FR FieldReady Academy
Unit 2OSObjective 1.512 min read

Windows Command-Line Tools

Unit 2: Windows Tools, Commands, Settings, and Networking. Lesson 7 of 41 in APlus Academy Core 2.

The command prompt is faster than clicking and is the only option when the desktop will not load. Know each command, its job, and the one or two switches the exam likes.

Navigation

  • cd changes directory: cd \Users, cd .. goes up, cd \ goes to the root. Just cd shows where you are. D: switches drives.
  • dir lists files and folders. dir /a includes hidden and system files; dir /s recurses into subfolders; dir /p pauses per page; dir *.log filters.

File management

  • md (or mkdir) makes a directory; rmdir (rd) removes one, and rmdir /s removes it with everything inside (/q skips the prompt).
  • robocopy copies folder trees robustly: retries on errors, resumes, preserves timestamps and, with /copyall, permissions; /mir mirrors a tree (deleting extras at the destination, so be careful); /e copies subfolders including empty ones; /log writes a log. It replaced xcopy; copy handles single files.

Network

  • ipconfig shows the adapter's IP, mask, and gateway; /all adds MAC address, DHCP server, lease, and DNS servers; /release and /renew redo the DHCP lease; /flushdns clears the resolver cache after a DNS change; /displaydns shows it.
  • ping tests reachability with echo requests and shows round-trip time; -t runs until stopped; -a resolves the name; pinging 127.0.0.1 tests the local stack.
  • tracert lists every router hop to the destination with timing; the hop that stops replying is where the path breaks.
  • pathping runs a tracert, then measures packet loss to each hop over several minutes: the tool for a flaky link.
  • netstat lists connections and listening ports; -a all, -n numeric, -o the owning process ID, -b the program name (needs admin). Spot malware calling out or a port already in use.
  • nslookup queries DNS: nslookup www.example.com returns the address and which server answered; test a specific server with nslookup name 8.8.8.8.
  • net use maps and lists drives: net use X: \\server\share maps, net use X: /delete removes, net use alone lists mappings; /persistent:yes survives reboots.

Disk management

  • chkdsk checks a volume's filesystem; /f fixes errors; /r locates bad sectors and recovers readable data (implies /f, slow). On the system drive it schedules at the next boot.
  • format writes a new filesystem on a volume, destroying its contents: format E: /fs:exfat /q for a quick exFAT format.
  • diskpart is the command-line Disk Management: list disk, select disk 1, clean (wipes the partition table), convert gpt, create partition primary, format fs=ntfs quick, assign. Useful from recovery media when the GUI is gone; dangerous if you select the wrong disk.

Informational

  • hostname prints the computer name.
  • net user lists local accounts; net user name shows one; net user name password /add creates one; net user name /active:no disables.
  • winver opens the About Windows dialog with version and build.
  • whoami shows the current account; whoami /groups its group memberships.
  • command /? prints help for any command (for example robocopy /?).

Any command followed by /? (for example, ipconfig /?) prints its help and switches; the exam writes this as [command name] /?.

OS management

  • gpupdate applies Group Policy changes now instead of waiting for the refresh interval; /force reapplies all settings even if unchanged.
  • gpresult reports which policies applied to the computer and user; /r for a summary, /h report.html for a full report. The tool when "the policy is not taking effect."
  • sfc is the System File Checker: sfc /scannow verifies protected system files and replaces corrupted ones from the component store; run as administrator. If it cannot repair, DISM /online /cleanup-image /restorehealth repairs the store first, then run sfc again.
  • shutdown /r /t 0 restarts now; /s shuts down; /a aborts a scheduled shutdown.
Exam tip: ipconfig /all for the MAC and DNS, /release and /renew for DHCP, /flushdns after DNS changes. pathping adds loss statistics to tracert. netstat -b shows the program on a port. chkdsk /r for bad sectors. diskpart clean erases a disk. gpupdate /force applies policy now; gpresult /r shows what applied. sfc /scannow repairs system files.
Remember
cd, dir /a. md, rmdir /s, robocopy /mir. ipconfig /all, /release, /renew, /flushdns; ping -t; tracert; pathping (loss per hop); netstat -a -n -o -b; nslookup; net use X: \\server\share. chkdsk /f /r; format; diskpart (list, select, clean, convert gpt). hostname, net user, winver, whoami, /?. gpupdate /force, gpresult /r, sfc /scannow (then DISM restorehealth).
Deeper explanation

Windows Command-Line Tools, explained slowly

Commands as verbs

Each command is a verb with a few adverbs (switches). The exam tests the verb ("which command shows the MAC address") and a handful of adverbs ("which switch renews the DHCP lease"). Group them by what they act on.

Navigation and files

command      does                                        adverbs
cd           change directory                            cd .. up; cd \ root; cd alone shows the path; D: changes drive
dir          list                                        /a all including hidden; /s recursive; /p page; /w wide; /o sort
md, mkdir    make directory
rmdir, rd    remove directory                            /s with contents; /q quiet
copy, xcopy  copy files, copy trees (legacy)
robocopy     robust copy of trees                        /e all subfolders; /mir mirror (deletes extras at the destination); /copyall include permissions; /r:n retries; /log:file

Network

command      does                                        adverbs and reading the output
ipconfig     adapter addresses                           /all shows MAC, DHCP server, lease times, DNS; /release and /renew redo the lease; /flushdns clears cached names; /displaydns shows them
ping         echo request and reply                      -t until stopped; -n count; -a resolve; -l size; 127.0.0.1 tests the stack; "request timed out" means no reply; "destination host unreachable" means no route
tracert      hops to a destination                       -d no name resolution; the first hop is your gateway; stars mean no reply from that hop
pathping     tracert plus loss statistics per hop        takes minutes; shows where packets die on an intermittent link
netstat      connections and listening ports             -a all; -n numeric; -o process ID; -b program name (admin); -r routing table
nslookup     DNS query                                   nslookup name; nslookup name server; set type=mx for mail records
net use      map drives and connect to shares            net use X: \\server\share; /user:domain\name; /persistent:yes; net use X: /delete; net use * /delete

Disk

command      does                                        notes
chkdsk       check and repair a filesystem               /f fix errors; /r find bad sectors and recover data (slow); /x dismount first; system drive schedules at next boot
format       write a filesystem                          format E: /fs:ntfs /q; destroys data; asks for confirmation
diskpart     command-line disk management                list disk; select disk n; list partition; clean; convert gpt; create partition primary; format fs=ntfs quick; assign letter=E; active

Diskpart's clean is the fastest way to erase a stubborn USB stick and the fastest way to destroy the wrong disk; read the list disk output twice.

Informational

command          shows
hostname         the computer name
whoami           domain\user; /groups the memberships; /priv the privileges
winver           the About dialog with version and build
net user         local accounts; net user name (details); net user name pass /add; /delete; /active:no; net user name * prompts for a password
systeminfo       OS, boot time, hotfixes, domain, memory (not on the list but common)
command /?       help for any command

OS management

command      does                                        notes
gpupdate     refresh Group Policy now                    /force reapplies every setting; /target:computer or user; may prompt to log off or reboot
gpresult     report applied policies                     /r summary for the user and computer; /h file.html full report; /scope user
sfc          System File Checker                         /scannow verifies and repairs protected files; /verifyonly reports; run elevated; log in CBS.log
DISM         Deployment Image Servicing and Management   /online /cleanup-image /checkhealth, /scanhealth, /restorehealth repairs the component store sfc draws from
shutdown     power control                               /r restart; /s shut down; /t seconds; /f force apps closed; /a abort; /m \\pc remote

The sfc and DISM pairing: if sfc reports files it could not repair, run DISM restorehealth (needs internet or a source), then sfc again.

Worked examples

  • "The internet stopped after the network team changed DNS." ipconfig /flushdns, then nslookup a name to confirm the new server answers; if the adapter still shows old servers, ipconfig /release and /renew.
  • "Copy a 200 GB user profile to a new PC, keeping permissions, resuming if the network drops." robocopy \\old\c$\Users\jane D:\jane /e /copyall /r:3 /w:5 /log:jane.txt.
  • "Port 8080 is already in use and the app will not start." netstat -ano | findstr 8080, then Task Manager Details to find the PID's process.
  • "A new policy is not applying to a user." gpupdate /force, then gpresult /r to see whether the GPO is listed and whether it was filtered out.
  • "Windows reports corrupted system files." sfc /scannow; if it fails, DISM /online /cleanup-image /restorehealth, then sfc again.
  • "A USB stick shows two partitions and will not format." diskpart, list disk, select disk n, clean, create partition primary, format fs=exfat quick, assign.

How the exam asks it

  • "Which command displays the MAC address?" ipconfig /all.
  • "Which command shows packet loss at each hop?" pathping.
  • "Which command maps a network drive?" net use.
  • "Which command repairs bad sectors?" chkdsk /r.
  • "Which command forces Group Policy to reapply?" gpupdate /force.
  • "Which command repairs protected system files?" sfc /scannow.
  • "Which command shows the processes owning network connections?" netstat -b (or -o).
  • "Which command creates a folder?" md.

What to memorize

  • Every row of the tables, especially ipconfig switches, pathping, netstat -b and -o, net use syntax, chkdsk /r, diskpart clean, gpupdate /force, gpresult /r, sfc /scannow with DISM.