME command supports
the /T switch which tells the command to just output the
current time, without prompting for a new time.
TIMEOUT
TIMEOUT [/T] timeout [/NOBREAK]
Description:
This utility accepts a timeout parameter to wait for the specified
time period (in seconds) or until any key is pressed. It also
accepts a parameter to ignore the key press.
Parameter List:
/T timeout Specifies the number of seconds to wait.
Valid range is -1 to 99999 seconds.
/NOBREAK Ignore key presses and wait specified time.
/? Displays this help message.
NOTE: A timeout value of -1 means to wait indefinitely for a key press.
Examples:
TIMEOUT /?
TIMEOUT /T 10
TIMEOUT /T 300 /NOBREAK
TIMEOUT /T -1
TITLE
Sets the window title for the command prompt window.
TITLE [string]
string Specifies the title for the command prompt window.
TRACERT
Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout]
[-R] [-S srcaddr] [-4] [-6] target_name
Options:
-d Do not resolve addresses to hostnames.
-h maximum_hops Maximum number of hops to search for target.
-j host-list Loose source route along host-list (IPv4-only).
-w timeout Wait timeout milliseconds for each reply.
-R Trace round-trip path (IPv6-only).
-S srcaddr Source address to use (IPv6-only).
-4 Force using IPv4.
-6 Force using IPv6.
TREE
Graphically displays the folder structure of a drive or path.
TREE [drive:][path] [/F] [/A]
/F Display the names of the files in each folder.
/A Use ASCII instead of extended characters.
TSDISCON
Disconnects a Remote Desktop Services session.
TSDISCON [sessionid | sessionname] [/SERVER:servername] [/V] [/VM]
sessionid The ID of the session.
sessionname The name of the session.
/SERVER:servername Specifies the Remote Desktop Session Host server (default is current).
/V Displays information about the actions performed.
/VM Disconnects session on server or within virtual machine. The unique ID of the session needs to be specified.
TSKILL
Ends a process.
TSKILL processid | processname [/SERVER:servername] [/ID:sessionid | /A] [/V]
processid Process ID for the process to be terminated.
processname Process name to be terminated.
/SERVER:servername Server containing processID (default is current).
/ID or /A must be specified when using processname
and /SERVER
/ID:sessionid End process running under the specified session.
/A End process running under ALL sessions.
/V Display information about actions being performed.
TYPE
Displays the contents of a text file or files.
TYPE [drive:][path]filename
TYPEPERF
Microsoft ® TypePerf.exe (10.0.19041.1741)
Usage:
TYPEPERF <counter [counter ...]>
[options]
Parameters:
<counter [counter ...]> Performance counters to monitor.
Examples:
typeperf "\Processor(_Total)\% Processor Time"
TZUTIL
Windows Time Zone Utility
Usage:
TZUTIL </? | /g | /s TimeZoneID[_dstoff] | /l>
Parameters:
/? Displays usage information.
/g Displays the current time zone ID.
/s TimeZoneID[_dstoff]
Sets the current time zone using the specified time zone ID.
The _dstoff suffix disables Daylight Saving Time adjustments
for the time zone (where applicable).
/l Lists all valid time zone IDs and display names. The output will
be:
<display name>
<time zone ID>
Examples:
TZUTIL /g
TZUTIL /s "Pacific Standard Time"
TZUTIL /s "Pacific Standard Time_dstoff"
Remarks:
An exit code of 0 indicates the command completed successfully.
VER
Displays the Windows version.
VERIFIER.EXE
This cmd command to open Driver Verifier Manager on Windows.
SYNTAX:
verifier {/? | /help}
verifier /standard /all
verifier /standard /driver <name> [<name> ...]
verifier {/ruleclasses | /rc} <options> [<ruleclass_1> <ruleclass_2> ...] /all
verifier /flags <options> [<options> ...] /all
verifier /flags <options> [<options> ...] /driver <name> [<name> ...]
verifier /rules {query | reset | default <id> | disable <id>}
verifier /query
verifier /querysettings
verifier /bootmode {persistent | resetonbootfail | oneboot | resetonunusualshutdown}
verifier /persistthroughupgrade
verifier /reset
verifier /faults [probability [pool_tags [applications [delay_minutes]]]]
verifier /faultssystematic [<options> ...]
verifier /log <file_name> [/interval <seconds>]
verifier /volatile /flags <options> [<options> ...]
verifier /volatile /adddriver <name> [<name> ...]
verifier /volatile /removedriver <name> [<name> ...]
verifier /volatile /faults [probability [pool_tags [applications
[delay_minutes]]]]
verifier /domain {wdm | ndis | ks | audio} [rules.all | rules.default ]
/driver ... [/logging | /livedump]
verifier /logging
verifier /livedump
PARAMETERS:
/? or /help
Displays this help message.
/standard
Specifies standard Driver Verifier flags.
/all
Specifies that all installed drivers will be verified after the next
boot.
/driver <name> [<name> ...]
Specifies one or more drivers (image names) that will be verified.
Wildcard values (e.g. n*.sys) are not supported.
/driver.exclude <name> [<name> ...]
Specifies one or more drivers (image names) that will be excluded
from verification. This parameter is applicable only if all drivers
are selected for verification. Wildcard values (e.g. n*.sys) are not
supported.
/flags <options> [<options> ...]
Specifies one or more options that should be enabled for verification.
Flags are applied to all drivers being checked by Driver Verifier. The
provided options values must be either in decimal, hexadecimal ("0x"
prefix), octal ("0o" prefix) or binary ("0b" prefix) format.
Standard Flags:
Standard Driver Verifier options can be specified using '/standard'.
WDF verification is included in /standard but is not shown here.
0x00000001 (bit 0) - Special pool
0x00000002 (bit 1) - Force IRQL checking
0x00000008 (bit 3) - Pool tracking
0x00000010 (bit 4) - I/O verification
0x00000020 (bit 5) - Deadlock detection
0x00000080 (bit 7) - DMA checking
0x00000100 (bit 8) - Security checks
0x00000800 (bit 11) - Miscellaneous checks
0x00020000 (bit 17) - DDI compliance checking
Additional Flags:
These flags are intended for specific scenario testing. Flags marked
with (*) require I/O Verification (bit 4) that will be automatically
enabled. Flags marked with (**) support disabling of individual
rules.
0x00000004 (bit 2) - Randomized low resources simulation
0x00000200 (bit 9) - Force pending I/O requests (*)
0x00000400 (bit 10) - IRP logging (*)
0x00002000 (bit 13) - Invariant MDL checking for stack (*)
0x00004000 (bit 14) - Invariant MDL checking for driver (*)
0x00008000 (bit 15) - Power framework delay fuzzing
0x00010000 (bit 16) - Port/miniport interface checking
0x00040000 (bit 18) - Systematic low resources simulation
0x00080000 (bit 19) - DDI compliance checking (additional)
0x00200000 (bit 21) - NDIS/WIFI verification (**)
0x00800000 (bit 23) - Kernel synchronization delay fuzzing
0x01000000 (bit 24) - VM switch verification
0x02000000 (bit 25) - Code integrity checks
/ruleclasses or /rc [<ruleclass_1> <ruleclass_2> ... <ruleclass_k>]
This parameter is larger set of '/flags' above. While '/flags' is
limited to 32 bit bitmap expression, this can include more than 32
verification classes. Each positive decimal integer represents a
verification class. Multiple classes can be expressed by separating
each class id with space character. Following rule classes IDs are
available and leading 0's can be omitted.
Standard Rule Classes:
1 - Special pool
2 - Force IRQL checking
4 - Pool tracking
5 - I/O verification
6 - Deadlock detection
8 - DMA checking
9 - Security checks
12 - Miscellaneous checks
18 - DDI compliance checking
34 - WDF Verification
Additional Rule Classes:
These rule classes are intended for specific scenario testing. Rule
classes are marked with (*) require I/O Verification (5) that will
be automatically enabled. Flags marked with (**) support disabling
of individual rules.
3 - Randomized low resources simulation
10 - Force pending I/O requests (*)
11 - IRP logging (*)
14 - Invariant MDL checking for stack (*)
15 - Invariant MDL checking for driver (*)
16 - Power framework delay fuzzing
17 - Port/miniport interface checking
19 - Systematic low resources simulation
20 - DDI compliance checking (additional)
22 - NDIS/WIFI verification (**)
24 - Kernel synchronization delay fuzzing
25 - VM switch verification
26 - Code integrity checks
/log.code_integrity
This option suppresses Code Integrity violation breaks and collects
only statistics for verified drivers. Statistics could be extracted
via /log option or kernel debugger. This parameter is applicable only
if Code Integrity checks are enabled.
/rules {query | reset | default <id> | disable <id>}
Specifies rules level control (advanced).
query Shows current status of controllable rules.
reset Resets all rules to their default state.
default <id> Sets rule ID to its default state.
disable <id> Disables specified rule ID.
/query
Display runtime Driver Verifier statistics and settings.
/querysettings
Displays a summary of the options and drivers that are currently
enabled, or options and drivers that will be verified after the
next boot. The display does not include drivers and options added
using /volatile.
/bootmode
Specifies the Driver Verifier boot mode. This option requires system
reboot to take effect.
persistent Ensures that Driver Verifier settings are
persistent across reboots. This is the default
value.
resetonbootfail Disables Driver Verifier for subsequent reboots
if the system failed to start.
resetonunusualshutdown
Driver Verifier persists until unusual shutdown
happens. Its abbrevation, 'rous', can be used.
oneboot Enables Driver Verifier only for the next boot.
/persistthroughupgrade
Makes the Driver Verifier settings persist through upgrade. Driver
Verifier will be active during system upgrade.
/reset
Clears Driver Verifier flags and driver settings. This option requires
system reboot to take effect.
/faults [probability [pool_tags [applications [delay_minutes]]]]
Enable the Randomized low resources simulation feature and optionally
control parameters for the Randomized low resources simulation.
Probability Specifies the probability that Driver Verifier will
fail a given allocation. The value represents the
number of chances in 10,000 that Driver Verifier will
fail the allocation. The default value 600, means
600/10000 or 6.
Pool Tags: Specifies a space separated list of the pool tags to
be injected with faults. By default, any pool
allocation can be injected with faults.
Applications Specifies a space separated list of image file names
(an executable) that will be injected with faults. By
default, any pool allocation can be injected with
faults.
DelayMinutes Specifies the number of minutes after booting during
which Driver Verifier does not intentionally fail any
allocations. This delay allows the drivers to load
and the system to stabilize before the test begins.
The default value is 8 minutes.
/faultssystematic [<options> ...]
Controls the Systematic low resources simulation parameters.
enableboottime Enables fault injections across reboots.
disableboottime Disables fault injections across reboots.
This is the default value.
recordboottime Enables fault injections in 'what if' mode
across reboots.
resetboottime Disables fault injections across reboots and
clears the stack exclusion list.
enableruntime Dynamically enables fault injections.
disableruntime Dynamically disables fault injections.
recordruntime Dynamically enables fault injections in
'what if' mode.
resetruntime Dynamically disables fault injections and
clears the previously faulted stack list.
querystatistics Shows the current fault injection statistics.
incrementcounter Increments the test pass counter used to
identify when a fault was injected.
getstackid <counter> Retrieves the indicated injected stack id.
excludestack <stack_id> Excludes the stack from fault injection.
/log <file_name> [/interval <seconds>]
Creates a log file with the specified name and periodically writes the
runtime statistics to this file. The interval between log file updates
is controlled by the '/interval' parameter. The default value is 30
seconds. Use CTRL+C to close the log and return.
/volatile
Changes Driver Verifier settings without rebooting the computer.
Volatile settings take effect immediately and are in effect until the
next system reboot.
/volatile /adddriver <name> [<name> ...]
Starts the verification for the specified driver or drivers.
/volatile /removedriver <name> [<name> ...]
Stops the verification for the specified driver or drivers.
/domain {wdm | ndis | ks | audio} [rules.all | rules.default] /driver ...
[/logging | /livedump]
Controls the verifier extension settings. The following verifier
extension types are supported:
wdm Enabled verifier extension for WDM drivers.
ndis Enabled verifier extension for networking drivers.
ks Enabled verifier extension for kernel mode
streaming drivers.
audio Enabled verifier extension for audio drivers.
The following extension options are supported:
rules.default Enables default validation rules for the selected
verifier extension.
rules.all Enables all validation rules for the selected
verifier extension.
/logging
Enables logging for violated rules detected by the selected verifier
extensions.
/livedump
Enables live memory dump collection for violated rules detected by
the selected verifier extensions.
VERIFY
Tells cmd.exe whether to verify that your files are written correctly to a
disk.
VERIFY [ON | OFF]
Type VERIFY without a parameter to display the current VERIFY setting.
VOL
Displays the disk volume label and serial number, if they exist.
VOL [drive:]
XCOPY
Copies files and directory trees.
XCOPY source [destination] [/A | /M] [/D[:date]] [/P] [/S [/E]] [/V] [/W]
[/C] [/I] [/Q] [/F] [/L] [/G] [/H] [/R] [/T] [/U]
[/K] [/N] [/O] [/X] [/Y] [/-Y] [/Z] [/B] [/J]
[/EXCLUDE:file1[+file2][+file3]...] [/COMPRESS]
source Specifies the file(s) to copy.
destination Specifies the location and/or name of new files.
/A Copies only files with the archive attribute set,
doesn't change the attribute.
/M Copies only files with the archive attribute set,
turns off the archive attribute.
/D:m-d-y Copies files changed on or after the specified date.
If no date is given, copies only those files whose
source time is newer than the destination time.
/EXCLUDE:file1[+file2][+file3]...
Specifies a list of files containing strings. Each string
should be in a separate line in the files. When any of the
strings match any part of the absolute path of the file to be
copied, that file will be excluded from being copied. For
example, specifying a string like \obj\ or .obj will exclude
all files underneath the directory obj or all files with the
.obj extension respectively.
/P Prompts you before creating each destination file.
/S Copies directories and subdirectories except empty ones.
/E Copies directories and subdirectories, including empty ones.
Same as /S /E. May be used to modify /T.
/V Verifies the size of each new file.
/W Prompts you to press a key before copying.
/C Continues copying even if errors occur.
/I If destination does not exist and copying more than one file,
assumes that destination must be a directory.
/Q Does not display file names while copying.
/F Displays full source and destination file names while copying.
/L Displays files that would be copied.
/G Allows the copying of encrypted files to destination that does
not support encryption.
/H Copies hidden and system files also.
/R Overwrites read-only files.
/T Creates directory structure, but does not copy files. Does not
include empty directories or subdirectories. /T /E includes
empty directories and subdirectories.
/U Copies only files that already exist in destination.
/K Copies attributes. Normal Xcopy will reset read-only attributes.
/N Copies using the generated short names.
/O Copies file ownership and ACL information.
/X Copies file audit settings (implies /O).
/Y Suppresses prompting to confirm you want to overwrite an
existing destination file.
/-Y Causes prompting to confirm you want to overwrite an
existing destination file.
/Z Copies networked files in restartable mode.
/B Copies the Symbolic Link itself versus the target of the link.
/J Copies using unbuffered I/O. Recommended for very large files.
/COMPRESS Request network compression during file transfer where
applicable.
The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line.
W32TM
w32tm [/? | /register | /unregister ]
? - this help screen.
register - register to run as a service and add default
configuration to the registry.
unregister - unregister service and remove all configuration
information from the registry.
w32tm /monitor [/domain:<domain name>]
[/computers:<name>[,<name>[,<name>...]]]
[/threads:<num>] [/ipprotocol:<4|6>] [/nowarn]
domain - specifies which domain to monitor. If no domain name
is given, or neither the domain nor computers option is
specified, the default domain is used. This option may be
used more than once.
computers - monitors the given list of computers. Computer
names are separated by commas, with no spaces. If a name is
prefixed with a '*', it is treated as an AD PDC. This option
may be used more than once.
threads - how many computers to analyze simultaneously. The
default value is 3. Allowed range is 1-50.
ipprotocol - specify the IP protocol to use. The default is
to use whatever is available.
nowarn - skip warning message.
w32tm /ntte <NT time epoch>
Convert a NT system time, in (10^-7)s intervals from 0h 1-Jan 1601,
into a readable format.
w32tm /ntpte <NTP time epoch>
Convert an NTP time, in (2^-32)s intervals from 0h 1-Jan 1900, into
a readable format.
w32tm /resync [/computer:<computer>] [/nowait] [/rediscover] [/soft]
Tell a computer that it should resynchronize its clock as soon
as possible, throwing out all accumulated error statistics.
computer:<computer> - computer that should resync. If not
specified, the local computer will resync.
nowait - do not wait for the resync to occur;
return immediately. Otherwise, wait for the resync to
complete before returning.
rediscover - redetect the network configuration and rediscover
network sources, then resynchronize.
soft - resync utilizing existing error statistics. Not useful,
provided for compatibility.
w32tm /stripchart /computer:<target> [/period:<refresh>]
[/dataonly] [/samples:<count>] [/packetinfo] [/ipprotocol:<4|6>] [/rdtsc]
Display a strip chart of the offset between this computer and
another computer.
computer:<target> - the computer to measure the offset against.
period:<refresh> - the time between samples, in seconds. The
default is 2s
dataonly - display only the data, no graphics.
samples:<count> - collect <count> samples, then stop. If not
specified, samples will be collected until Ctrl-C is pressed.
packetinfo - print out NTP packet response message.
ipprotocol - specify the IP protocol to use. The default is
to use whatever is available.
rdtsc - display the TSC values and time offset data in CSV format.
The output displays TSC and FILETIME values captured before the
NTP request is sent, TSC value after an NTP response is received
along with NTP roundtrip and time offset values.
w32tm /config [/computer:<target>] [/update]
[/manualpeerlist:<peers>] [/syncfromflags:<source>]
[/LocalClockDispersion:<seconds>]
[/reliable:(YES|NO)]
[/largephaseoffset:<milliseconds>]
computer:<target> - adjusts the configuration of <target>. If not
specified, the default is the local computer.
update - notifies the time service that the configuration has
changed, causing the changes to take effect.
manualpeerlist:<peers> - sets the manual peer list to <peers>,
which is a space-delimited list of DNS and/or IP addresses.
When specifying multiple peers, this switch must be enclosed in
quotes.
syncfromflags:<source> - sets what sources the NTP client should
sync from. <source> should be a comma separated list of
these keywords (not case sensitive):
MANUAL - sync from peers in the manual peer list
DOMHIER - sync from an AD DC in the domain hierarchy
NO - sync from none
ALL - sync from both manual and domain peers
LocalClockDispersion:<seconds> - configures the accuracy of the
internal clock that w32time will assume when it can't acquire
time from its configured sources.
reliable:(YES|NO) - set whether this machine is a reliable time source.
This setting is only meaningful on domain controllers.
YES - this machine is a reliable time service
NO - this machine is not a reliable time service
largephaseoffset:<milliseconds> - sets the time difference between
local and network time which w32time will consider a spike.
w32tm /tz
Display the current time zone settings.
w32tm /dumpreg [/subkey:<key>] [/computer:<target>]
Display the values associated with a given registry key.
The default key is HKLM\System\CurrentControlSet\Services\W32Time
(the root key for the time service).
subkey:<key> - displays the values associated with subkey <key>
of the default key.
computer:<target> - queries registry settings for computer <target>.
w32tm /query [/computer:<target>]
{/source | /configuration | /peers | /status}
[/verbose]
Display a computer's windows time service information.
computer:<target> - query the information of <target>. If not
specified, the default is the local computer.
source: display the time source.
configuration: display the configuration of run-time and where
the setting comes from. In verbose mode, display the undefined
or unused setting too.
peers: display a list of peers and their status.
status: display windows time service status.
verbose: set the verbose mode to display more information.
w32tm /debug {/disable | {/enable /file:<name> /size:<bytes> /entries:<value>
[/truncate]}}
Enable or disable local computer windows time service private log.
disable: disable the private log.
enable: enable the private log.
file:<name> - specify the absolute filename.
size:<bytes> - specify the maximum size for circular logging.
entries:<value> - contains a list of flags, specified by number and
separated by commas, that specify the types of information that
should be logged. Valid numbers are 0 to 300. A range of numbers
is valid, in addition to single numbers, such as 0-100,103,106.
Value 0-300 is for logging all information.
truncate: truncate the file if it exists.
w32tm /leapseconds /getstatus [/verbose]
Display the status of leap seconds on the local machine.
verbose: Set the verbose mode to display more information.
WAITFOR
WaitFor has two ways of working:
Syntax 1: to send a signal
WAITFOR [/S system [/U user [/P [password]]]] /SI signal
Syntax 2: to wait for a signal
WAITFOR [/T timeout] signal
Description:
This tool sends, or waits for, a signal on a system. When /S is not
specified, the signal will be broadcasted to all the systems in a
domain. If /S is specified, then the signal will be sent only
to the specified system.
Parameter List:
/S system Specifies remote system to send signal to.
/U [domain\]user Specifies the user context under which
the command should execute.
/P [password] Specifies the password for the given user context.
/SI Sends the signal across the net to waiting machines
/T timeout Number of seconds to wait for signal. Valid range
is 1 - 99999. Default is to wait forever for signal.
signal The name of the signal to wait for or to send.
/? Displays this help message.
NOTE: A system can wait for multiple unique signal names.
The signal name cannot exceed 225 characters and cannot
contain characters other than a-z, A-Z, 0-9 and ASCII
characters in the range 128-255.
Examples:
WAITFOR /?
WAITFOR SetupReady
WAITFOR CopyDone /T 100
WAITFOR /SI SetupReady
WAITFOR /S system /U user /P password /SI CopyDone
WHERE
WHERE [/R dir] [/Q] [/F] [/T] pattern...
Description:
Displays the location of files that match the search pattern.
By default, the search is done along the current directory and
in the paths specified by the PATH environment variable.
Parameter List:
/R Recursively searches and displays the files that match the
given pattern starting from the specified directory.
/Q Returns only the exit code, without displaying the list
of matched files. (Quiet mode)
/F Displays the matched filename in double quotes.
/T Displays the file size, last modified date and time for all
matched files.
pattern Specifies the search pattern for the files to match.
Wildcards * and ? can be used in the pattern. The
"$env:pattern" and "path:pattern" formats can also be
specified, where "env" is an environment variable and
the search is done in the specified paths of the "env"
environment variable. These formats should not be used
with /R. The search is also done by appending the
extensions of the PATHEXT variable to the pattern.
/? Displays this help message.
NOTE: The tool returns an error level of 0 if the search is
successful, of 1 if the search is unsuccessful and
of 2 for failures or errors.
Examples:
WHERE /?
WHERE myfilename1 myfile????.*
WHERE $windir:*.*
WHERE /R c:\windows *.exe *.dll *.bat
WHERE /Q ??.???
WHERE "c:\windows;c:\windows\system32:*.dll"
WHERE /F /T *.dll
WHOAMI
WhoAmI has three ways of working:
Syntax 1:
WHOAMI [/UPN | /FQDN | /LOGONID]
Syntax 2:
WHOAMI { [/USER] [/GROUPS] [/CLAIMS] [/PRIV] } [/FO format] [/NH]
Syntax 3:
WHOAMI /ALL [/FO format] [/NH]
Description:
This utility can be used to get user name and group information
along with the respective security identifiers (SID), claims,
privileges, logon identifier (logon ID) for the current user
on the local system. I.e. who is the current logged on user?
If no switch is specified, tool displays the user name in NTLM
format (domain\username).
Parameter List:
/UPN Displays the user name in User Principal
Name (UPN) format.
/FQDN Displays the user name in Fully Qualified
Distinguished Name (FQDN) format.
/USER Displays information on the current user
along with the security identifier (SID).
/GROUPS Displays group membership for current user,
type of account, security identifiers (SID)
and attributes.
/CLAIMS Displays claims for current user,
including claim name, flags, type and values.
/PRIV Displays security privileges of the current
user.
/LOGONID Displays the logon ID of the current user.
/ALL Displays the current user name, groups
belonged to along with the security
identifiers (SID), claims and privileges for
the current user access token.
/FO format Specifies the output format to be displayed.
Valid values are TABLE, LIST, CSV.
Column headings are not displayed with CSV
format. Default format is TABLE.
/NH Specifies that the column header should not
be displayed in the output. This is
valid only for TABLE and CSV formats.
/? Displays this help message.
Examples:
WHOAMI
WHOAMI /UPN
WHOAMI /FQDN
WHOAMI /LOGONID
WHOAMI /USER
WHOAMI /USER /FO LIST
WHOAMI /USER /FO CSV
WHOAMI /GROUPS
WHOAMI /GROUPS /FO CSV /NH
WHOAMI /CLAIMS
WHOAMI /CLAIMS /FO LIST
WHOAMI /PRIV
WHOAMI /PRIV /FO TABLE
WHOAMI /USER /GROUPS
WHOAMI /USER /GROUPS /CLAIMS /PRIV
WHOAMI /ALL
WHOAMI /ALL /FO LIST
WHOAMI /ALL /FO CSV /NH
WHOAMI /?
WINGET
The winget command line utility enables installing applications and other packages from the command line.
usage: winget [<command>] [<options>]
The following commands are available:
install Installs the given package
show Shows information about a package
source Manage sources of packages
search Find and show basic info of packages
list Display installed packages
upgrade Shows and performs available upgrades
uninstall Uninstalls the given package
hash Helper to hash installer files
validate Validates a manifest file
settings Open settings or set administrator settings
features Shows the status of experimental features
export Exports a list of the installed packages
import Installs all the packages in a file
For more details on a specific command, pass it the help argument. [-?]
The following options are available:
-v,--version Display the version of the tool
--info Display general info of the tool
More help can be found at: https://aka.ms/winget-command-help
WINVER
This cmd command to open About Windows on Windows.
WRITE.EXE
This cmd command to open Wordpad on Windows.
WSCRIPT
This cmd command to open Windows Script Host on Windows.
https://en.wikipedia.org/wiki/Windows_Script_Host
Redirections
command > file
Redirect command output to a file
command >> file
Apend to a file
command < file
Redirect file to command
commandA | commandB
Pipe the commands output from commandA into commandB
commandA & commandB
Run commandA and then run commandB
commandA && commandB
Run commandA and if it succeeds then run commandB
commandA || commandB
Run commandA and if it fails then run commandB
commandA && commandB || commandC
If commandA succeeds run commandB, if commandA fails run commandC
(Note that if commandB fails, that will also trigger running commandC)
Redirect to NUL
Also NUL command, use hide command errors.
command 2> nul Redirect error messages to NUL
command >nul 2>&1 Redirect error and output to NUL
command >filename 2> nul Redirect output to file but suppress error
(command)>filename 2> nul Redirect output to file but suppress CMD.exe errors
Redirect multiple lines
Redirect multiple lines by bracketing a set of commands:
(
echo hi
echo bye
) > C:\log.txt
