{"id":1744,"date":"2021-04-08T14:46:23","date_gmt":"2021-04-08T14:46:23","guid":{"rendered":"https:\/\/dft.wiki\/?p=1744"},"modified":"2026-06-08T23:07:24","modified_gmt":"2026-06-09T03:07:24","slug":"windows-cmd-and-powershell-cheat-sheet","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1744","title":{"rendered":"Windows CMD and PowerShell Cheat Sheet"},"content":{"rendered":"

USERS AND GROUPS<\/strong><\/p>\n

net user\r\nnet user newuser \/add\r\nnet user newuser password \/add\r\nnet localgroup users newuser \/add\r\nnet user newuser\r\nnet user newuser newpassword\r\nnet user newuser *\r\nnet user newuser * \/domain\r\nwmic useraccount where name='newuser' set PasswordRequired=false\r\nwmic useraccount where name='newuser' set PasswordExpires=false\r\nnet view\r\nnet localgroup\r\nnet localgroup administrators\r\nnet localgroup newgroupname \/add\r\nnet localgroup newgroupname \/del\r\nnet group \"group name\" \"user name\" \/add \/domain<\/pre>\n
FILES AND FOLDERS<\/strong><\/p>\n
rmdir \"folder with spaces in the name\"\r\nrmdir \/Q \/S nonemptydir\r\nrd \/S \"nonemptydir\"\r\ntakeown \/F \"folder to get control\" \/R \/A<\/pre>\n
GENERAL CMD<\/strong><\/p>\n
query session\r\nlogoff 1\r\nwmic os get OSArchitecture\r\necho %PROCESSOR_ARCHITECTURE%\r\nsysteminfo\r\nsysteminfo | findstr \/C:\"Install Date\"\r\ntasklist\r\nnet share\r\nnet share \"shared folder\" \/delete\r\nfor %i in (C$ IPC$ ADMIN$) do net share %i \/delete\r\ntype myfile.txt\r\nfc file1.txt file2.txt\r\nnetsh wlan show profile SmithHouse key=clear\r\ntype fileName.txt\r\nirm https:\/\/example.com\/<\/pre>\n
GENERAL POWERSHELL<\/strong><\/p>\n
Write-Output ANY-TEXT\r\nGet-ComputerInfo\r\nGet-LocalUser\r\nGet-NetIPConfiguration\r\nGet-NetIPAddress\r\nGet-Command\r\nGet-Command -CommandType \"Function\"\r\nGet-Command -Name Remove*\r\nGet-Process\r\nGet-Service\r\nGet-NetTCPConnection\r\nGet-FileHash -Path .\\FileName\r\nGet-Item -Path .\\FileName -Stream *\r\nGet-Help Get-Date\r\nGet-Help Get-Date -examples\r\nGet-Alias\r\nGet-ChildItem -Path C:\\\r\nGet-ChildItem | Sort-Object Length\r\nGet-ChildItem | Where-Object -Property \"Extension\" -eq \".txt\"\r\nGet-ChildItem | Where-Object -Property \"Name\" -like \"ship*\"\r\nGet-ChildItem | Select-Object Name,Length\r\nGet-Content -Path .\\File.TXT\r\nSelect-String -Path \".\\File.TXT\" -Pattern \"TEXT\"\r\nGet-Content -Path .\\File.TXT | Select-String -Pattern \"TEXT\"\r\nSet-Location -Path .\\Documents\r\nNew-Item -Path .\\Documents -ItemType Directory\r\nRemove-Item -Path .\\Documents\\FileName\r\nCopy-Item -Path .\\Documents\\FileName -Destination .\\Downloads\\FileName\r\nTaskList\r\nFind-Module -Name PowerShell*\r\nInstall-Module -Name PowerShellGet\r\nRemove-Module -Name PowerShellGet\r\nStop-Process -id 1\r\nStop-Process -name chrome\r\nGet-Service\r\nGet-Service vboxservice\r\nStop-Service vboxservice\r\nStart-Service vboxservice\r\nInvoke-Command -ComputerName RemoteHostName -ScriptBlock { Get-Service }<\/pre>\n
VIRTUALBOX AUTOMATION SCRIPTS<\/strong><\/p>\n
Create the following scripts and add them in Local Group Policy Editor > Windows Settings > Scripts (Startup\/Shutdown)<\/strong>.<\/p>\n
\"%ProgramFiles%\\Oracle\\VirtualBox\\VBoxManage.exe\" startvm \"Ubuntu\" --type headless<\/pre>\n
set VBoxManageEXE=\"%ProgramFiles%\\Oracle\\VirtualBox\\VBoxManage.exe\"\r\nset ListRunningVMS=%VboxManageEXE% list runningvms\r\nfor \/f tokens^=2^,4^ delims^=^\" %%p in ('%ListRunningVMS%') do %VBoxManageEXE% controlvm %%p savestate<\/pre>\n
SIMPLE COMMANDS<\/strong><\/p>\n
    \n
  • hostname<\/li>\n
  • whoami<\/li>\n
  • ipconfig<\/li>\n
  • netstat<\/li>\n
  • netstat -a<\/li>\n
  • netstat -b<\/li>\n
  • netstat -e<\/li>\n
  • netstat -abn<\/li>\n
  • type<\/li>\n<\/ul>\n
    CALLING COMMON APPLICATIONS<\/strong><\/p>\n
      \n
    • lusrmgr.msc<\/li>\n
    • control.exe<\/li>\n
    • UserAccountControlSettings.exe<\/li>\n
    • compmgmt.msc<\/li>\n
    • msinfo32.exe<\/li>\n
    • resmon.exe<\/li>\n
    • wf.msc<\/li>\n<\/ul>\n
      BONUS<\/strong><\/p>\n
        \n
      • Windows\\System32\\config\n
          \n
        • The location where Windows stores credentials.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
          USERS AND GROUPS net user net user newuser \/add net user newuser password \/add net […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-1744","post","type-post","status-publish","format-standard","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1744"}],"version-history":[{"count":9,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1744\/revisions"}],"predecessor-version":[{"id":5748,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1744\/revisions\/5748"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}