Windows dir Command: Syntax, Switches, and Practical Examples

The dir command lists files and directories in a given path. It is available on every Windows system, works without additional tools or modules, and is reliable in scripts, remote sessions, and recovery environments. For system administrators, it is often the first command used when inspecting an unfamiliar system or building a file inventory.

This article covers the full syntax, all available switches grouped by purpose, and practical patterns for real administrative tasks.

Syntax

dir [<drive>:][<path>][<filename>] [...] [/p] [/q] [/w] [/d] [/a[[:]<attributes>]] [/o[[:]<sortorder>]] [/t[[:]<timefield>]] [/s] [/b] [/l] [/n] [/x] [/c] [/4] [/r]

Switches Reference

Output Format

Switch	What it does	When to use
`/B`	Bare output — filenames only, no headers or totals	Always use when redirecting output to a file or pipe
`/W`	Wide format — filenames in columns, no metadata	Quick visual scan of a large directory
`/D`	Same as `/W` but sorted by column	Alternative to `/W` for column-first reading
`/N`	Long list format with filenames on the far right	When short 8.3 names are present alongside long names
`/X`	Shows both short 8.3 name and long name	Legacy apps or scripts that require 8.3 paths
`/L`	Outputs names in lowercase	Piping into case-sensitive tools or scripts
`/-C`	Removes thousand separator from file sizes	Script parsing — separator breaks numeric processing
`/4`	Shows years in four-digit format	Audit logs and exports where two-digit years are ambiguous
`/P`	Pauses after each screenful	Interactive browsing only — do not use in scripts

Filtering by Attribute

Use /A with a modifier to filter by file attribute. Without a modifier, shows all files including hidden and system. Modifiers can be combined: /A:HS matches files that are both hidden and system. Prefix with - to negate: /A:-D shows everything except directories.

Modifier	Shows
`/A:H`	Hidden files
`/A:S`	System files
`/A:D`	Directories only
`/A:R`	Read-only files
`/A:A`	Files with archive bit set
`/A:L`	Reparse points — symlinks and junctions
`/A:I`	Files excluded from content indexing
`/A:-D`	All files, excluding directories

Recursion

/S includes all subdirectories. By itself it produces verbose output. Combined with /B it produces a flat list of full paths — the most useful pattern for scripting and auditing.

dir /S /B *.log

Sorting

Use /O with a modifier to sort output. Prefix with - to reverse the order. Modifiers can be combined: /O:GN lists directories first, then files alphabetically.

Modifier	Sort by	Example
`/O:N`	Name (A–Z)	`dir /O:N`
`/O:E`	Extension (A–Z)	`dir /O:E`
`/O:S`	Size (smallest first)	`dir /O:-S` for largest first
`/O:D`	Date/time (oldest first)	`dir /O:-D` for newest first
`/O:G`	Directories listed first	`dir /O:GN`

Timestamps

Use /T to control which timestamp is displayed and used for date sorting.

Modifier	Timestamp	Example
`/T:C`	Creation time	`dir /T:C /O:D`
`/T:A`	Last accessed	`dir /T:A /O:-D`
`/T:W`	Last written (default)	`dir /T:W /O:-D`

Security and Advanced

/Q — Shows the owner of each file. Requires read permission on the file’s security descriptor. May not resolve ownership correctly across domain boundaries or on shares with restricted ACLs.

/R — Shows alternate data streams (ADS) attached to files. Relevant for security audits — malware sometimes uses ADS to hide payloads.

Admin Tasks with Examples

Find all log files recursively, sorted by size

Useful before a cleanup operation to understand what takes the most space.

dir C:\inetpub\logs /S /B *.log /O:-S

C:\inetpub\logs\LogFiles\W3SVC1\u_ex260101.log
C:\inetpub\logs\LogFiles\W3SVC1\u_ex260315.log
C:\inetpub\logs\LogFiles\W3SVC2\u_ex260310.log

Export a full file index to a text file

Standard input for batch scripts, PowerShell pipelines, or audit documentation.

dir C:\Backup /S /B > filelist.txt

C:\Backup\configs\server01.xml
C:\Backup\configs\server02.xml
C:\Backup\scripts\deploy.ps1
C:\Backup\logs\backup_2026-03-01.log

List hidden files in a user profile

Used during malware investigations, GPO audits, or profile cleanup.

dir C:\Users\jsmith /A:H /S /B

C:\Users\jsmith\AppData\Local\Temp\~DF3A12.tmp
C:\Users\jsmith\NTUSER.DAT
C:\Users\jsmith\ntuser.dat.LOG1
C:\Users\jsmith\ntuser.ini

Find all symlinks and junctions under a path

Useful when diagnosing unexpected path redirections or auditing storage layout.

dir C:\inetpub /A:L /S

 Directory of C:\inetpub

03/15/2026  09:14 AM    <JUNCTION>     logs [C:\Logs\IIS]
03/10/2026  02:45 PM    <SYMLINKD>     wwwroot_old [C:\OldSite\wwwroot]
               0 File(s)              0 bytes
               2 Dir(s)   48,302,415,872 bytes free

Audit file ownership in a shared folder

dir C:\Shares\Finance /Q /B

CORP\svc-backup        budget_2025.xlsx
CORP\j.wilson          forecast_Q1.xlsx
BUILTIN\Administrators salaries_confidential.xlsx
CORP\svc-backup        archive_2024.zip

Find stale files by last access time

dir C:\Logs /T:A /O:D

 Directory of C:\Logs

01/04/2026  06:30 AM             8,192 app_old.log
01/19/2026  11:15 PM            24,576 system.log
03/01/2026  08:00 AM           102,400 iis_access.log
03/15/2026  04:22 PM             4,096 debug.log
               4 File(s)        139,264 bytes
               0 Dir(s)   48,302,415,872 bytes free

Redirecting Output

dir output can be sent to a file using standard shell redirection. > creates or overwrites the file. >> appends to an existing file.

dir /S /B *.log > loglist.txt
dir /S /B *.log >> loglist.txt

When redirecting, use /B and /A:-D together to get a clean list of file paths only — no headers, totals, or directory entries. This makes the output directly usable as script input.

dir /S /B /A:-D > filelist.txt

Things to Know Before Using dir in Scripts

Output encoding

cmd.exe uses the system OEM code page by default. On Russian Windows this is typically CP866. If you redirect dir output to a file and open it in a UTF-8 editor, extended characters in filenames may appear corrupted.

Before switching, check the currently active code page:

chcp

Active code page: 866

chcp (Change Code Page) changes the active encoding for the current cmd.exe session only — it does not affect system settings or other sessions. Note the original value, switch to UTF-8, run the command, then restore:

chcp 65001
dir /S /B > output.txt
chcp 866

The console font must also support the target encoding for characters to render correctly on screen. The file content will be correctly encoded regardless.

UNC paths

dir \\server\share works, but /Q may not resolve file owners correctly across domain boundaries or on shares with restricted ACL access.

No regex support

dir supports only * and ? wildcards. For pattern-based filtering that requires regular expressions, use PowerShell Get-ChildItem with -Filter or -Include.

dir is a cmd.exe built-in

It is not a standalone executable. When calling it from PowerShell, wrap it in cmd /c:

cmd /c dir /S /B *.log

In PowerShell scripts, Get-ChildItem is the native alternative and should be preferred. For a full comparison of dir vs Get-ChildItem see: (article in progress)

Quick Reference

Command	What it does
`dir /B`	Filenames only, no metadata
`dir /S /B *.log`	All matching files, full paths
`dir /A:H /S /B`	All hidden files recursively
`dir /A:L`	All symlinks and junctions
`dir /O:-S`	Sorted by size, largest first
`dir /T:A /O:D`	Sorted by last access, oldest first
`dir /Q /B`	Filenames with owner
`dir /R`	Show alternate data streams
`dir /S /B /A:-D > list.txt`	Clean file index export