[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572969-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572969-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","windows-command-line-cheat-sheet-pocket-reference-guide","Windows Command Line Cheat Sheet - Pocket Reference Guide","","Windows Command Line Cheat Sheet consolidates practical syntax and examples for common Windows administration tasks, emphasizing efficient command usage for registry management, system process/service inspection, network troubleshooting, package installation, file searching, loop automation, and invoking management GUIs. It provides command forms and parameter placeholders for local or remote operations, including reg add/export/import/query, WMIC grammar and examples, tasklist and service queries, shutdown control, netstat filtering, Vista package installation via pkgmgr, directory file search with dir/find, counting line techniques, FOR loops, and netsh firewall and interface configuration. The result is a fast reference for operators working across Windows security and operations training scenarios.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/windows-command-line-cheat-sheet-pocket-reference-guide/572969/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/windows-command-line-cheat-sheet-pocket-reference-guide/572969.png","ImageObject",442,249,{"name":42,"@type":43},"acoobca","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"How do you add a registry key on a specific machine using Reg Command?","Question",{"text":63,"@type":64},"Use reg add with the target machine and registry domain placeholders, specifying the key location. If no remote machine is specified, the local machine is used.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What is the basic grammar structure for WMIC commands?",{"text":68,"@type":64},"WMIC follows: wmic [alias] [where clause] [verb clause]. You can use aliases like process, service, nicconfig, startup, and qfe.",{"name":70,"@type":61,"acceptedAnswer":71},"How can you configure network firewall and interface settings with Netsh?",{"text":72,"@type":64},"Use netsh firewall set opmode disable to turn off the built-in firewall, then configure IP and DNS with netsh interface ip set address and netsh interface ip set dns commands.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572969,1792242136,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,122],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":55,"slug":121},21,"Paper Templates","papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":82,"data":127},{"doc_id":79,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":26,"language":135,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":12,"update_tm":139,"read_time":22},3985747870733,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","| Reg Command |\n| --- |\n| Adding Keys and Values: C: \\> reg add\u003Cbr>[\\\\TargetIPaddr\\][RegDomain]\\ [Key]\u003Cbr>Add a key to the registry on machine [TargetIPaddr] within the registry domain [RegDomain] to location [Key] . If no remote machine is specified, the current machine is assumed.\u003Cbr>Export and Import:\u003Cbr>C: \\> reg export [RegDomain] \\ [Key][FileName]\u003Cbr>Export all subkeys and values located in the domain [RegDomain] under the location [Key] to the file [FileName]\u003Cbr>C: \\> reg import [FileName]\u003Cbr>Import all registry entries from the file [FileName]\u003Cbr>Import and export can only be done from or to the local machine.\u003Cbr>Query for a specific Value of a Key: C: \\> reg query\u003Cbr>[\\\\TargetIPaddr\\][RegDomain]\\ [Key] /v [ValueName]\u003Cbr>Query a key on machine [TargetIPaddr] within the registry domain [RegDomain] in location [Key] and get the specific value [ValueName] under that key. Add /s to recurse all values. |\n\n\n| WMIC |\n| --- |\n| Fundamental grammar:\u003Cbr>C: \\> wmic [alias] [where clause] [verb clause]\u003Cbr>Useful [aliases]:\u003Cbr>process service\u003Cbr>share nicconfig\u003Cbr>startup useraccount\u003Cbr>qfe (Quick Fix Engineering – shows patches)\u003Cbr>Example [where clauses]:\u003Cbr>where name=\"nc .exe\"\u003Cbr>where (commandline like \"%stuff\")\u003Cbr>where (name=\"cmd .exe\" and parentprocessid!=\"[pid]\")\u003Cbr>Example [verb clauses]:\u003Cbr>list [full |brief]\u003Cbr>get [attrib1,attrib2…]\u003Cbr>call [method]\u003Cbr>delete\u003Cbr>List all attributes of [alias]:\u003Cbr>C: \\> wmic [alias] get /?\u003Cbr>List all callable methods of [alias]:\u003Cbr>C: \\> wmic [alias] call /?\u003Cbr>Example:\u003Cbr>List all attributes of all running processes: C: \\> wmic process list full\u003Cbr>Make WMIC effect remote [TargetIPaddr] : C: \\> wmic /node:[TargetIPaddr]\u003Cbr>/user:[User] /password:[Passwd] process list full |\n\nWindows Command Line Cheat Sheet  \nBy Ed Skoudis  \nPOCKET REFERENCE GUIDE  \n[http://www.sans.org](http://www.sans.org)  \n\n|  | Purpose |  |\n| --- | --- | --- |\n|  | The purpose of this cheat sheet is to provide tips on how to use various Windows command that are frequently referenced in SANS 504, 517, 531, and 560. |  |\n|  |  |  |\n| Process and Service Information |  |  |\n| List all processes currently running: C: \\> tasklist\u003Cbr>List all processes currently running and the DLLs each has loaded:\u003Cbr>C: \\> tasklist /m\u003Cbr>Lists all processes currently running which have the specified [dll] loaded:\u003Cbr>C: \\> tasklist /m [dll]\u003Cbr>List all processes currently running and the services hosted in those processes:\u003Cbr>C: \\> tasklist /svc\u003Cbr>Query brief status of all services: C: \\> sc query\u003Cbr>Query the configuration of a specific service: C: \\> sc qc [ServiceName] |  |  |\n\n\n| Shutdown and Restart |\n| --- |\n| Shutdown Windows immediately: C: \\> shutdown /s /t 0\u003Cbr>Note: Command may not power down the hardware.\u003Cbr>Restart Windows immediately: C: \\> shutdown /r /t 0\u003Cbr>Abort shutdown/restart countdown: C: \\> shutdown /a |\n\n\n| Useful Netstat Syntax |\n| --- |\n| Show all TCP and UDP port usage and process ID: C: \\> netstat –nao\u003Cbr>Look for usage of port [port] every [N] seconds: C: \\> netstat –nao [N] | find [port]\u003Cbr>Dump detailed protocol statistics:\u003Cbr>C: \\> netstat –s –p [tcp|udp|ip| icmp] |\n\n\n| Installing Built-in Packages on Vista |\n| --- |\n| Install telnet service on Vista:\u003Cbr>C: \\> pkgmgr /iu:\"TelnetServer\"\u003Cbr>Install telnet client on Vista:\u003Cbr>C: \\> pkgmgr /iu:\"TelnetClient\"\u003Cbr>Install IIS on Vista:\u003Cbr>C: \\> pkgmgr /iu:IIS-WebServerRole;WASWindowsActivationService;WASProcessModel; WAS-NetFxEnvironment;WASConfigurationAPI\u003Cbr>To remove any of these packages, replace install update (/iu) with uninstall update (/uu) |\n\n\n| File Search and Counting Lines |\n| --- |\n| Search directory structure for a file in a specific directory:\u003Cbr>C: \\> dir /b /s [Directory] \\ [FileName]\u003Cbr>Count the number of lines on StandardOuy of [Command] :\u003Cbr>C: \\> [Command] | find /c /v \"\"\u003Cbr>Finds the count (/c) of lines that do not contain (/v) nothing (\"\") . Lines that do not have nothing are all lines, even blank lines, which contain CR/LF |\n\n\n| Comma","cbCaidIGp5Fv7adE","https://ap.wps.com/l/cbCaidIGp5Fv7adE","pdf",133967,"English","# Reg Command\n## Adding Keys and Values\n## Export and Import\n## Query for a Specific Value\n# WMIC\n## Fundamental grammar\n## Useful aliases and examples\n# Process and Service Information\n## Tasklist commands\n## sc service queries\n# Shutdown and Restart\n# Useful Netstat Syntax\n# Installing Built-in Packages on Vista\n# File Search and Counting Lines\n# Command Line FOR Loops\n# Invoking Useful GUIs at the Command Line\n# Interacting with the Network Using Netsh","[{\"question\":\"How do you add a registry key on a specific machine using Reg Command?\",\"answer\":\"Use reg add with the target machine and registry domain placeholders, specifying the key location. If no remote machine is specified, the local machine is used.\"},{\"question\":\"What is the basic grammar structure for WMIC commands?\",\"answer\":\"WMIC follows: wmic [alias] [where clause] [verb clause]. You can use aliases like process, service, nicconfig, startup, and qfe.\"},{\"question\":\"How can you configure network firewall and interface settings with Netsh?\",\"answer\":\"Use netsh firewall set opmode disable to turn off the built-in firewall, then configure IP and DNS with netsh interface ip set address and netsh interface ip set dns commands.\"}]","Windows Command Line Cheat Sheet - Pocket Reference Guide | PDF",1791930313]