ProtocolBound

Commands

The same task in PowerShell, CMD and Bash. Click a command to copy it.

How to use it

  1. Search for a task or pick a category.
  2. Fill in any boxes on a card (user, computer, service); the command updates as you type.
  3. Click a command to copy it, then paste it into PowerShell, CMD or a terminal. Cards marked Ends with a check show you the result.

Network commands

  • Show IP configuration ipconfig /all: Lists each network adapter with its IP address, gateway and DNS servers. Start here when a machine can't reach the network.
  • Release and renew DHCP lease ipconfig /release: Drops the current IP address and asks the DHCP server for a new one. Fixes a wrong or stale address after a network change.
  • Flush DNS cache ipconfig /flushdns: Clears names the computer has already looked up, so it asks DNS again. Use it after a DNS record changes or a site resolves to the wrong place.
  • Look up a DNS record nslookup -type=mx example.com: Asks DNS for the MX (mail server) records for a domain. Swap MX for A, TXT, CNAME and so on.
  • Ping a host ping 8.8.8.8: Sends a few test packets and shows whether replies come back and how long they take. A quick check that a host is up and reachable.
  • Test if a TCP port is open Test-NetConnection server01 -Port 443: Tries to connect to one port on a remote host. Tells you whether a firewall or a stopped service is blocking it.
  • Trace the route to a host tracert 8.8.8.8: Shows each router hop between you and the target. Points to where along the path traffic slows down or stops.
  • List listening ports and owning process netstat -ano | findstr LISTENING: Shows which ports this machine is listening on and the process ID behind each one. Finds what's holding a port.
  • Show the routing table route print: Shows where the computer sends traffic for each network, including the default gateway. Useful with VPN and multi-NIC issues.
  • Show ARP / neighbor cache arp -a: Lists the MAC addresses the computer has matched to local IPs. Helps spot IP conflicts and confirm a device is on the LAN.
  • Remove an old SIM (cellular laptops) netsh mbn show interfaces: Shows the laptop's cellular adapter, the SIM in it now (the SIM ICCID under Ready info) and every saved cellular profile, including ones left behind by old SIMs. The interface is usually Cellular;…
  • Reset the Winsock and TCP/IP stack netsh winsock reset: Resets Windows networking settings to defaults. A last resort for broken connectivity; restart afterwards. Run as admin.
  • Show saved Wi-Fi password netsh wlan show profile name="WiFiName" key=clear: Shows the stored password for a Wi-Fi network this machine has joined. Fill in the network name. Run as admin.

System commands

  • Computer name, OS and uptime systeminfo: Shows the computer name, Windows edition and version, and how long it has been running.
  • Serial number Get-CimInstance Win32_BIOS | Select SerialNumber: Reads the serial number (service tag) from the BIOS. Handy for warranty lookups and asset records.
  • Repair system files DISM /Online /Cleanup-Image /RestoreHealth: DISM repairs the Windows image, then SFC fixes corrupted system files from it. Run as admin; it takes a while.
  • Rename this computer (force) powershell -NoProfile -Command "Rename-Computer -NewName 'NYC-LT-0142' -Force -PassThru…: Renames this PC and restarts it right away, without asking to save or confirm. The rename line prints the old name, the new name and HasSucceeded before the restart, so you can see it took; if the…
  • Restart now shutdown /r /t 0: Restarts the computer immediately with no countdown. Unsaved work is lost.
  • Shut down now shutdown /s /f /t 0: Shuts the computer all the way off, immediately, with no countdown. Unsaved work is lost.
  • Warn users, then shut down or restart shutdown /s /t 120 /c "Automatic maintenance starting soon. Please save your work.": Shows a countdown with your own message before shutting down, so whoever is on the PC gets a chance to save their work. Good for shared or lab machines, or anyone connected over RDP. Fill in the…
  • Cancel a pending shutdown or restart shutdown /a: Stops a shutdown or restart that's already counting down, for example one you started with a countdown, or Windows Update's own forced restart.
  • Sign out the current user shutdown /l: Signs out whoever is signed in right now, closing their apps. Unsaved work in those apps is lost. Doesn't shut the computer down.
  • Hibernate this computer shutdown /h: Saves the current session to disk and powers off, so it comes back to where it was. Hibernate must be turned on first (powercfg /hibernate on); laptops usually have it on by default, desktops often…
  • Restart to firmware (UEFI/BIOS) settings shutdown /r /fw /t 0: Restarts straight into the motherboard's firmware setup screen, no key-mashing at boot needed. Handy when walking someone through a BIOS change remotely. Needs UEFI firmware (most PCs from the last…
  • Restart to advanced startup options shutdown /r /o /t 0: Restarts into the Windows recovery menu (Safe Mode, System Restore, Startup Repair, command prompt) instead of straight to the desktop. Useful when a PC won't boot cleanly and you need to get into…
  • Last boot time systeminfo | find "Boot Time": Shows when the computer last started. Confirms whether a requested reboot actually happened.
  • Installed software winget list: Lists installed programs with their versions. Useful for audits and checking whether an update landed.
  • Update all apps (winget) winget upgrade --include-unknown --accept-source-agreements: Lists every installed app that has a newer version available, with the current and new version. Run this first to see what will change. winget comes with Windows 10 and 11 (App Installer); if it's…
  • Device join status (Entra / AD) dsregcmd /status: Shows whether the device is joined to Entra ID, a domain or both, and whether it has a valid sign-in token (PRT).
  • BitLocker status manage-bde -status: Shows encryption status and protection for each drive. Confirms a laptop is encrypted before it leaves the building.
  • Recent system errors wevtutil qe System /q:"*[System[(Level=1 or Level=2)]]" /c:20 /rd:true /f:text: Pulls the latest critical and error events from the System log. A fast first look after a crash or blue screen.

Policy commands

  • Faster sign-in: stop waiting for the network reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Winlogon" /v…: Turns off the policy Always wait for the network at computer startup and logon (SyncForegroundPolicy = 0), so Windows signs users in without waiting for the network. Fixes long waits at Welcome or…
  • Force a Group Policy update gpupdate /force: Re-applies computer and user Group Policy right away instead of waiting for the next refresh.
  • See which GPOs applied gpresult /r: Lists the Group Policy objects that applied to this computer and user, and any that were filtered out.

Users commands

  • Who am I and what groups am I in whoami /all: Shows the signed-in account and the groups it belongs to. Explains why someone can or can't open something.
  • My fully qualified domain name whoami /fqdn: Shows the signed-in account's full distinguished name, such as CN=Jane Doe,OU=Sales,OU=Miami,DC=contoso,DC=com. That also tells you which OU the account lives in, without needing to look it up in AD…
  • List user profiles on a PC dir %SystemDrive%\Users: Lists every user profile on this computer with when it was last used and whether that user is signed in right now (Loaded = True). The folder name at the end of LocalPath is the profile name to use…
  • Delete a user profile Get-CimInstance Win32_UserProfile | Where-Object { $_.LocalPath -eq…: Removes one user's profile from this computer: the folder under C:\Users and its registry entry, so their next sign-in builds a fresh profile. Fill in the profile name (the folder name). Run as…
  • Delete a user profile on a remote PC Get-CimInstance Win32_UserProfile -ComputerName pc01 | Where-Object { $_.LocalPath -eq…: Same as above, from your own machine: removes the profile folder and its registry entry on another computer. Fill in the computer and the profile name. Needs admin rights on that PC and WinRM…
  • Delete profiles not used in X days Get-CimInstance Win32_UserProfile | Where-Object { -not $_.Special -and -not $_.Loaded…: Clears out old profiles on a shared or lab PC: every profile whose last use is older than the number of days you set. Skips signed-in users, system profiles and the built-in Administrator. Last-use…
  • Add a user to the local admins net localgroup administrators DOMAIN\jdoe /add: Gives a user administrator rights on this one computer. Remove them when the job is done.
  • Who is logged on query user: Shows who is signed in to this machine, including remote sessions, and whether each session is active or idle.

Active Directory commands

  • Look up a domain user net user jdoe /domain: Shows a user's account details: enabled, locked, last sign-in, password age and more. Fill in the username.
  • Look up a device dsquery computer -name pc01 | dsget computer -desc -disabled: Shows a computer's account details: whether it's enabled, its operating system, when it last contacted the domain, and which OU it's in (DistinguishedName). Fill in the computer name.
  • This computer's OU location ([adsisearcher]"(&(objectCategory=computer)(cn=$env:COMPUTERNAME))").FindOne().Path: Shows which OU this computer lives in, without needing the ActiveDirectory module or admin rights. Run it on the device itself; it looks itself up by its own computer name. Same idea as whoami…
  • Search AD by name (any part of it) dsquery user -name "*smith*" | dsget user -samid -display -title -dept -disabled: Fastest way to find someone when you only know part of a name. One search matches first name, last name, display name, username and email (Ambiguous Name Resolution). Add | Out-GridView to the end…
  • Review one account (lockout, password, groups) net user jdoe /domain: The short version of everything you check on a ticket: enabled, locked, bad password count, when the password was set and expires, last sign-in, when it was created and which groups it's in.
  • Unlock an AD account Unlock-ADAccount -Identity jdoe; Get-ADUser jdoe -Properties LockedOut, BadLogonCount |…: Unlocks a user who is locked out after too many bad passwords. Needs the ActiveDirectory module and rights to the account.
  • Reset an AD password and force a change at next sign-in Set-ADAccountPassword jdoe -Reset -NewPassword (Read-Host -AsSecureString "New…: Sets a temporary password and makes the user choose their own at next sign-in. Fill in the username.
  • Find locked-out AD accounts Search-ADAccount -LockedOut | Select Name, SamAccountName: Lists every account in the domain that is locked out right now.
  • Find users where a field contains text Get-ADUser -Filter "Title -like '*error*'" -Properties Title, Enabled | Select-Object…: Finds everyone whose chosen field contains your text, for example Title containing manager or Department containing sales. Set the field to Title, Department, Description, Office, Company, City or…
  • Search text across several user fields Get-ADUser -Filter * -Properties Description, Title, Department, Office, Company |…: Looks for your text in Description, Title, Department, Office and Company at once, when you don't know which field holds it. Slower than a single-field search on big domains because it reads every…
  • Find OUs from part of the name dsquery ou -name "*sales*": Finds every OU whose name or description contains your text, so you don't need the exact name or path. For example, sales finds Sales, Inside Sales and Sales-Laptops. Each match is numbered with its…
  • Find computers or groups containing text dsquery computer -name "*error*": Finds computers whose name or description contains your text, for example kiosk or a site code. Switch to Groups to search group names and descriptions, for example VPN.
  • Find disabled accounts dsquery user -disabled -limit 0: Lists every disabled user account. Good for cleanup reviews and checking that leavers were turned off.
  • Find inactive accounts (not signed in for X days) Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Where-Object…: Lists enabled users who haven't signed in for the number of days you set. LastLogonDate can lag by up to 14 days, so treat results close to the cutoff as a maybe. Switch to Computers to find stale…
  • Find expired passwords Search-ADAccount -PasswordExpired -UsersOnly | Select-Object Name, SamAccountName,…: Lists accounts whose password has expired, which is a common cause of sign-in failures off the network and VPN.
  • Members of a group net group "IT Staff" /domain: Lists who is in a group. Fill in the group name.

Files & disk commands

  • Disk free space fsutil volume diskfree C:: Shows used and free space for each drive.
  • Free up disk space (all-in-one cleanup) $before = (Get-PSDrive C).Free; Remove-Item "$env:TEMP\*", "$env:SystemRoot\Temp\*"…: One command that does a full cleanup of the C: drive, in order: empties the temp folders (yours and Windows'), empties the Recycle Bin, runs Disk Cleanup silently with every category except the…
  • Largest folders here Get-ChildItem -Directory | ForEach { [pscustomobject]@{Name=$_.Name;…: Sizes every folder in the current location, biggest first. Finds what's filling a drive.
  • Find a file by name dir C:\*.pst /s /b: Searches a whole drive for files matching a name or pattern, such as *.pst for Outlook data files.
  • Search inside files findstr /s /i /n /c:"error" *.log: Finds text inside files below the current folder and shows the file, line number and matching line. Set the file type, for example *.log, *.txt or *.* for everything. Switch to File names only for a…
  • Mirror a folder (robust copy) robocopy C:\Src D:\Dst /MIR /R:2 /W:5: Copies a folder and makes the destination match it exactly, retrying on errors. /MIR also deletes extra files at the destination.
  • Map a network drive net use S: "\\server\share" /persistent:yes: Connects a shared folder as a drive letter that comes back after restart. Fill in the server, share and drive letter.
  • File hash certutil -hashfile "setup.exe" SHA256: Calculates a file's SHA-256 checksum so you can compare it with the one the vendor publishes.
  • Take ownership of a folder takeown /f C:\Folder /r /d y: Makes administrators the owner of a folder and grants them full control. Fixes Access denied on orphaned folders.

Processes & services commands

  • List running processes tasklist: Lists running processes. The PowerShell and Bash versions put the biggest CPU users first, to find what's slowing a machine down.
  • Kill a process: Force-closes an app that's frozen or won't exit. Unsaved work in that app is lost. Pick the app above.
  • Service status: Shows whether a Windows service is running, stopped or stuck. Pick the service above.
  • Restart a service: Stops and starts a service. Often clears a stuck state without a full reboot. Pick the service above.
  • Start a service: Starts a stopped Windows service. Pick the service above. Run as admin. If it says the service is disabled, use the next command.
  • Stop a service: Stops a running service. Anything that depends on it stops too. Pick the service above. Run as admin.
  • Set a service to automatic and start it: For a service that was disabled or set to manual: makes it start with Windows from now on, and starts it right away. Pick the service above. Run as admin.
  • Start a service on a remote PC: Starts a service on another computer without remoting in. Pick the service above and fill in the computer. Needs admin rights on that PC. The PowerShell version uses WinRM; the CMD version works…
  • Start an app: Opens an app for the signed-in user, for example OneDrive when its cloud icon is missing from the taskbar. Pick the app above. Run it as the user, not as admin.
  • Restart an app (close and reopen): Force-closes an app and opens it again. Clears a frozen or misbehaving app in one step; unsaved work in it is lost. Pick the app above.
  • Reset OneDrive (fix sync) "%LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe" /reset: Resets OneDrive's sync connection when files are stuck syncing or the app won't open. Files aren't deleted; OneDrive re-checks everything, which can take a while for big libraries. Run as the user.…
  • Restart Windows Explorer (taskbar, Start menu) taskkill /f /im explorer.exe: Restarts the Windows shell when the taskbar, Start menu or desktop icons freeze or vanish. Open File Explorer windows close; nothing else does.
  • Clear a stuck print queue net stop spooler: Stops the spooler, deletes every waiting print job and starts it again. Fixes a print queue that won't clear.
  • Scheduled tasks schtasks /query /fo LIST: Lists the scheduled tasks on this machine and their state.

Remote commands

  • Open a remote shell Enter-PSSession -ComputerName pc01: Opens an interactive command session on another computer, as if you were sitting at it.
  • Run a command on another machine Invoke-Command -ComputerName pc01 -ScriptBlock { Get-Service }: Runs one command on a remote computer and shows the result here, without staying connected.
  • Restart a remote computer shutdown /r /m \\pc01 /t 0: Restarts another computer on the network right away. Make sure no one is working on it.
  • Shut down a remote computer shutdown /s /m \\pc01 /t 0: Powers off another computer on the network right away. Make sure no one is working on it and that someone can turn it back on (or that it's set up for Wake-on-LAN).
  • Enable PowerShell remoting winrm quickconfig -quiet: Turns on WinRM so this computer accepts PowerShell remoting. Run as admin on the target machine.