For many Windows users, the thought of using the Command Prompt is either a scary experience or something that they will never need. But for some, the command prompt is a powerful tool that can be far more useful than many graphical tools available in Windows.
Being a System Administrator, I constantly use the command prompt, mostly because I access systems remotely and many tasks can be performed quickly with out the graphics over head (even though connecting via Terminal Server is very convenient).
So if you are an avid user of the command line, here are my top 10 built-in (non third party) command line tools for XP, Vista and WIndows server versions (remember these commands are not your typical tools, such as find, copy, move, dir, etc..).
1 - systeminfo - Have a need to display operating system configuration information for a local or remote machine, including service pack levels? Then systeminfo is the tool to use. When I need to connect to a system that I am not familiar with, this is the first tool I run. The output of this command gives me all the info I need including: host name, OS type, version, product ID, install date, boot time and hardware info (processor and memory). Also knowing what hot fixes are installed can be a big help when troubleshooting problems. This tool can be used to connect to a machine remotely using the following syntax: SYSTEMINFO /S system /U user
2 - ipconfig - This tool may be most useful tool for viewing and troubleshooting TCP/IP problems. It's capability includes release or renew an adapter IP Address, display and flush DNS cache, re-register the system name in DNS. WIth Vista and some server versions, ipconfig includes support for IPv6.
Some examples when usinging ipconfig.
- To view all TCP/IP information, use: ipconfig /all
- To view the local DNS cache, use: ipconfig /displaydns
- To delete the contents in the local DNS cache, use: ipconfig /flushdns
3 - tasklist and taskkill - If you are used to Windows Task Manager, then you'll find tasklist very easy to use. This tool displays a list of currently running processes, including image name, PID (Process ID) and memory usage on local or remote machines. Using the /V switch displays more information in verbose mode that includes, CPU Time, user name, and modules. Tasklist includes a filter option to display a set of task based on the criteria specified. But the best use of the filter is using it to display programs running inside svchost.exe process.
Of course, there will be times when a process needs to be killed and taskkill can be used to terminate those trouble processes. A single or multiple processes can be killed using the PID (/PID ) or image name (/IM ). Here are two examples for doing just that:
TASKKILL /IM notepad.exe
TASKKILL /PID 1230 /PID 1241 /PID 1253 /T
Both tasklist and taskkill can connect to remote systems using the /S (system name) /U (user name) switches.
4 - netstat - Need to know who (or what) is making a connection to your computer? Then netstat is the tool you want to run. The output provides valuable information of all connections and listening ports, including the executable used in the connections. In additon to the above info, you can view Ethernet statistics, and resolve connecting host IP Addresses to a fully qualified domain name. I usually run the netstat command using the -a (displays all connection info), -n (sorts in numerical form) and -b (displays executable name) switches.
5 - type - A lesser known tool to those who don't work with the command prompt. For Administrators, the type command is the perfect tool for viewing text files. But what many people don't know about the type tool, is it's capability to read multiple files at once. For example to view multiple text files, just separate each file with a space:
type firstfile.txt secondfile.txt thirdfile.txt
For files that are large, you can control text scrolling using the more command.
6 - net command - Although this tool is more known as a command, the net command is really like a power drill with different bits and is used to update, fix, or view the network or network settings.
It is mostly used for viewing (only services that are started), stopping and starting services:
- net stop server
- net start server
- net start (display running services)
and for connecting (mapping) and disconnecting with shared network drives:
- net use m: \\myserver\sharename
- net use m: \\myserver\sharename /delete
Other commands used with net command are, accounts (manage user accounts), net print (manage print jobs), and net share (manage shares).
Below are all the options that can be used with the net command.
[ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |HELPMSG | LOCALGROUP | PAUSE | PRINT | SESSION | SHARE | START |STATISTICS | STOP | TIME | USE | USER | VIEW ]
To display the complete syntax for each command, just type net help followed by the command - net help use .
7 - nslookup - With the Internet, DNS (Domain Name Service) is the key for allowing us to use friendly names when surfing the web instead of needing to remember IP Addresses. But when there are problems, nslookup can be a valuable tool for testing and troubleshooting DNS servers.
Nslookup can be run in two modes: interactive and noninteractive. Noninteractive mode is useful when only a single piece of data needs to be returned. For example, to resolve google.com:
To use the interactive mode, just type nslookup at the prompt. To see all available options, type help while in interactive mode.
Don't let the help results intimidate you. Nslookup is easy to use. Some of the options I use when troubleshooting are:
set ds (displays detailed debugging information of behind the scenes communication when resolving an host or IP Address).
set domain (sets the default domain to use when resolving, so you don't need to type the fully qualified name each time).
set type (sets the query record type that will be returned, such as A, MX, NS)
server NAME (allows you to point nslookup to use other DNS servers than what is configured on your computer)
To exit out of interactive mode, type exit .
8 - ping and tracert - These tools can be helpful with connectivity to other systems. Ping will test whether a particular host is reachable across an IP network, while tracert (traceroute) is used to determine the route taken by packets across an IP network.
To ping a system just type at the prompt: ping www.google.com. By default, ping will send three ICMP request to the host and listen for ICMP “echo response†replies. Ping also includes switches to control the number of echo requests to send (-n ), and to resolve IP addresses to hostname (-a ).
To use tracert, type at the prompt: tracert www.google.com. You can force tracert to not resolve address to hostnames by using the -d switch, or set the desired timeout (milliseconds) for each reply using -w switch.
9 - gpresult - Used mostly in environments that implement group poicies, gpresults (Group Policy Results) verifies all policy settings in effect for a specific user or computer. The command is simple to use, just enter gpresults at the prompt. It can also be used to connect to computers remotely using the /S and /U switches.
10 - netsh - Without a doubt the most powerful command line tool available in Windows. Netsh is like the swiss army knife for configuring and monitoring Windows computers from the command prompt. It capabilities include:
- Configure interfaces
- Configure routing protocols
- Configure filters
- Configure routes
- Configure remote access behavior for Windows-based remote access routers that are running the Routing and Remote Access Server (RRAS) Service
- Display the configuration of a currently running router on any computer
Some examples of what you can do with netsh:
- Enable or disable Windows firewall:
netsh firewall set opmode disable
netsh firewall set opmode disable
- Enable or disable ICMP Echo Request (for pinging) in Windows firewall:
netsh firewall set icmpsetting 8 enable
netsh firewall set icmpsetting 8 disable
- Configure your NIC to automatically obtain an IP address from a DHCP server:
netsh interface ip set address "Local Area Connection" dhcp
(For the above command, if your NIC is named something else, use netsh interface ip show config and replace the name at Local Area Connection).
As you can see netsh can do alot. Instead of re-inventing the wheel, check out the following Microsoft article for more info on netsh.
The use of Windows command line tools can be a powerful alternative when only a command prompt is available. I'm sure there are plenty more commands that I have not mention.
Let us know what your favorite command line tool is and leave a comment below.
Comments on Top 10 Windows Built-In Command Line Tools
Heya,
in case you don't want to use PowerShell, try WMIC (built-in command line tool). This is Windows command line swiss knife, even though it requires some practice to get used to…
Martin
I'm using NVER command. It shows version information of PE file (EXE,DLL, OCX and etc.)
http://www.deepsoftware.com/nver/
@teremock
Very cool utility. I'm going to have to add that to my list of sys admin tools.
Is deepsoftware.com your site? I noticed a couple of other nice tools that I can use.
You seem to have spent a great deal of attention on the Windows built-in command-line tools. Perhaps you can help me:
Is there a command-line way to do either "search & replace" or "return only matching portion" on strings or files in Windows?
My goal is to pipe PIDs from tasklist into netstat, so as to see what ports certain processes are using, and I am restricted to using only built-in Windows commands.
Thank you in advance,
Danielle
@Danielle Meadow
For situations as you described, this is where I relied on Unix tools for Windows (such as MKS Toolkit for Windows). Windows commands just don't have this type of functionality and since I also managed Linux servers, using the same set of command line tools made administraion easy across both OS's.
You may want to check out Windows Power Shell (I don't use it only because I don't have the time to learn a new scripting language).
Thank you. I will try those out.
It's a relief to have some confirmation of the absence of these tools. I thought I just could not find them, but that they must exist.
Danielle
Hi Danielle,
that is possible, however you would need to be more specific about what you want to achieve…
Parsing of tasklist could be done using For /f (tokenizing)…
Search and replace is built-into variables (%Var:OriginalString=ReplaceString%).
Searching for specific portions can be either done using Find or FindStr if you want to use RegEx.
Anyway, if you have a chance to use PowerShell, do it - it is more powerfull than *nix shells and there is no way how you could compare it to cmd 😉
Hi Martin,
Thank you. I want to find out what ports are being used by any processes of a given imagename. Not sure how I could be more specific than that. As far as I could tell, the info on what processes are running comes from TASKLIST, but to find out the port info I'd need to look in NETSTAT.
I'm not familiar with For /f (tokenizing). Clearly, I should look this up. I'm new to Windows scripting!
I read some tutorials about search-and-replace in variables. If I recall correctly, the replacement only affects the value which the variable evaluates to that time — not the underlying value actually stored in the variable. No? If you have a good tutorial to recommend, I'd take another look at it.
I do want to use regexes, but FindStr did NOT fully meet my needs. It always returns the whole line in which the regex matches, when I only want to backreference the matching parts.
Well, that's two recommendations for PowerShell so far! I will see if I can use that. I do have SP2 available
HI Danielle,
that is why should should understand how For /f works 😉
For /f is used to take string (for example "Hello world") and split it to tokens, so you will end up with two variables (with values "Hello" and "World").
Sorry, I didn't get what you mean 🙁 If variable %X% is Hello world, than
Set X=%X:World=Danielle% would change X to Hello Danielle.
If you have a chance to use PowerShell, don't bother yourself with batches. As I said, it is not even possible to compare them (PowerShell is more like .NET shell)
I would love to write that script for you, however netstat doesn't work on my PC (duh, haven't seen that before ;)).
Anyway, you don't need to use tasklist, because you already got process name in netstat.
So I would recommend to use netstat /b | FindStr XXX together with for /f.
What it means: netstat /b should display all open connections + process name.
You will use FindStr to retrieve just lines where your process is mentioned.
You will use For /F to tokenize output and retrieve port number.
But as mentioned few times - using *nix utils or powershell, this task is much easier to achieve.
I should repeat that the restriction I'm working under is "only tools that come standard with recent Windows". Unfortunately this rules out the many handy Unix-type for Windows tools.
It's true that NETSTAT /B displays all open connections + process name. BUT, at least where I've tried it, the process name always displays on a new line, below the port information. Therefore FINDSTR can't find both the port and the name together. (Or is there something I'm overlooking?) But thank you for pointing out the /B option; it's definitely a step in the direction I want.
If I were using grep, it would be easy to tell it to give me 1 line's context before the match. I don't think there's a way to do this with FINDSTR.
For /f sounds very useful.
[some poking around later….]
for /d "usebackq tokens=2 skip=3" %i in ('tasklist /fi "imagename eq %imname%*" /fo table') do @netstat -nop TCP | @findstr /E %i
The above command works for me. It's surely wasteful, since it re-runs netstat for each matching token — but it gives me what I needed.
Thank you both, Watching The Net(Mike?) & Martin for your help. And if you see a way to improve on the above, please let me know it!
Danielle
correction:
for /f "usebackq tokens=2 skip=3" %i in ('tasklist /fi "imagename eq %imname%*" /fo table') do @netstat -nop TCP | @findstr /E %i
correction:
for /f "usebackq tokens=2 skip=3" %i in (`tasklist /fi "imagename eq %imname%*" /fo table` ) do @netstat -nop TCP | @findstr /E %i
So that's what you wanted, isn't it? 😉
Anyway, still don't understand why you need tasklist - you already know process name, so what's the reason for using it?
Hi Martin,
Thank you. Yes, this query gets me what I wanted.
The reason for using Tasklist is to get the PID, which allows me to *filter* the output from Netstat, so as to see ONLY the process(es) of interest. There are a lot of irrelevant processes with TCP ports open…
It is true that I know the process name from the get-go. But I do not know a way to tell Netstat to pre-filter by process name (I wish it could! Or even by PID). That being the case, I must turn to FindStr to post-filter the Netstat results, in order to keep only those of interest.
Here's the point that either you are missing (or else *is* possible to do, but I am ignorant of how): FindStr cannot do multi-line matches. NetStat /B returns the process name on a different line than the port ID.
Therefore, it is not possible for me to match on process name, and get the crucial Port info, too.
The PID is returned on the same line as the Port ID by NetStat, so I *can* use the *PID* with FindStr to filter the results. TaskList is my way to convert from process name (sadly useless for filtering) to PID (useful for filtering).
Regards,
Danielle
Hi Danielle,
now I see finally 🙂
For /f "usebackq tokens=1,2,*" %i IN (`tasklist /fi "imagename eq %imname%*" /nh`) Do (For /f "usebackq tokens=2,5" %a IN (`netstat -nop TCP`) Do
(If /i "%b" equ "%j" Echo %a))
Makes sense?
Martin
Martin,
Yes that makes sense. Thanks!
I adjusted the columns a bit and suppressed the command-echo using @, resulting in the following:
For /f "usebackq tokens=1,2,8" %i IN (`tasklist /v /nh /fi "imagename eq %imname%*"`) Do @(For /f "usebackq tokens=2,4,5" %a IN (`netstat -nop TCP`) Do @(if %c equ %j echo %j %i %a %b %k ))
Danielle
Hi. Just needed this like Danielle.
But with Martin's command from March 18 @ 5:01 PM, i get this output:
…
C:\>(If /I "800" EQU "No" Echo 193.19.62.222:55631 )
C:\>(If /I "1452" EQU "No" Echo 193.19.62.222:61688 )
…
which result anyway I don't understand
With Danielle's version from March 23 @ 11:12 AM I get nothing! I mean, I get the prompt immediately with no output.
Can someone help a little?
albresc
This is fantastic! Great summary of commands. Just what I needed.
May God bless you.
Mazlan
That's a good summary of windows commands. I am writing up a blog specially about windows command line and have added tips for doing most of the computer administration tasks from command line. Thought mentioning the link here would help the visitors..
http://www.windows-commandliencom
correcting the link, it's http://www.windows-commandline.com