🪟 Complete Cheatsheet — Windows Sysadmin (CMD + PowerShell)

Practical command reference for administering Windows Server and Desktop environments: diagnostics, networking, users, Active Directory, services, disk, security, and troubleshooting.

Index

1. System Information

2. Network

3. Processes and Services

4. Disk and Storage

5. Local Users and Groups

6. Active Directory / Domain

7. GPO (Group Policy)

8. Windows Registry

9. Permissions and Security (NTFS/ACL)

10. Firewall

11. Logs and Events

12. Task Scheduling

13. Windows Updates (WSUS/Update)

14. Hyper-V / Virtualization

15. DNS and DHCP (Server)

16. IIS (Web Server)

17. PowerShell Remoting (WinRM)

18. Backup and Restore

19. Diagnostics and Performance

20. Miscellaneous / Utilities

💡 Legend: commands with no indication are native CMD. Commands marked (PS) are PowerShell. Commands marked (GUI) open a graphical window. Commands marked (Legacy) still work but have a recommended modern replacement.

1. System Information

• systeminfo — displays system details (OS, BIOS, hotfixes, memory)

• systeminfo /s SERVIDOR /u DOMINIO\usuario /p senha — same query on remote machine

• hostname — returns computer name

• whoami — shows current user

• whoami /all — displays user, groups, and privileges

• winver (GUI) — window with Windows version

• ver — Windows version via prompt

• wmic os get caption,version,buildnumber (Legacy) — OS version and build via WMIC

• Get-ComputerInfo (PS) — detailed system information

• Get-HotFix (PS) — lists installed patches/hotfixes

• wmic qfe list (Legacy) — lists hotfixes via WMIC

• Get-CimInstance Win32_OperatingSystem (PS) — OS details via CIM

• msinfo32 (GUI) — system information in graphical mode

• dxdiag (GUI) — DirectX/graphics hardware diagnostics

• bcdedit — displays/edits boot configuration (BCD)

• slmgr /xpr — checks Windows activation status/expiration

• slmgr /dlv — complete license details

2. Network

2.1 Basic Configuration

• ipconfig — basic IP configuration

• ipconfig /all — complete IP configuration (DNS, gateway, MAC, DHCP)

• ipconfig /release — releases current DHCP IP

• ipconfig /renew — renews IP via DHCP

• ipconfig /flushdns — clears DNS resolution cache

• ipconfig /displaydns — displays current DNS cache

• ipconfig /registerdns — forces DNS re-registration (DDNS environment)

• Get-NetIPAddress (PS) — lists configured IPs

• Get-NetAdapter (PS) — lists network adapters

• Get-NetAdapter | Restart-NetAdapter (PS) — restarts all adapters

• New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.1.10 -PrefixLength 24 -DefaultGateway 192.168.1.1 (PS) — sets static IP

• Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 8.8.8.8,1.1.1.1 (PS) — sets DNS servers

• netsh interface ip set address "Ethernet" static 192.168.1.10 255.255.255.0 192.168.1.1 — static IP via netsh

• netsh interface ip set dns "Ethernet" static 8.8.8.8 — DNS via netsh

• netsh interface ip set address "Ethernet" dhcp — back to DHCP

2.2 Diagnostics

• ping host — tests ICMP connectivity

• ping -t host — continuous ping

• ping -n 10 host — sets number of packets

• tracert host — traces route to destination

• tracert -d host — traceroute without name resolution (faster)

• pathping host — combines ping + tracert (per-hop loss statistics)

• nslookup host — simple DNS query

• nslookup host servidorDNS — DNS query using specific server

• nslookup -type=MX dominio.com — queries MX records

• Resolve-DnsName host (PS) — modern equivalent to nslookup

• Test-Connection host (PS) — equivalent to ping

• Test-NetConnection host -Port 443 (PS) — tests TCP connectivity on specific port

• telnet host porta — tests TCP connection (requires enabling feature)

• netstat -ano — lists active connections with PID

• netstat -an | findstr LISTENING — filters listening ports

• netstat -rn — shows routing table

• route print — displays routing table

• route add 10.0.0.0 mask 255.255.255.0 192.168.1.1 — adds static route

• arp -a — shows ARP table

• getmac — displays MAC address of interfaces

• Get-NetTCPConnection (PS) — TCP connections, equivalent to netstat

• Get-NetRoute (PS) — routing table

2.3 Network Shares (SMB/CIFS)

• net share — lists active shares

• net share Nome=C:\Pasta /grant:usuario,FULL — creates share with permission

• net use Z: \\servidor\compartilhamento — maps network drive

• net use Z: \\servidor\compartilhamento /user:dominio\usuario senha /persistent:yes — maps drive with persistent credentials

• net use Z: /delete — removes drive mapping

• net view \\servidor — lists shares from a remote server

• New-SmbShare -Name "Dados" -Path "C:\Dados" -FullAccess "DOMINIO\Grupo" (PS) — creates SMB share

• Get-SmbShare (PS) — lists shares

• Get-SmbConnection (PS) — active SMB connections

• Get-SmbOpenFile (PS) — files opened via SMB

3. Processes and Services

3.1 Processes

• tasklist — lists running processes

• tasklist /v — lists processes with details (user, status)

• tasklist /svc — lists processes with associated services

• taskkill /PID 1234 /F — terminates process by PID (forced)

• taskkill /IM notepad.exe /F — terminates process by name

• Get-Process (PS) — lists processes

• Stop-Process -Name notepad -Force (PS) — terminates process

• Get-Process | Sort-Object CPU -Descending | Select -First 10 (PS) — top 10 processes by CPU

3.2 Services

• sc query — lists status of all services

• sc query nomeservico — status of a specific service

• sc start nomeservico — starts a service

• sc stop nomeservico — stops a service

• sc config nomeservico start= auto — sets automatic startup

• sc config nomeservico start= disabled — disables the service

• sc delete nomeservico — removes a service

• net start — lists running services

• net start nomeservico — starts service (alternative syntax)

• net stop nomeservico — stops service

• Get-Service (PS) — lists services

• Get-Service nomeservico | Restart-Service (PS) — restarts service

• Set-Service nomeservico -StartupType Automatic (PS) — sets startup type

• services.msc (GUI) — graphical services console

3.3 System / Restart

• taskmgr (GUI) — Task Manager

• Restart-Computer -Force (PS) — restarts the computer

• shutdown /r /t 0 — restarts immediately

• shutdown /s /t 0 — shuts down immediately

• shutdown /r /t 60 /c "Manutenção programada" — restarts in 60s with message

• shutdown /a — cancels scheduled shutdown

• shutdown /m \\servidor /r /t 0 — restarts remote server

4. Disk and Storage

• diskpart — partition utility (interactive)

• chkdsk C: — checks disk errors

• chkdsk C: /f /r — fixes errors and bad sectors (requires reboot if boot disk)

• sfc /scannow — scans and repairs protected system files

• DISM /Online /Cleanup-Image /CheckHealth — checks Windows image integrity

• DISM /Online /Cleanup-Image /ScanHealth — scans image corruption

• DISM /Online /Cleanup-Image /RestoreHealth — repairs image using Windows Update/source

• defrag C: /A — analyzes fragmentation

• defrag C: /O — optimizes the drive (HDD defragments, SSD trims)

• fsutil volume diskfree C: — free/total space on volume

• fsutil fsinfo drives — lists available drives

• fsutil dirty query C: — checks if volume is marked "dirty"

• vssadmin list shadows — lists shadow copies (Volume Shadow Copy)

• vssadmin create shadow /for=C: — creates shadow copy

• vssadmin delete shadows /for=C: /oldest — removes oldest shadow copy

• Get-Volume (PS) — lists volumes

• Get-Disk (PS) — lists physical disks

• Get-Partition (PS) — lists partitions

• Get-PhysicalDisk | Get-StorageReliabilityCounter (PS) — disk SMART health

• Resize-Partition -DriveLetter C -Size 100GB (PS) — resizes partition

• New-Volume -DiskNumber 1 -FriendlyName "Dados" -FileSystem NTFS (PS) — creates volume

• Format-Volume -DriveLetter D -FileSystem NTFS -NewFileSystemLabel "Dados" (PS) — formats volume

• mountvol — lists/manages mount points

• cleanmgr (GUI) — disk cleanup

• manage-bde -status — BitLocker status on all volumes

• manage-bde -on C: — enables BitLocker on volume C:

• manage-bde -off C: — disables BitLocker

5. Local Users and Groups

• net user — lists local users

• net user nomeusuario — details of a user

• net user nomeusuario senha /add — creates local user

• net user nomeusuario /delete — removes local user

• net user nomeusuario /active:no — disables user account

• net user nomeusuario novasenha — resets password

• net user nomeusuario /expires:never — sets account to never expire

• net localgroup — lists local groups

• net localgroup Administradores — lists members of Administrators group

• net localgroup Administradores nomeusuario /add — adds user to group

• net localgroup Administradores nomeusuario /delete — removes user from group

• Get-LocalUser (PS) — lists local users

• New-LocalUser "joao" -Password (ConvertTo-SecureString "Senha123!" -AsPlainText -Force) (PS) — creates local user

• Remove-LocalUser -Name "joao" (PS) — removes user

• Set-LocalUser -Name "joao" -Password $senha (PS) — changes password

• Get-LocalGroupMember "Administrators" (PS) — lists group members

• Add-LocalGroupMember -Group "Administrators" -Member "joao" (PS) — adds to group

• lusrmgr.msc (GUI) — local users and groups

• control userpasswords2 (GUI) — advanced account management

6. Active Directory / Domain

Requires ActiveDirectory module (RSAT) installed.

• dsquery user -name "joao*" (Legacy) — searches for user in AD

• dsquery computer (Legacy) — lists computers in AD

• dsget user "CN=Joao,OU=TI,DC=empresa,DC=local" -memberof (Legacy) — shows groups of a user

• whoami /fqdn — fully qualified DN of current user

• nltest /dsgetdc:dominio.local — locates Domain Controller

• nltest /sc_query:dominio.local — checks secure channel with DC

• gpresult /r — GPOs applied to current user/computer

• gpupdate /force — forces Group Policy update

• dcdiag — complete Domain Controller diagnostics

• dcdiag /v — detailed diagnostics (verbose)

• repadmin /replsummary — summary of replication status between DCs

• repadmin /showrepl — detailed replication status

• netdom query dc — lists Domain Controllers in domain

• netdom query fsmo — shows FSMO role holders

• Get-ADUser -Filter * (PS) — lists AD users

• Get-ADUser -Identity joao -Properties * (PS) — complete user details

• New-ADUser -Name "Joao Silva" -SamAccountName joao -Enabled $true -AccountPassword $senha (PS) — creates user in AD

• Set-ADUser joao -Department "TI" (PS) — edits user attribute

• Disable-ADAccount -Identity joao (PS) — disables account

• Unlock-ADAccount -Identity joao (PS) — unlocks account

• Get-ADGroup -Filter * (PS) — lists groups

• Add-ADGroupMember -Identity "TI" -Members joao (PS) — adds user to group

• Get-ADGroupMember -Identity "TI" (PS) — lists group members

• Get-ADComputer -Filter * (PS) — lists domain computers

• Get-ADOrganizationalUnit -Filter * (PS) — lists OUs

• Get-ADDomainController -Filter * (PS) — lists Domain Controllers

• Get-ADDefaultDomainPasswordPolicy (PS) — default domain password policy

• Search-ADAccount -LockedOut (PS) — lists locked out accounts

• Search-ADAccount -PasswordExpired (PS) — lists accounts with expired passwords

• Move-ADObject -Identity "CN=Joao,..." -TargetPath "OU=Nova,DC=..." (PS) — moves object between OUs

• dsa.msc (GUI) — AD Users and Computers

• dssite.msc (GUI) — AD Sites and Services

7. GPO (Group Policy)

• gpedit.msc (GUI) — Local Group Policy Editor

• gpmc.msc (GUI) — GPO Management (domain)

• gpupdate /force — applies GPOs immediately

• gpupdate /target:computer — updates only computer policies

• gpupdate /target:user — updates only user policies

• gpresult /r — summary of applied GPOs

• gpresult /h relatorio.html — generates detailed HTML GPO report

• Get-GPO -All (PS) — lists all GPOs

• New-GPO -Name "Politica-TI" (PS) — creates new GPO

• New-GPLink -Name "Politica-TI" -Target "OU=TI,DC=empresa,DC=local" (PS) — links GPO to an OU

• Backup-GPO -Name "Politica-TI" -Path C:\Backup (PS) — GPO backup

• Get-GPOReport -All -ReportType HTML -Path C:\relatorio.html (PS) — report of all GPOs

8. Windows Registry

• regedit (GUI) — Registry Editor

• reg query HKLM\Software\Microsoft — queries a registry key

• reg add HKLM\Software\Teste /v Chave /t REG_SZ /d Valor — adds/edits value

• reg delete HKLM\Software\Teste /v Chave /f — removes value

• reg export HKLM\Software\Teste C:\backup.reg — exports key to file

• reg import C:\backup.reg — imports key from file

• reg save HKLM\SAM C:\sam.hiv — saves registry hive

• Get-ItemProperty -Path "HKLM:\Software\Teste" (PS) — reads registry values

• Set-ItemProperty -Path "HKLM:\Software\Teste" -Name "Chave" -Value "Valor" (PS) — sets value

• New-Item -Path "HKLM:\Software\Teste" (PS) — creates key

• Remove-Item -Path "HKLM:\Software\Teste" -Recurse (PS) — removes key

9. Permissions and Security (NTFS/ACL)

• icacls C:\Pasta — shows NTFS permissions on folder

• icacls C:\Pasta /grant usuario:(OI)(CI)F — grants full control (recursive)

• icacls C:\Pasta /grant usuario:RX — grants read and execute

• icacls C:\Pasta /remove usuario — removes permissions for a user

• icacls C:\Pasta /reset /T — restores default inheritance (recursive)

• icacls C:\Pasta /save permissoes.acl /T — exports permissions to file

• icacls C:\Pasta /restore permissoes.acl — restores permissions from file

• takeown /f C:\Pasta /r /d y — takes ownership of files/folders (recursive)

• cacls (Legacy) — old version of icacls, avoid

• Get-Acl C:\Pasta (PS) — reads folder ACL

• Set-Acl C:\Pasta -AclObject $acl (PS) — applies ACL

• whoami /priv — lists current user privileges

• secedit /export /cfg C:\policy.cfg — exports local security policy

• secedit /configure /db secedit.sdb /cfg policy.cfg — applies security policy from file

• auditpol /get /category:* — shows current audit configuration

• auditpol /set /subcategory:"Logon" /success:enable /failure:enable — enables logon auditing

10. Firewall

• netsh advfirewall show allprofiles — firewall status (all profiles)

• netsh advfirewall set allprofiles state on — enables firewall on all profiles

• netsh advfirewall set allprofiles state off — disables firewall (all profiles)

• netsh advfirewall firewall show rule name=all — lists all rules

• netsh advfirewall firewall add rule name="Abrir 8080" dir=in action=allow protocol=TCP localport=8080 — creates inbound rule

• netsh advfirewall firewall delete rule name="Abrir 8080" — removes rule by name

• netsh advfirewall reset — restores default firewall settings

• Get-NetFirewallRule (PS) — lists firewall rules

• New-NetFirewallRule -DisplayName "Abrir 8080" -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow (PS) — creates rule

• Remove-NetFirewallRule -DisplayName "Abrir 8080" (PS) — removes rule

• Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True (PS) — enables firewall on all profiles

• Show-NetFirewallRule | Where Enabled -eq True (PS) — lists only active rules

• wf.msc (GUI) — Windows Firewall with Advanced Security

11. Logs and Events

• eventvwr.msc (GUI) — Event Viewer

• wevtutil el — lists all available event logs

• wevtutil qe System /c:10 /rd:true /f:text — displays last 10 events from System log

• wevtutil cl System — clears System log

• wevtutil epl System C:\backup-system.evtx — exports log to file

• Get-EventLog -LogName System -Newest 50 (PS) — last 50 events (classic logs)

• Get-WinEvent -LogName System -MaxEvents 50 (PS) — last 50 events (modern logs)

• Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 20 (PS) — filters only errors (Level=2)

• Get-EventLog -LogName Application -EntryType Error -Newest 20 (PS) — recent errors in application log

• Clear-EventLog -LogName Application (PS) — clears application log

• Get-WinEvent -ListLog * (PS) — lists all available logs

12. Task Scheduling

• schtasks /query — lists scheduled tasks

• schtasks /query /fo LIST /v — detailed list of tasks

• schtasks /create /tn "Backup" /tr "C:\script.bat" /sc daily /st 02:00 — creates daily task at 02:00

• schtasks /create /tn "Reboot" /tr "shutdown /r" /sc weekly /d SUN /st 03:00 — creates weekly task

• schtasks /run /tn "Backup" — runs task immediately

• schtasks /delete /tn "Backup" /f — removes task

• schtasks /change /tn "Backup" /disable — disables task

• taskschd.msc (GUI) — Task Scheduler

• Get-ScheduledTask (PS) — lists scheduled tasks

• Register-ScheduledTask -TaskName "Backup" -Trigger $trigger -Action $action (PS) — creates scheduled task

• Start-ScheduledTask -TaskName "Backup" (PS) — runs task

• Unregister-ScheduledTask -TaskName "Backup" -Confirm:$false (PS) — removes task

13. Windows Updates (WSUS/Update)

• wuauclt /detectnow (Legacy) — forces update detection (older builds)

• Get-WindowsUpdateLog (PS) — generates readable update log

• Install-Module PSWindowsUpdate (PS) — installs update management module

• Get-WindowsUpdate (PS, requires module) — lists available updates

• Install-WindowsUpdate -AcceptAll -AutoReboot (PS, requires module) — installs all pending updates

• Get-HotFix (PS) — lists installed patches

• DISM /Online /Get-Packages — lists installed packages/updates via DISM

• wusa /uninstall /kb:5001234 — removes a specific KB

• sconfig — simplified configuration menu (Server Core), includes updates

14. Hyper-V / Virtualization

• Get-VM (PS) — lists virtual machines

• Start-VM -Name "VM01" (PS) — starts VM

• Stop-VM -Name "VM01" (PS) — stops VM (graceful)

• Stop-VM -Name "VM01" -TurnOff (PS) — forces VM shutdown

• Restart-VM -Name "VM01" (PS) — restarts VM

• New-VM -Name "VM02" -MemoryStartupBytes 4GB -NewVHDPath "C:\VMs\vm02.vhdx" -NewVHDSizeBytes 60GB (PS) — creates new VM

• Get-VMSwitch (PS) — lists virtual switches

• New-VMSwitch -Name "vSwitch-Externo" -NetAdapterName "Ethernet" (PS) — creates external virtual switch

• Checkpoint-VM -Name "VM01" (PS) — creates VM checkpoint/snapshot

• Get-VMSnapshot -VMName "VM01" (PS) — lists VM snapshots

• Restore-VMSnapshot -VMName "VM01" -Name "Checkpoint1" (PS) — restores snapshot

• Get-VMHardDiskDrive -VMName "VM01" (PS) — lists attached virtual disks

• Resize-VHD -Path C:\VMs\vm01.vhdx -SizeBytes 100GB (PS) — resizes virtual disk

• Export-VM -Name "VM01" -Path D:\Backup (PS) — exports complete VM

• Import-VM -Path D:\Backup\VM01\Virtual Machines\xxx.vmcx (PS) — imports VM

• Enable-VMMigration (PS) — enables Live Migration on host

• Move-VM -Name "VM01" -DestinationHost "HOST02" (PS) — live migration of VM

• virtmgmt.msc (GUI) — Hyper-V Manager

15. DNS and DHCP (Server)

15.1 DNS Server

• Get-DnsServerZone (PS) — lists configured DNS zones

• Add-DnsServerPrimaryZone -Name "empresa.local" -ZoneFile "empresa.local.dns" (PS) — creates primary zone

• Add-DnsServerResourceRecordA -ZoneName "empresa.local" -Name "srv01" -IPv4Address "192.168.1.10" (PS) — creates A record

• Get-DnsServerResourceRecord -ZoneName "empresa.local" (PS) — lists zone records

• Remove-DnsServerResourceRecord -ZoneName "empresa.local" -Name "srv01" -RRType A (PS) — removes record

• Clear-DnsServerCache (PS) — clears DNS server cache

• dnscmd /enumzones (Legacy) — lists DNS zones

• dnscmd /zoneprint empresa.local (Legacy) — shows zone records

• dnsmgmt.msc (GUI) — DNS Server console

15.2 DHCP Server

• Get-DhcpServerv4Scope (PS) — lists IPv4 DHCP scopes

• Add-DhcpServerv4Scope -Name "LAN" -StartRange 192.168.1.100 -EndRange 192.168.1.200 -SubnetMask 255.255.255.0 (PS) — creates scope

• Get-DhcpServerv4Lease -ScopeId 192.168.1.0 (PS) — lists active leases in scope

• Add-DhcpServerv4ExclusionRange -ScopeId 192.168.1.0 -StartRange 192.168.1.1 -EndRange 192.168.1.10 (PS) — excludes IP range

• Add-DhcpServerv4Reservation -ScopeId 192.168.1.0 -IPAddress 192.168.1.50 -ClientId "AA-BB-CC-DD-EE-FF" (PS) — creates reservation by MAC

• Get-DhcpServerv4Statistics (PS) — DHCP usage statistics

• dhcpmgmt.msc (GUI) — DHCP Server console

16. IIS (Web Server)

• iisreset — restarts IIS completely

• iisreset /stop — stops IIS

• iisreset /start — starts IIS

• Get-Website (PS) — lists IIS sites

• New-Website -Name "Site01" -PhysicalPath "C:\inetpub\site01" -Port 8080 (PS) — creates new site

• Start-Website -Name "Site01" (PS) — starts site

• Stop-Website -Name "Site01" (PS) — stops site

• Get-WebAppPoolState -Name "DefaultAppPool" (PS) — Application Pool status

• Restart-WebAppPool -Name "DefaultAppPool" (PS) — restarts App Pool

• New-WebBinding -Name "Site01" -Protocol https -Port 443 (PS) — adds HTTPS binding

• appcmd list sites — lists sites via appcmd

• appcmd list apppools — lists App Pools via appcmd

• inetmgr (GUI) — IIS Manager

17. PowerShell Remoting (WinRM)

• Enable-PSRemoting -Force (PS) — enables PowerShell Remoting on machine

• winrm quickconfig — quick WinRM configuration

• Test-WSMan servidor (PS) — tests WinRM response on remote host

• Enter-PSSession -ComputerName servidor (PS) — opens remote interactive session

• Invoke-Command -ComputerName servidor -ScriptBlock { Get-Service } (PS) — runs remote command

• Invoke-Command -ComputerName srv1,srv2 -ScriptBlock { Get-Process } (PS) — runs on multiple servers

• New-PSSession -ComputerName servidor (PS) — creates persistent remote session

• Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*" -Force (PS) — sets trusted hosts (non-domain environment)

• Get-PSSession (PS) — lists active remote sessions

• Remove-PSSession -Id 1 (PS) — closes remote session

• psexec \\servidor cmd (Sysinternals) — runs remote shell

18. Backup and Restore

• wbadmin start backup -backupTarget:D: -include:C: -quiet — starts full backup of C: volume

• wbadmin get versions — lists available backup versions

• wbadmin start systemstaterecovery -version:01/01/2026-02:00 — restores system state

• wbadmin start recovery -version:01/01/2026-02:00 -itemtype:Volume -items:C: — restores volume

• robocopy C:\Origem D:\Destino /MIR /Z /R:3 /W:5 /LOG:backup.log — mirrors folders (mirror), with retry and log

• robocopy C:\Origem D:\Destino /E /COPYALL — recursive copy preserving attributes/ACLs

• xcopy C:\Origem D:\Destino /E /H /C /I (Legacy) — recursive copy including hidden files

• Backup-SqlDatabase -ServerInstance "SRV01" -Database "ERP" (PS, requires SqlServer module) — database backup

• wbpolicy.msc (GUI, Server) — backup configuration

19. Diagnostics and Performance

• perfmon (GUI) — Performance Monitor

• resmon (GUI) — Resource Monitor

• typeperf "\Processor(_Total)\% Processor Time" — real-time performance counter

• Get-Counter '\Processor(_Total)\% Processor Time' (PS) — reads performance counter

• Get-Counter -Counter "\Memory\Available MBytes" (PS) — available memory

• Measure-Command { Get-Process } (PS) — measures execution time of a command

• logman query providers — lists performance log providers

• wmic memorychip get capacity (Legacy) — memory module capacity

• wmic cpu get name,numberofcores,loadpercentage (Legacy) — CPU information and usage

• wmic logicaldisk get size,freespace,caption (Legacy) — disk space

• Get-CimInstance Win32_Processor (PS) — CPU details

• Get-CimInstance Win32_PhysicalMemory (PS) — RAM module details

• tracert / pathping — latency/route diagnostics (see section 2.2)

• procmon / procexp (Sysinternals) — advanced process monitor / Process Explorer

• MdSched.exe (GUI) — Windows Memory Diagnostic

• verifier — Driver Verifier, advanced driver diagnostics

• eventcreate /T ERROR /ID 100 /L APPLICATION /D "Teste" — creates manual test event in log

20. Miscellaneous / Utilities

• cmd — Command Prompt

• powershell — PowerShell (Desktop/Windows PowerShell 5.1)

• pwsh — PowerShell 7+ (Core)

• runas /user:dominio\admin cmd — runs program as another user

• Start-Process powershell -Verb RunAs (PS) — runs elevated (UAC)

• where /r C:\ arquivo.txt — searches for file recursively

• Get-ChildItem -Path C:\ -Filter "*.log" -Recurse (PS) — searches for files recursively

• findstr /s /i "erro" *.log — searches text in files (recursive, case-insensitive)

• Select-String -Path "*.log" -Pattern "erro" (PS) — equivalent to findstr

• tree /F — displays directory tree structure

• attrib +h +s arquivo.txt — sets hidden/system attributes

• attrib -h -s arquivo.txt — removes hidden/system attributes

• clip < arquivo.txt — copies file content to clipboard

• Compress-Archive -Path C:\Pasta -DestinationPath C:\pasta.zip (PS) — compresses to ZIP

• Expand-Archive -Path C:\pasta.zip -DestinationPath C:\Destino (PS) — extracts ZIP

• Get-FileHash arquivo.iso -Algorithm SHA256 (PS) — calculates file hash

• certutil -hashfile arquivo.iso SHA256 — calculates hash via certutil (native alternative)

• Export-Csv, Import-Csv, ConvertTo-Json, ConvertFrom-Json (PS) — structured data manipulation

• Get-Help Get-Service -Full (PS) — full help for any command

• Get-Command *service* (PS) — searches for cmdlets by name

• Update-Help (PS) — updates local help files

• $PSVersionTable (PS) — PowerShell version in use

• Set-ExecutionPolicy RemoteSigned -Scope CurrentUser (PS) — sets script execution policy

• sconfig — simplified configuration menu (Windows Server Core)

• msconfig (GUI) — system startup configuration

• control (GUI) — Control Panel

• optionalfeatures (GUI) — optional Windows features

• Get-WindowsOptionalFeature -Online -FeatureName * (PS) — lists optional features

• Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient (PS) — enables feature (e.g., Telnet)

📌 Quick Tips

• Use Tab to autocomplete paths and cmdlets in PowerShell.

• Get-Help <comando> -Examples shows practical examples of any cmdlet.

• Combine | Out-GridView to PowerShell output for interactive table view.

• Run CMD/PowerShell as Administrator for commands that change system, services, network, or registry.

• On Server Core, use sconfig as starting point for common tasks.

• wmic, dnscmd, dsquery/dsget, and cacls are legacy tools — they work in current versions, but Microsoft recommends PowerShell cmdlets in new scripts.

Essential cheat sheet for Windows Server and Desktop administration — CMD and PowerShell.