CMD Commands: Full List for Windows PC
In an era dominated by glossy graphical interfaces and touch-friendly dashboards, the Command Prompt remains the systems administrator’s scalpel—precise, immediate, and unforgiving. When a server is thrashing, a domain controller is unresponsive, or a critical application refuses to start, the GUI is often the first thing to fail. The command line? It keeps working.
Consider this: resetting a TCP/IP stack through the Network Settings panel requires at least a dozen clicks across multiple windows. The same operation via CMD takes a single command: netsh int ip reset. CMD Commands are not legacy relics; they are the fastest path from problem to resolution.
The Command Prompt has evolved significantly from its MS-DOS origins. Windows NT introduced the modern cmd.exe interpreter, and each subsequent release—from Windows 2000 through Windows 11—has added new utilities and refined existing ones. Today’s CMD supports long paths, Unicode characters, and advanced scripting capabilities that would have been unthinkable in the DOS era.
This guide covers over 40 essential CMD Commands organized by function, with syntax breakdowns, critical flags, and real-world examples you can use immediately. Whether you’re a helpdesk technician diagnosing a user’s connectivity issue or a senior admin automating server maintenance, keep this cheat sheet close.
File & Directory Management
These are the foundational CMD Commands you’ll use daily for navigating, creating, copying, and manipulating the Windows filesystem.
cd (Change Directory)
Definition: Changes the current working directory to the specified path.
Syntax: cd [/d] [<drive>:][<path>]
Key Flags:
/d– Changes both drive and directory in one operation..– Moves up one directory level\– Returns to the root of the current drive
Real-World Example: cd /d D:\Projects\WebApp – switches from C: drive directly to a folder on D: drive in a single command.
dir (Directory)
Definition: Displays a list of files and subdirectories in the current or specified directory.
Syntax: dir [<drive>:][<path>] [<switches>]
Key Flags:
/a– Shows all files, including hidden and system files/s– Recursively displays contents of all subdirectories/b– Uses bare format (filenames only, no headers or summary)
Real-World Example: dir C:\Windows\System32\drivers\*.sys /s /b > drivers.txt – exports a clean list of all .sys driver files to a text file for inventory.
mkdir / md (Make Directory)
Definition: Creates a new directory (folder) in the specified location.
Syntax: mkdir [<drive>:]<path>
Key Flags:
- No critical flags—simply provide the full path
Real-World Example: mkdir "C:\Users\Public\Documents\Project Alpha\Backups" – creates an entire nested directory structure in one command.
rmdir / rd (Remove Directory)
Definition: Deletes a directory. Works only on empty directories unless flags are used.
Syntax: rmdir [<drive>:]<path> [/s] [/q]
Key Flags:
/s– Removes the directory and all its contents recursively/q– Quiet mode; suppresses confirmation prompts
Real-World Example: rmdir C:\Temp\OldCache /s /q – forcibly removes a cache folder and everything inside it without asking for confirmation.
copy
Definition: Copies one or more files from one location to another.
Syntax: copy [/d] [/v] [/n] [/y | /-y] [<source>] [<destination>]
Key Flags:
/y– Suppresses confirmation prompt when overwriting/-y– Prompts for confirmation before overwriting/v– Verifies that new files are written correctly
Real-World Example: copy \\server\share\config.ini C:\App\config.ini /y – copies a configuration file from a network share, overwriting the local version without prompting.
xcopy
Definition: Copies files and entire directory trees with more options than the basic copy command.
Syntax: xcopy <source> <destination> [/e] [/i] [/h] [/r] [/k]
Key Flags:
/e– Copies all subdirectories, including empty ones/i– If destination does not exist and copying multiple files, assumes destination is a directory/h– Copies hidden and system files
Real-World Example: xcopy C:\UserData D:\Backup\UserData /e /i /h – performs a full backup of a user’s data folder including all subdirectories and hidden files.
robocopy (Robust File Copy)
Definition: Microsoft’s advanced file copy utility designed for reliable, multi-threaded copying with retry logic and mirroring capabilities.
Syntax: robocopy <source> <destination> [<file>...] [/mir] [/mt[:n]] [/r:n] [/w:n]
Key Flags:
/mir– Mirrors a directory tree (deletes files at destination that don’t exist at source)/mt[:n]– Uses multi-threaded copying with n threads (default 8)/r:n– Specifies the number of retries on failed copies
Real-World Example: robocopy C:\WebApp D:\Backup\WebApp /mir /mt:16 /r:3 – mirrors a web application folder to a backup location using 16 threads, retrying up to 3 times on failure.
move
Definition: Moves files or directories from one location to another; also used to rename files and folders.
Syntax: move [<source>] [<destination>]
Key Flags:
/y– Suppresses confirmation prompt when overwriting
Real-World Example: move C:\Downloads\Q4-Report.xlsx D:\Finance\Reports\ – relocates a report file to the finance department’s shared folder.
ren / rename
Definition: Changes the name of a file or directory without moving it.
Syntax: ren [<drive>:][<path>]<oldname> <newname>
Key Flags:
- No critical flags—simple rename operation
Real-World Example: ren C:\Logs\app.log app_2026-08-27.log – renames a log file with a date-stamp for archival purposes.
del / erase
Definition: Deletes one or more files.
Syntax: del [<drive>:][<path>]<filename> [/p] [/f] [/s] [/q] [/a]
Key Flags:
/f– Forces deletion of read-only files/s– Deletes specified files from all subdirectories/q– Quiet mode; no confirmation prompts
Real-World Example: del C:\Temp\*.tmp /f /s /q – forcibly deletes all temporary files in the Temp folder and its subdirectories without prompting.
type
Definition: Displays the contents of a text file directly in the command window.
Syntax: type [<drive>:][<path>]<filename>
Key Flags:
- No critical flags—displays entire file content
Real-World Example: type C:\Windows\System32\drivers\etc\hosts – quickly views the contents of the hosts file to check for manual DNS entries.
tree
Definition: Displays the directory structure of a specified path as a graphical tree.
Syntax: tree [<drive>:][<path>] [/f] [/a]
Key Flags:
/f– Displays files in addition to directories/a– Uses ASCII characters instead of extended characters for compatibility
Real-World Example: tree D:\Projects /f > project_structure.txt – generates a complete file and folder tree of a project directory and saves it for documentation.
attrib
Definition: Displays or changes file attributes (Read-only, Archive, System, Hidden).
Syntax: attrib [{+|-}r] [{+|-}a] [{+|-}s] [{+|-}h] [<drive>:][<path>]<filename> [/s [/d]]
Key Flags:
+r/-r– Adds or removes Read-only attribute+h/-h– Adds or removes Hidden attribute+s/-s– Adds or removes System attribute/s– Applies changes to matching files in all subdirectories
Real-World Example: attrib +h +s C:\Secret\config.ini – hides a sensitive configuration file from casual browsing.
findstr
Definition: Searches for patterns of text in files using regular expressions—a more powerful alternative to find.
Syntax: findstr [/s] [/i] [/m] [/n] [/c:"<string>"] [<files>]
Key Flags:
/s– Searches in all subdirectories/i– Case-insensitive search/n– Prints line numbers where matches occur
Real-World Example: findstr /s /i "ERROR" C:\Logs\*.log – finds all occurrences of “ERROR” (case-insensitive) in all .log files across the Logs directory and its subfolders.
Read Also: How to Upgrade to Windows 11
System Diagnostics & Performance
These CMD Commands give you X-ray vision into your Windows system’s health, configuration, and performance.
systeminfo
Definition: Displays comprehensive configuration information about a computer, including OS version, installed hotfixes, memory, and network details.
Syntax: systeminfo [/s <computer>] [/u <domain>\<username> [/p <password>]] [/fo <format>]
Key Flags:
/s– Specifies a remote system to query/fo– Formats output as TABLE, LIST, or CSV/nh– Suppresses column headers in TABLE format
Real-World Example: systeminfo /fo csv > system_audit.csv – exports a complete system inventory in CSV format for asset management or compliance auditing.
winver
Definition: Displays the “About Windows” dialog with the exact OS edition, version number, and build number.
Syntax: winver
Key Flags: None
Real-World Example: winver – instantly confirms the Windows build number when validating that a critical patch has been applied or when opening a support ticket.
tasklist
Definition: Displays a list of all currently running processes on the local or a remote system, including their Process ID (PID) and memory usage.
Syntax: tasklist [/s <computer>] [/u <domain>\<username> [/p <password>]] [/fi <filter>] [/fo <format>]
Key Flags:
/fi– Filters the list (e.g.,/fi "memusage gt 100000"for processes using over 100MB)/fo– Output format (TABLE, LIST, CSV)/v– Verbose output with additional details
Real-World Example: tasklist /fi "memusage gt 500000" /fo csv – identifies memory-hogging processes using over 500MB of RAM, exported in CSV format for reporting.
taskkill
Definition: Terminates one or more running processes by Process ID (PID) or image name.
Syntax: taskkill [/s <computer>] [/u <domain>\<username> [/p <password>]] [/fi <filter>] [/pid <pid> | /im <imagename>] [/f]
Key Flags:
/f– Forcefully terminates the process (use when graceful termination fails)/pid– Terminates the process with the specified PID/im– Terminates all processes with the specified image name
Real-World Example: taskkill /im notepad.exe /f – forcibly closes all instances of Notepad when a user has left multiple unsaved documents open and locked.
shutdown
Definition: Shuts down, restarts, logs off, or hibernates the local or a remote computer.
Syntax: shutdown [/i | /l | /s | /r | /g | /a | /p | /h | /e | /o] [/t <seconds>] [/c "<comment>"]
Key Flags:
/s– Shuts down the computer/r– Restarts the computer/t– Sets the time delay in seconds before the action/a– Aborts a pending shutdown
Real-World Example: shutdown /r /t 30 /c "Scheduled maintenance reboot - save your work" – restarts the system with a 30-second warning message, giving users time to save their work.
sfc (System File Checker)
Definition: Scans all protected system files and replaces corrupted or missing versions with correct Microsoft versions from the local cache.
Syntax: sfc [/scannow] [/verifyonly] [/scanfile=<file>] [/offbootdir=<dir> /offwindir=<dir>]
Key Flags:
/scannow– Scans and immediately repairs all protected system files/verifyonly– Scans but does not repair/scanfile– Scans and repairs a specific file
Real-World Example: sfc /scannow – the first line of defense when Windows is behaving erratically or crashing. Run this before spending hours debugging application issues.
dism (Deployment Image Servicing and Management)
Definition: Services and repairs Windows images, including the Windows Recovery Environment, Windows PE, and the online running OS. Often used to repair the component store that sfc relies on.
Syntax: dism /Online /Cleanup-Image /RestoreHealth
Key Flags:
/Online– Targets the running operating system/Cleanup-Image– Performs cleanup and repair operations/RestoreHealth– Scans for and repairs component store corruption
Real-World Example: DISM /Online /Cleanup-Image /RestoreHealth – run this BEFORE sfc /scannow when the system is severely corrupted. DISM repairs the source files that SFC uses to restore system integrity.
ver
Definition: Displays the Windows version number.
Syntax: ver
Key Flags: None
Real-World Example: ver – quickly checks the OS version when a script needs to conditionally execute commands based on the Windows release.
Network Configuration
Network troubleshooting is where CMD Commands truly shine. These utilities are on every Windows system and require no additional installation.
ipconfig
Definition: Displays current TCP/IP network configuration values and refreshes DHCP and DNS settings.
Syntax: ipconfig [/all] [/release [<adapter>]] [/renew [<adapter>]] [/flushdns] [/registerdns]
Key Flags:
/all– Displays full configuration including MAC address, DHCP status, and DNS servers/release– Releases the current DHCP lease/renew– Renews the DHCP lease/flushdns– Purges the DNS resolver cache
Real-World Example: ipconfig /flushdns – clears the DNS cache when a user cannot reach a website that has recently changed IP addresses. Follow with ipconfig /registerdns to refresh the computer’s DNS registration.
ping
Definition: Sends Internet Control Message Protocol (ICMP) echo requests to a target host to test network connectivity and measure round-trip time.
Syntax: ping [/t] [/n <count>] [/l <size>] [/w <timeout>] <target>
Key Flags:
/t– Pings continuously until stopped (Ctrl+C)/n– Specifies the number of echo requests to send/l– Specifies the packet size in bytes
Real-World Example: ping -t 8.8.8.8 – continuously monitors connectivity to Google’s DNS server to diagnose intermittent network drops. Look for “Request timed out” patterns.
tracert (Trace Route)
Definition: Determines the path packets take to reach a destination, listing each router hop along the way.
Syntax: tracert [/d] [/h <maxhops>] [/w <timeout>] <target>
Key Flags:
/d– Prevents resolution of IP addresses to hostnames (speeds up the trace)/h– Sets the maximum number of hops to search for the target/w– Sets the time to wait for each reply in milliseconds
Real-World Example: tracert /d 8.8.8.8 – traces the route to Google’s DNS without resolving hostnames, quickly identifying where packets are being dropped or delayed.
netstat (Network Statistics)
Definition: Displays active TCP and UDP connections, listening ports, Ethernet statistics, and the routing table.
Syntax: netstat [-a] [-b] [-e] [-n] [-o] [-p <protocol>] [-r] [-s] [<interval>]
Key Flags:
-a– Displays all connections and listening ports-n– Shows addresses and port numbers in numerical form (no name resolution)-o– Displays the owning Process ID (PID) for each connection-b– Shows the executable involved in creating each connection (requires admin)
Real-World Example: netstat -ano | findstr :443 – finds all active connections using port 443 (HTTPS) along with the PID of the owning process. Use the PID with tasklist to identify the application.
nslookup
Definition: Queries Domain Name System (DNS) servers to obtain mapping information between domain names and IP addresses.
Syntax: nslookup [<host>] [<DNS-server>]
Key Flags:
-type=<record>– Specifies the DNS record type (A, MX, CNAME, etc.)-debug– Shows detailed debugging informationserver <IP>– Changes the DNS server used for queries
Real-World Example: nslookup -type=MX company.com – checks the mail exchange (MX) records for a domain when troubleshooting email delivery issues.
arp -a
Definition: Displays the Address Resolution Protocol (ARP) cache, showing IP-to-MAC address mappings for the local network.
Syntax: arp -a [<inet_addr>] [/n <if_addr>]
Real-World Example: arp -a – checks for IP address conflicts by showing which MAC addresses are associated with which IPs on the local subnet.
netsh (Network Shell)
Definition: A powerful command-line scripting utility for displaying and modifying network configuration of the local or remote computer.
Syntax: netsh [-a <AliasFile>] [-c <Context>] [-r <RemoteComputer>] [<Command>]
Real-World Example: netsh int ip reset reset.log – resets the entire TCP/IP stack to its default state, a last-resort fix for persistent network issues that survives reboots.
Disk Utility
Disk-related CMD Commands are essential for storage management, error recovery, and data protection.
chkdsk (Check Disk)
Definition: Checks the file system and file system metadata of a volume for logical and physical errors.
Syntax: chkdsk [<volume>] [/f] [/r] [/x] [/i] [/c]
Key Flags:
/f– Fixes errors on the disk/r– Locates bad sectors and recovers readable information (implies/f)/x– Forces the volume to dismount before the scan
Real-World Example: chkdsk C: /f /r – schedules a full disk check on the system drive at the next reboot, attempting to fix both logical errors and recover data from bad sectors.
diskpart (Disk Partition)
Definition: An interactive disk partitioning utility that manages disks, partitions, and volumes.
Syntax: diskpart (enters interactive mode; commands are then issued within the environment)
Key Diskpart Commands:
list disk– Shows all physical disksselect disk <n>– Selects a disk for further operationslist volume– Shows all volumesclean– Removes all partition or volume formatting from the selected disk
Real-World Example:
text
diskpart list disk select disk 1 clean create partition primary format fs=ntfs quick assign letter=E exit
– prepares a new disk for use by cleaning it, creating a primary partition, formatting it as NTFS, and assigning a drive letter.
format
Definition: Formats a disk or drive for use with a Windows-supported file system.
Syntax: format <volume> [/fs:<filesystem>] [/v:<label>] [/q] [/x]
Key Flags:
/fs:– Specifies the file system (NTFS, FAT32, exFAT)/q– Performs a quick format/v:– Assigns a volume label
Real-World Example: format E: /fs:NTFS /v:DATA /q – quickly formats the E: drive as NTFS with the label “DATA”.
vol
Definition: Displays the disk volume label and serial number.
Syntax: vol [<drive>:]
Real-World Example: vol C: – confirms the volume label and serial number of the system drive for inventory or troubleshooting.
defrag
Definition: Optimizes files on a volume to improve system performance.
Syntax: defrag <volume> [/a] [/o] [/u]
Key Flags:
/a– Analyzes the volume without defragmenting/o– Performs optimization for each media type/u– Shows the progress of the operation
Real-World Example: defrag C: /o – optimizes the system drive using the appropriate method for the storage media (SSD or HDD).
User & Permission Controls
Managing users and permissions from the command line is faster and more scriptable than using the GUI.
net user
Definition: Adds, modifies, or displays user accounts on a local or domain system.
Syntax: net user [<username> [<password> | *] [/add] [/delete] [/active:{yes | no}]]
Key Flags:
/add– Creates a new user account/delete– Removes a user account/active:{yes | no}– Enables or disables an account
Real-World Example: net user jsmith P@ssw0rd123! /add /active:yes – creates a new user account with a specified password.
net localgroup
Definition: Adds, displays, or modifies local groups on a system.
Syntax: net localgroup [<groupname> [/add] [/delete] <username> ...]
Real-World Example: net localgroup Administrators jsmith /add – adds the user “jsmith” to the local Administrators group, granting full system privileges.
whoami
Definition: Displays the user name, group information, and privileges of the currently logged-in user.
Syntax: whoami [/user] [/groups] [/priv]
Key Flags:
/user– Displays the user name and security identifier (SID)/groups– Displays the groups the user belongs to/priv– Displays the security privileges of the user
Real-World Example: whoami /groups – confirms which security groups the current user belongs to when troubleshooting permission denied errors.
runas
Definition: Runs a program or command with different user credentials, typically with elevated privileges.
Syntax: runas [/profile] [/env] [/netonly] /user:<username> <program>
Key Flags:
/profile– Loads the user’s profile/env– Uses current environment instead of the user’s/netonly– Specifies credentials only for remote network access
Real-World Example: runas /user:Administrator "cmd.exe" – opens a new Command Prompt window running as the local Administrator, useful when you need to perform administrative tasks but are logged in with a standard account.
icacls (Integrity Control Access Control Lists)
Definition: Displays or modifies discretionary access control lists (DACLs) on files and folders—the modern replacement for the legacy cacls command.
Syntax: icacls <filename> [/grant <user>:<perm>] [/remove <user>] [/setowner <user>]
Key Flags:
/grant– Grants specified user permissions (R, W, C, F)/remove– Removes all permissions for a user/setowner– Changes the ownership of a file or folder/t– Applies recursively to all subfolders and files
Real-World Example: icacls C:\SecureData /grant domain\jsmith:(F) /t – grants full control (F) to user jsmith on the SecureData folder and all its contents.
takeown
Definition: Grants an administrator ownership of a file or folder, bypassing permission restrictions.
Syntax: takeown /f <filename> [/a] [/r] [/d <prompt>]
Key Flags:
/f– Specifies the file or directory/a– Gives ownership to the Administrators group instead of the current user/r– Recursively applies to all subdirectories and files
Real-World Example: takeown /f C:\Windows\System32\drivers\etc\hosts /a – takes ownership of the hosts file as an administrator before making changes.
Power User Tactics
Knowing individual CMD Commands is only half the battle. The real power of the command line emerges when you combine them with piping, redirection, and scripting.
Piping (|)
The pipe operator sends the output of one command as input to another. This allows you to chain commands together for powerful data processing.
Example: tasklist | findstr "chrome" – lists all running processes and filters for those containing “chrome”, showing only Chrome-related processes.
Example: netstat -ano | findstr :80 | findstr LISTENING – finds all processes listening on port 80.
Redirection (> and >>)
Redirection operators send command output to files instead of the console.
>– Overwrites the destination file with new content>>– Appends to the destination file
Example: systeminfo > C:\Reports\system_config.txt – saves the full system information to a text file.
Example: ping 8.8.8.8 -t >> C:\Logs\ping_log.txt – continuously logs ping results to a file for later analysis (stop with Ctrl+C).
Batch Scripts for Automation
Creating .bat or .cmd files allows you to automate sequences of CMD Commands. Here’s a practical example that a junior admin might use to provision a new developer workstation:
batch
@echo off echo === Developer Workstation Setup === REM Install common developer tools via winget winget install Microsoft.VisualStudioCode winget install Git.Git winget install Docker.DockerDesktop REM Create project directory structure mkdir C:\Projects\ClientA\Source mkdir C:\Projects\ClientA\Docs mkdir C:\Projects\ClientB\Source mkdir C:\Projects\ClientB\Docs REM Map network drives net use Z: \\fileserver\shared\devtools /persistent:yes REM Set environment variables setx DEV_ROOT C:\Projects setx NODE_ENV development echo === Setup Complete === pause
This script demonstrates real-world automation that saves hours of manual setup time.
Command Chaining: && and ||
&&– Executes the second command only if the first succeeds||– Executes the second command only if the first fails
Example: ping 8.8.8.8 && echo "Network is online" || echo "Network is offline" – tests connectivity and provides appropriate feedback.
Environment Variables (set and echo)
Environment variables store system and user-specific values that you can reference in commands and scripts.
Display all variables: set
Display a specific variable: echo %PATH%
Set a variable temporarily: set MYVAR=HelloWorld
Persistent variable: setx MYVAR C:\MyApp – makes the variable permanent across reboots.
Conclusion
The Command Prompt remains an indispensable tool in every Windows administrator’s arsenal. From the humble dir to the enterprise-grade robocopy, the CMD Commands covered in this guide represent the core skills that separate effective system administrators from those who click their way through every problem.
While PowerShell has emerged as a more powerful scripting environment with object-based output, CMD retains its place for quick diagnostics, legacy script compatibility, and situations where simplicity and speed matter most. Understanding both tools makes you a more versatile and effective IT professional.
Bookmark this cheat sheet. Commit the most frequently used CMD Commands to muscle memory. When a server is down and the GUI is frozen, you’ll be glad you did.
References
- Microsoft Official Windows Commands Documentation – The definitive reference for every Windows command, maintained by Microsoft: learn.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands
- TCP/IP Fundamentals (Academic Resource) – Comprehensive educational material on the networking protocols underlying every ping and tracert command: www.sabanciuniv.edu [course listing for IT 511 – Fundamentals of Data Communications and TCP/IP Networking]
- NIST Cybersecurity Best Practices – The National Institute of Standards and Technology’s guidelines for secure system administration, including command-line security practices: nist.gov/cyberframework