sc vs net:sc uses the internal service name (e.g. Spooler). net start/stop uses the display name (e.g. "Print Spooler"). Note the space after start= in sc config - it is required.
netstat -b requires admin: Without elevation it returns "The operation requires elevation". Run CMD as Administrator to see process names per connection.
wmic is gone: WMIC was removed from Windows 11 24H2 and 25H2 and is no longer available as a Feature on Demand, so the commands above are the PowerShell CIM replacements. WMIC still ships on Windows Server 2016 to 2022, where wmic os get caption,version,buildnumber and friends continue to work.
Users & Permissions
Command
What It Does
net user
List all local user accounts
net user username
Show details for a specific user
net user username pass /add
Create a new local user
net user username newpass
Change user password
net user username /active:no
Disable a user account
net user username /delete
Delete a user account
whoami
Show current user name
whoami /groups
List current user's group memberships
Command
What It Does
net localgroup
List all local groups
net localgroup Administrators
Show Administrators group members
net localgroup Administrators user /add
Add user to Administrators
net localgroup Administrators user /delete
Remove user from Administrators
whoami /priv
List current user's privileges
runas /user:DOMAIN\admin cmd.exe
Run CMD as another user
net accounts
Show password and lockout policy
net session
List active network sessions (admin)
Command
What It Does
icacls C:\Folder
Show NTFS permissions
icacls file.txt /grant "User:(R)"
Grant read permission
icacls file.txt /grant "Users:(F)"
Grant full control
icacls file.txt /deny "User:(W)"
Explicitly deny write access
Command
What It Does
icacls C:\Folder /grant "User:(OI)(CI)(M)"
Modify on folder + subfolders + files
icacls file.txt /remove "User"
Remove all permissions for a user
icacls C:\Folder /reset /t
Reset to inherited defaults (recursive)
icacls C:\Folder /save perms.txt /t
Export permissions to file
Flag
Permission Level
F
Full control
M
Modify (read, write, execute, delete)
RX
Read and execute
R
Read only
W
Write only
Flag
Inheritance
(OI)
Object inherit - applies to files in folder
(CI)
Container inherit - applies to subfolders
(IO)
Inherit only - not applied to the folder itself
(NP)
No propagate - do not inherit further down
(I)
Inherited from parent container
Disk & Storage
Command
What It Does
chkdsk C:
Check disk for errors (read-only)
chkdsk C: /f
Fix file system errors. On the volume Windows is running from it cannot take the lock, so it offers to schedule the check for the next reboot instead
chkdsk C: /r
Find bad sectors + recover data
fsutil volume diskfree C:
Show free space for a volume
fsutil file createnew test.bin 1073741824
Create a 1 GB test file
vol C:
Show volume label and serial number
Command
What It Does
label C: NewLabel
Change volume label
subst Z: "C:\Long\Path"
Map folder to virtual drive letter
subst Z: /d
Remove virtual drive mapping
subst
List all active virtual drive mappings
defrag C: /u /v
Defragment drive with progress output
diskpart
Open diskpart interactive shell (admin)
Diskpart commands (run inside diskpart shell)
Command
What It Does
list disk
List all physical disks
select disk 1
Select disk 1
list partition
List partitions on selected disk
list volume
List all volumes
select volume 3
Select volume 3
Command
What It Does
assign letter=Z
Assign drive letter to selected volume
remove letter=Z
Remove drive letter
online disk
Bring an offline disk online
attributes disk clear readonly
Remove read-only flag from disk
exit
Exit diskpart
Diskpart is destructive: No undo. Always double-check select disk before any operation. Selecting the wrong disk and cleaning it permanently destroys all data.
Always export before editing:reg export HKCU\Software\MyApp backup.reg - there is no undo for deleted keys.
Event Logs & Diagnostics
wevtutil - Event Logs
Command
What It Does
wevtutil el
List all available event logs
wevtutil gl System
Get configuration of a log
wevtutil qe System /c:20 /f:text /rd:true
Last 20 System events as text
wevtutil cl Application
Clear Application event log (admin)
Command
What It Does
wevtutil qe Security /q:"*[System[EventID=4625]]" /c:10 /f:text /rd:true
Last 10 failed logons (ID 4625)
wevtutil epl System C:\backup\system.evtx
Export log to file
eventvwr
Open Event Viewer GUI
eventvwr /l:C:\backup\system.evtx
Open a saved .evtx file
System Diagnostics
Command
What It Does
sfc /scannow
Scan and repair system files (admin)
sfc /verifyonly
Scan only, no repair
DISM /Online /Cleanup-Image /CheckHealth
Quick check for component store issues
DISM /Online /Cleanup-Image /ScanHealth
Full component store scan
DISM /Online /Cleanup-Image /RestoreHealth
Repair using Windows Update
Command
What It Does
gpresult /r
Show applied Group Policy (user + computer)
gpresult /h gpreport.html
Generate full GPO report as HTML
gpupdate /force
Force immediate Group Policy refresh
msconfig
System Config: startup, services, boot
perfmon /report
Generate performance diagnostic report
Batch Scripting Essentials
Syntax
Meaning
set name=value
Define a variable (no spaces around =)
echo %name%
Print variable value
set /p name=Enter value:
Prompt user for input
set /a result=5+3
Arithmetic expression
setlocal enabledelayedexpansion
Enable !var! inside blocks
echo !name!
Delayed expansion (inside for/if blocks)
Syntax
Meaning
@echo off
Suppress command echoing
echo.
Print a blank line
pause
Wait for keypress
rem This is a comment
Comment line
:: This is a comment
Alternative comment (faster)
title My Script
Set CMD window title
Syntax
Meaning
if "%1"=="" goto usage
Check if argument is empty
if exist file.txt echo found
Check if file exists
if not exist file.txt goto end
Jump if file does not exist
if /i "%var%"=="yes"
Case-insensitive string compare
if %ERRORLEVEL% neq 0 goto fail
Check last exit code
Syntax
Meaning
goto label
Jump to a label
:label
Define a jump target
call :subroutine
Call sub-routine and return
call other.bat arg1
Call another script
exit /b 0
Exit with code (0=success, 1=error)
ERRORLEVEL: Use if %ERRORLEVEL% neq 0 rather than if errorlevel 1 - the latter is true for any value ≥ 1 and can cause unexpected behavior.
Syntax
Meaning
for %%f in (*.txt) do echo %%f
Loop over files matching pattern
for /r C:\Folder %%f in (*.log) do del "%%f"
Recursive loop over files
for /l %%i in (1,1,10) do echo %%i
Numeric loop 1 to 10, step 1
Syntax
Meaning
for /f "tokens=1,2" %%a in (file.txt) do ...
Parse lines, split into tokens
for /f "delims=," %%a in (data.csv) do ...
Parse CSV with comma delimiter
for /d %%d in (C:\*) do echo %%d
Loop over directories only
%% vs %: Use %%f inside .bat files, use %f when typing directly in CMD interactively.
Syntax
Meaning
%1 %2 %3
Script arguments by position
%0
The script name itself
%*
All arguments as a single string
shift
Shift arguments: %2 becomes %1, etc.
Syntax
Meaning
%~f1
Argument 1 expanded to full path
%~d1
Drive letter only (e.g. C:)
%~p1
Path only (without filename)
%~dp0
Directory of the script itself
CMD vs PowerShell: When to Use Which
Task
Use CMD
Use PowerShell
Quick one-liner
✓ Often shorter syntax
More verbose but precise
Robust file copy
✓ robocopy is native
Possible but more complex
Simple batch scripts
✓ .bat files run everywhere
Execution policy can block .ps1
Managing services
sc / net work fine
✓ Richer output, pipeline support
Filtering & sorting output
Text parsing with find, findstr
✓ Real objects, native filtering
Remoting to other machines
Limited (psexec, WMI)
✓ Built-in PSRemoting
Active Directory
Basic (net user only)
✓ Full AD module
Error handling
ERRORLEVEL only
✓ try/catch, exceptions
Registry editing
✓ reg command is quick
Also possible via PSDrive
Compatibility (old systems)
✓ Works back to Windows XP
Requires PS version check
General rule: Use CMD for quick tasks and scripts that need to run everywhere without configuration. Use PowerShell for anything involving filtering, automation, or Windows APIs. For new scripts, PowerShell 7 is the modern standard.
FAQ
How do I run CMD as Administrator?
Three ways: (1) Press Win+X and choose Terminal (Admin). (2) Search for cmd in Start, right-click → Run as administrator. (3) From an existing CMD: powershell -c "Start-Process cmd -Verb RunAs". Note that runas /user:... only switches the user, it does not elevate, and the built-in Administrator account is disabled by default. Many commands silently fail or return "Access is denied" without elevation - when in doubt, run as admin.
How do I find which process is using a specific port?
Run as Administrator: netstat -ano | find ":80" - the PID is in the last column. Then: tasklist /fi "pid eq 1234" to get the process name. One-liner: for /f "tokens=5" %a in ('netstat -ano ^| find ":80" ^| find "LISTENING"') do tasklist /fi "pid eq %a"
What is the difference between xcopy and robocopy?
xcopy is older and simpler. robocopy supports resume on failure, bandwidth throttling (/ipg), mirroring (/mir), detailed logging, and preserving all NTFS attributes. For anything beyond a simple one-time copy, use robocopy. xcopy is considered legacy.
Why does my variable show as empty inside a for loop?
CMD expands %variables% when a line is parsed, not when it executes. Inside code blocks the entire block is parsed at once. The fix: add setlocal enabledelayedexpansion at the top of your script, then use !var! instead of %var% inside for and if blocks.
How do I suppress all output from a command?
To suppress stdout and stderr: command > nul 2>&1. Stderr only: command 2> nul. Stdout only: command > nul. To capture everything to a log instead: command >> script.log 2>&1
What is the difference between & and && when chaining commands?
& runs both commands regardless of result. && runs the second only if the first succeeded (ERRORLEVEL 0). || runs the second only if the first failed. Example: mkdir logs && cd logs changes into the directory only if mkdir succeeded.
How do I schedule a command to run automatically?
Use schtasks: schtasks /create /tn "MyTask" /tr "C:\Scripts\backup.bat" /sc daily /st 02:00 creates a task that runs daily at 2am. View existing tasks: schtasks /query /fo list. For a GUI: run taskschd.msc.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
