Windows

Windows Facts

Windows Explorer Commands

  • Create new folder
    • Ctrl+Shift+N

Task Manager Commands

  • Start another Task Manager instance 
    • Ctrl-Shift-Esc
  • Restart Task Manager 
    • Ctrl-Alt-Shift
  • Start Task Manager without help from Windows Shell
    • Ctrl-Shift-Esc

CLI Commands

Windows

  • Enable Administrator Account
    • net user administrator /active:yes
  • Update policies
    • gpupdate /force
  • Last boot time
    • net stats workstation | find "since"
  • Display password expiry date for Domain user account
    • net user "Name" /domain | find /i "Password expires"
  • Display the device that last woke the PC
    • powercfg -lastwake
  • Generate a battery life report
    • powercfg -batteryreport
  • Display the devices that can wake the PC from sleep mode
    • powercfg -devicequery wake_armed
  • Find Scheduled Tasks that can wake PC from sleep mode (PowerShell as admin)
    • Get-ScheduledTask |where {$_.Settings.waketorun}
  • Permanently sets environment variable FOO=bar. Not set in current command console.
    • setx FOO bar
  • Open Startup folder
    • [Win+R] shell:startup (current user)
    • [Win+R] shell:common startup (all users)
  • Last boot time
    • systeminfo | find "Boot"
  • Names and PIDs of running processes
    • tasklist
  • Forcefully kill running process NAME
    • taskkill /f /im NAME
  • Shadow store
    • [admin] vssadmin list shadows
  • Compute digest sum of a file, e.g. MD5 or SHA256
    • certutil -hashfile FILE MD5
  • Create "junction" (symbolic link) <linkpath> to real folder <folderpath>. E.g. to create a symbolic link C:\Comix to real folder C:\Users\Bob\Documents\Comix
    • mklink /J C:\Comix C:\Users\Bob\Documents\Comix mklink /J <linkpath> <folderpath>
  • Windows version e.g. Microsoft Windows [Version 10.0.14393]
    • ver
  • Lock/unlock a file (can't be read/copied/moved)
    • cacls <File Path> /P everyone:n 
    • cacls <File Path> /P everyone:f

Network

  • latency and loss at hops between a source and destination (better tracert)
  • Turn off hiberfile.sys, saves about 8 Gb disk space for desktops that don't need hibernation
    • powercfg -h off
  • Show currently logged in users (RDP)
    • query user

Control Panels

Open Control panels from command line/Win+R
  • Add/Remove Programs
    • appwiz.cpl
  • Display Properties
    • desk.cpl
  • Computer Management
    • compmgmt.msc
  • Device Manager
    • devmgmt.msc
  • Disk Management Control Panel
    • diskmgmt.msc
  • DirectX Diagnostics
    • dxdiag
  • Event Viewer
    • eventvwr
  • Local Group Policy Editor
    • gpedit.msc
  • Fonts installed on system
    • start fonts
  • Local Users and Groups admin
    • lusrmgr
  • System Configuration: stuff like startup, boot options, services, startup programs, names of system commands
    • msconfig
  • Displays general system information
    • msinfo32
  • System Properties -> Advanced tab -> Environment Variables
    • runDll32 sysdm.cpl,EditEnvironmentVariables
  • Remote Desktop Connection to <computername>
    • mstsc /v:<computername>
  • Services
    • services.msc
  • Task Scheduler
    • taskschd.msc
  • Show Windows version in command console
    • ver
  • Show Windows version and build in dialog
    • winver

How to "Run as Admin" from Windows button

  1. Hit the "Windows" button on the keyboard
  2. Type a command to run as admin, e.g. "services"
  3. Type Ctrl-Shift-Enter to run command AS ADMIN!

Useful Event Viewer IDs

Open Windows Logs: System then filter on Event IDs 6005, 6009 to find last boot time