Windows
73 cheat sheets.
yt-dlp
Downloading video and audio from YouTube and hundreds of other sites with yt-dlp — formats, playlists, subtitles, post-processing, and config.
xcopy
Copy files and directory trees with attribute preservation, date filtering, exclusion lists, and verification. The step between copy and robocopy for most scripting needs.
WSL Interoperability
Running Linux tools from Windows and vice versa, file system access, and networking between WSL and Windows.
wsl
Install, list, export, import, configure, and clone WSL distributions using the wsl.exe command on Windows 10 and 11.
wmic
Query and manage Windows system information — hardware, software, processes, services, and more — from the command prompt using WMI classes and WMIC's SQL-like syntax.
winget Package Manager
Installing, upgrading, and managing packages with Windows Package Manager.
Windows Terminal
Configure Windows Terminal — settings.json structure, profiles for pwsh/cmd/wsl/ssh, keybindings, colour schemes, panes, and the wt.exe CLI.
whoami
Display the current user name, SID, group memberships, and privileges from the Windows command prompt — essential for auditing security context in scripts and support scenarios.
wevtutil
Query, export, clear, and manage Windows Event Log channels from the command line — the primary CLI for event log automation, log archiving, and scripted log analysis on Windows.
tzutil & w32tm
Read and set the system timezone with tzutil, then query, configure, and force-sync the Windows Time service with w32tm — including NTP peer configuration and Kerberos-clock-drift recovery.
tracert
Trace the sequence of routers between your machine and a destination by sending probes with increasing TTL values — the go-to tool for locating where a network path breaks or introduces high latency.
timeout
Pause a batch script for a specified number of seconds with an optional keypress bypass — a reliable replacement for the ping-delay idiom and a safer alternative to sleep in Windows CMD scripts.
tasklist
Display all running processes on a local or remote Windows machine with PID, memory usage, session, and optional service or module details — the cmd.exe equivalent of Task Manager for scripts.
taskkill
End one or more running Windows processes by PID or image name from the command prompt, with options for force termination, process tree killing, filtering, and remote targets.
takeown
Transfer ownership of files and directories to the current user or the Administrators group from an elevated command prompt — a prerequisite for modifying ACLs on system-protected paths.
systeminfo
Display detailed OS, hardware, and network configuration for the local or a remote Windows machine. Covers output formats, remote querying, filtering, and parsing in scripts.
Sysinternals
Bootstrap and drive the headless Sysinternals utilities — PsExec, Handle, PsList, Autoruns, ProcMon, ListDLLs — for process spelunking, file-lock hunting, autostart auditing and scripted system tracing on Windows.
ssh
Connect to remote hosts, transfer files, and forward ports over an encrypted channel using the OpenSSH client built into Windows 10 and later.
shutdown
Initiate, schedule, abort, or force a shutdown, restart, logoff, hibernate, or sleep on a local or remote Windows machine from the command line — essential for scripted maintenance, patch automation, and remote administration.
set
Set, display, and delete cmd.exe environment variables within the current session, perform integer arithmetic with /A, and read interactive user input with /P.
Scoop
Install dev tools without admin rights using Scoop — buckets, manifests, multi-version installs, and reproducible setups.
schtasks
Create, query, run, end, and delete scheduled tasks on local or remote Windows machines from the command prompt — the scripting interface to Windows Task Scheduler.
sc
Query, create, configure, start, stop, and delete Windows services from the command line — the scripting interface to the Service Control Manager, equivalent to the Services MMC snap-in but fully automatable.
runas
Launch a program in the security context of a different user account — elevate to Administrator, switch to a service account, or test application behaviour under a restricted identity.
route
Display, add, delete, and modify entries in the Windows IP routing table — control how packets are forwarded between subnets, add persistent static routes, and diagnose routing failures.
robocopy
Production-grade file and directory synchronisation with mirroring, multi-threading, retry logic, logging, and exclusion filters. The go-to for backup scripts and deployment pipelines on Windows.
rmdir / rd
Delete empty or entire directory trees from the Windows command prompt. Covers the /S and /Q flags, force-removing read-only trees, and safe deletion patterns.
reg
Query, add, modify, export, and import Windows registry keys and values with the built-in reg.exe — the scriptable, no-dependency tool for everything from one-off tweaks to full backup-and-restore.
PowerShell Scripting
Author production-grade PowerShell: advanced functions with [CmdletBinding()], parameter validation, pipeline-bound parameters, splatting, switch parameters, .ps1 vs .psm1, and all the control-flow constructs.
PowerShell Remoting
Execute PowerShell against one or many remote hosts using WinRM or SSH transport, persistent sessions, credential management, and JEA.
PowerShell Pipelines
Deep dive on PowerShell's object pipeline: Where-Object, Select-Object, ForEach-Object, Sort-Object, Group-Object, Measure-Object, Compare-Object, Out-GridView, parallel execution, and the two filter forms.
PowerShell Modules
Install, discover, update, and author PowerShell modules: PowerShellGet, PSResourceGet, the Gallery, $PSModulePath, $PROFILE customisation, PSReadLine, SecretManagement, and the must-have module shortlist.
PowerShell Essentials
Variables, operators, pipelines, Where-Object, ForEach-Object, Select-Object, sorting, grouping, remoting, jobs, CIM, registry, JSON, error handling, and common cmdlets.
PowerShell Error Handling
Master terminating vs non-terminating errors, $ErrorActionPreference, try/catch/finally, throw vs Write-Error, transcripts, and strict mode.
PowerShell Built-in Variables
Complete reference for every automatic and preference variable built into PowerShell — $_, $Error, $MyInvocation, $PSCmdlet, $Host, $PSVersionTable, $ExecutionContext, and all preference variables that tune runtime behaviour.
powercfg
Manage Windows power plans, enable or disable hibernation, diagnose battery health and sleep failures, and generate energy efficiency reports from the command prompt.
ping
Send ICMP echo requests to a host to test reachability, measure round-trip latency, and detect packet loss from the Windows command prompt.
pathping
Trace the route to a destination and measure per-hop packet loss and latency over a sustained sampling period — more diagnostic than tracert and more thorough than ping for identifying intermittent network problems.
nslookup
Query DNS servers for A, AAAA, MX, TXT, NS, PTR, and other resource records from the Windows command prompt — the built-in tool for diagnosing name resolution issues.
netstat
Display active TCP/UDP connections, listening ports, routing tables, interface statistics, and per-connection process IDs from the Windows command prompt.
netsh
Configure network interfaces, firewall rules, wireless profiles, port proxies, and Winsock settings from an elevated command prompt — the comprehensive Windows network configuration CLI.
net user
Create, modify, delete, and list local Windows user accounts from the command prompt — set passwords, manage account expiry, lock/unlock accounts, and control logon hours.
net localgroup
Create, delete, and modify local security groups on a Windows machine — add or remove members, list group memberships, and manage built-in groups from the command prompt.
move
Move files to a new location or rename them within the Windows command prompt. Covers single files, wildcards, directory renames, overwrite control, and cross-drive behaviour.
mountvol
List, create, and remove NTFS volume mount points and display the unique volume GUID path for any drive letter or directory junction from the command prompt.
mkdir / md
Create one or more directories from the Windows command prompt. Covers single and nested directory creation, batch patterns, and common scripting idioms.
logman
Create, start, stop, and manage Data Collector Sets for performance counters, event traces, and configuration data — the command-line interface to Windows Performance Monitor for scripted monitoring and automated log collection.
ipconfig
Display and manage TCP/IP network configuration for all adapters on a Windows machine — covers full adapter details, DNS cache operations, and DHCP lease management.
icacls
Display and modify NTFS access control lists on files and directories — grant, deny, or remove permissions for users and groups, manage inheritance, and save or restore full ACL sets.
hostname
Display the DNS hostname of the local Windows machine from the command prompt — useful in scripts to identify the machine without parsing systeminfo output.
gpresult & gpupdate
Inspect the Resultant Set of Policy that applied to a user and computer with gpresult, then force a refresh with gpupdate — including HTML reports, scope filtering, and the classic 'why didn't my GPO take effect?' workflow.
getmac
Display the MAC (hardware) addresses and associated transport names for all network adapters on a local or remote Windows machine — useful for asset inventory, DHCP reservation setup, and network access control.
fsutil
Inspect and manage NTFS file system internals — query volume info, manage hard links, sparse files, reparse points, the USN journal, and the dirty bit — from an elevated command prompt.
findstr
Search for string patterns inside files or piped input on Windows — the built-in grep equivalent for cmd.exe, with support for regular expressions, case-insensitive matching, and recursive directory searches.
fc
Compare two text or binary files line-by-line or byte-by-byte and report their differences — the built-in Windows equivalent of Unix diff for quick file audits in cmd.exe.
echo
Print text to stdout, expand environment variables, write blank lines, redirect output to files, and toggle command-echoing in cmd.exe batch scripts.
driverquery
Display all installed device drivers on a local or remote Windows machine — module name, type, link date, and driver file path — for hardware audits and troubleshooting.
dism
Service Windows images and the running OS — enable/disable optional features, repair the component store, mount and edit WIM/ESD images, add drivers, and manage editions from an elevated command prompt.
diskpart
Create, delete, format, extend, shrink, and assign drive letters to disk partitions from the Windows command prompt using an interactive or scripted REPL interface.
dir
Display files and folders in a directory with filtering, sorting, formatting, and recursive traversal options. The Windows cmd.exe equivalent of Unix ls.
del
Delete one or more files from the Windows command prompt. Covers wildcards, quiet mode, attribute overrides, recursive deletion patterns, and the distinction from rmdir.
defrag
Analyze, defragment, and optimize volumes from the command line — consolidate free space on HDDs, issue TRIM on SSDs, and schedule or review optimization tasks.
copy
Copy one or more files to a new location in the Windows command prompt. Covers single-file copy, wildcard batches, file concatenation, and binary vs ASCII modes.
cls
Clear all text from the cmd.exe or PowerShell console window and reset the cursor to the top-left — the single command for resetting a terminal session's visible output.
Chocolatey
Install, upgrade, pin, and script software installs on Windows with the choco CLI, packages.config files, and custom sources.
chkdsk
Scan a FAT or NTFS volume for file system errors and bad sectors, optionally repairing them — the built-in Windows disk health and integrity tool for drives and volumes.
certutil
The dual-purpose Windows CLI for certificate-store management and as the most reliable built-in tool for file hashing, base64 encoding, and CRL/CTL handling — no install required.
cd
Navigate the Windows command prompt's current working directory. Covers drive switching, absolute and relative paths, UNC paths, and path-with-spaces quoting.
beets Music Organizer
Importing, tagging, querying, and organizing a music library with beets — config, plugins, queries, and common workflows on Windows.
bcdedit
View and modify the Windows Boot Configuration Data store — manage boot entries, set default OS, change timeouts, enable debugging, and configure boot options from an elevated command prompt.
attrib
View and modify Windows file attributes (hidden, read-only, system, archive) from the command line. Covers all attribute flags, recursive operations, and practical recipes for unhiding malware-hidden files and managing backups.
arp
Display, add, and delete entries in the Windows ARP (Address Resolution Protocol) cache — map IP addresses to MAC addresses, detect IP conflicts, and diagnose Layer 2 connectivity issues.
Windows
PowerShell, winget, WSL interop, yt-dlp, beets, and Windows administration.