4. File System & Data Management (dir, cd, del, copy, xcopy, robocopy, attrib, cipher, icacls...)
dir
dir C:\Windows
dir /a (Hidden/system)
dir /s (Recursive)
dir /b (Bare)
dir /o:d (Sort by date)
dir /tc (Show creation time)
cd / chdir
cd C:\Users
cd .. (Up one)
md / mkdir
md C:\Temp\NewFolder
rd / rmdir
rd C:\Temp\OldFolder (Only if empty)
rd /s /q C:\Temp\OldFolder (Remove dir + contents — caution)
copy / move / ren
copy C:\file.txt D:\backup\
move C:\file.txt D:\
move C:\OldFolderName C:\NewFolderName
ren oldname.txt newname.txt
del / erase (Destructive!)
del C:\Temp\file.txt
del /f /q C:\Temp\*.tmp (Force + quiet)
xcopy (legacy) / robocopy (preferred)
xcopy C:\source D:\dest /E /H /I /Y
robocopy C:\source D:\dest /E /COPYALL /R:3 /W:10
robocopy C:\source D:\dest /MIR (Mirror — deletes extras!)
type / find / findstr / sort / comp / fc / tree
type C:\Windows\System32\drivers\etc\hosts
find "error" C:\logs\app.log
findstr /i /s /c:"password" C:\Users\*.txt
ipconfig /all | findstr /i "DNS Servers"
type names.txt | sort
sort < names.txt > sorted_names.txt
comp file1.bin file2.bin
fc file1.txt file2.txt
tree C:\Windows /F
attrib
attrib C:\Windows\System32\ntdll.dll (Show attributes)
attrib +h C:\secret.txt (Hide — often Admin)
attrib -r C:\config.ini (Remove read-only)
cipher (EFS)
cipher /c (Encryption status)
cipher /e C:\SecretFolder (Encrypt folder)
cipher /w:C: (Wipe free space — long) (Admin)
compact (NTFS compression)
compact /c /s:C:\Logs (Compress dir)
compact /u /s:C:\Logs (Uncompress)
diskpart (Admin) — destructive if misused!
list disk | select disk | list partition | list volume | detail disk
clean (WIPES disk) | create partition primary | format fs=ntfs quick | assign letter=E
format (Destructive)
format D: /fs:ntfs /q
chkdsk
chkdsk C:
chkdsk C: /f (Fix errors — may reboot)
chkdsk C: /r (Scan bad sectors — includes /f)
takeown (Admin)
takeown /f
takeown /f /r /d y
icacls (Admin)
icacls (Show perms)
icacls /grant Administrators:F
icacls /inheritance:d
icacls /reset /t
openfiles (Admin)
openfiles /local on (Enable tracking — reboot needed)
openfiles /query /v
5. User, Group & Policy Management (net user, net localgroup, gpupdate, gpresult, runas, assoc/ftype, control)
net user
net user (List local users)
net user (Details)
net user (Change password) (Admin)
net user /active:no (Disable) (Admin)
net user /add (Add user) (Admin)
net user /delete (Delete user) (Admin)
net localgroup (Admin)
net localgroup (List local groups)
net localgroup Administrators (List members)
net localgroup Administrators /add
net localgroup Administrators /delete
net localgroup NewGroup /add
gpupdate
gpupdate (Update policies)
gpupdate /force (Re-apply all) (Sometimes Admin)
gpresult
gpresult /r (Summary for current user/computer)
gpresult /Scope Computer /v (Verbose computer policy) (Admin)
gpresult /Scope User /v (Verbose user policy)
gpresult /h C:\temp\gp_report.html (HTML report) (Admin)
runas
runas /user:DOMAIN\Administrator cmd.exe
runas /user:LocalAdmin /savecred "notepad.exe C:\windows\system32\drivers\etc\hosts" (Use with caution)
assoc / ftype
assoc .txt (Show association)
ftype txtfile (Command used for 'txtfile' type)
control (Control Panel)
control | control printers | control userpasswords2
6. Event Log Management (wevtutil, eventvwr)
wevtutil (Admin for Security/System)
wevtutil el (List logs)
wevtutil qe Security /c:10 /rd:true /f:text (10 newest Security events)
wevtutil qe System /q:"*[System[Level=2]]" /c:5 /f:text (5 newest System Errors)
wevtutil epl Security C:\Backup\SecurityLog.evtx (Export Security log)
wevtutil cl Security (CLEAR Security log — erases evidence!)
eventvwr
eventvwr (Open GUI)
eventvwr Security (Open specific log)
