Windows Command-Line Tools

Windows ships with a Command Prompt (cmd.exe) that holds a set of tools every technician must know by name and function. The 220-1202 exam tests these commands directly: given a task, which command? Given a command, what does it do? This lesson covers all of them, organized by category.

Scope: Command Prompt only — PowerShell is out of scope for this lesson. Commands shared with Core 1 (ping, tracert, ipconfig) appear here in the Windows context; the networking concepts behind them are not re-taught.

Open a standard Command Prompt by typing cmd in the Start menu search. For commands that require administrator privileges — specifically sfc — right-click Command Prompt and select Run as administrator.

Navigation Commands

cd — Change Directory Changes the current working directory.

• cd Documents — move into the Documents subfolder
• cd .. — move up one directory level
• cd \ — jump to the root of the current drive (C:\)
• cd C:\Users\Tech — navigate to a full absolute path

dir — List Directory Lists the contents of the current directory: file and folder names, sizes, and dates.

• dir — list files and folders in the current directory
• dir /a — include hidden and system files in the listing
• dir /p — pause output after each screen, useful for long listings

Network Commands

Reference: IP addressing, DHCP, DNS, and the protocols behind these commands were covered in the Core 1 Networking module. This section teaches Windows command syntax and flags — not the underlying networking concepts.

ipconfig — IP Configuration Displays the IP configuration for all network adapters. The most-tested command in this category.

• ipconfig — shows IP address, subnet mask, and default gateway per adapter
• ipconfig /all — full details: MAC address, DHCP enabled/disabled, lease obtained/expires, DHCP server address, DNS server addresses
• ipconfig /release — releases the current DHCP-assigned IP address (sends a DHCPRELEASE message)
• ipconfig /renew — requests a new DHCP lease from the server
• ipconfig /flushdns — clears the local DNS resolver cache; forces the next DNS lookup to query the server rather than serving a cached (possibly stale) result

ping — Test Connectivity Tests reachability of a host by sending ICMP Echo Request packets and measuring round-trip time and packet loss. A quick first step for "can this machine reach that host?" Covered in Core 1 ts-network — apply it here as a Windows command.

netstat — Network Statistics Displays active TCP/IP connections and ports the local machine is listening on.

• netstat — shows currently active connections only
• netstat -a — shows all connections AND all listening ports (not just active established ones)
• netstat -n — shows IP addresses and port numbers in numerical form rather than resolving them to hostnames; faster output; useful when DNS is slow or broken

nslookup — Name Server Lookup Queries a DNS server to resolve a hostname to an IP address (or reverse-resolve an IP to a hostname). Use nslookup when you suspect DNS is failing — if ping hostname fails but ping IP-address succeeds, nslookup confirms whether DNS resolution is the problem.

• nslookup google.com — shows which DNS server answered and what IP was returned
• nslookup google.com 8.8.8.8 — queries a specific DNS server (bypasses the configured DNS to test an alternative)

net use — Map Network Drive Maps a remote network share to a local drive letter.

net use Z: \\server\share

The mapped drive appears as drive Z: in File Explorer. Run net use alone to list all currently mapped network drives. Use net use Z: /delete to disconnect a mapped drive.

tracert — Trace Route Traces the path packets take from your machine to a destination host, displaying each router hop and the round-trip time to that hop. Used to identify where a connection slows or fails. Covered in Core 1 ts-network — apply it here as a Windows command.

pathping — Path Ping Combines the route-tracing of tracert with packet-loss statistics per hop. Like tracert, pathping shows every hop to the destination. Unlike tracert, it also calculates how many packets are dropped at each hop over a collection period. Use pathping when you need to identify not just latency but where packets are actually being lost — information tracert cannot provide. Because it collects statistics across many packets per hop, pathping takes significantly longer to complete than tracert.

Disk Management Commands

Reference: chkdsk's diagnostic context was covered in Core 1 ts-storage. This section teaches the Windows command syntax and flags.

chkdsk — Check Disk Checks a volume for filesystem errors and bad sectors.

• chkdsk C: — scans drive C: and reports problems (read-only; no changes made)
• chkdsk C: /f — fixes filesystem errors; repairs corrupted filesystem metadata; requires the volume to be offline (schedules at next reboot if the drive is in use)
• chkdsk C: /r — locates bad sectors and recovers readable data; includes everything /f does (implies /f); also requires exclusive volume access and schedules at next boot if needed

format — Format a Volume Writes a new filesystem to a volume, making it ready for use. Specifying the filesystem type is standard practice.

format D: /FS:NTFS
format D: /FS:FAT32
format D: /FS:exFAT

diskpart — Disk Partition Manager An interactive disk partitioning utility. Unlike the other commands in this lesson, diskpart opens its own sub-environment — typing diskpart at the prompt launches a DISKPART> prompt with its own command set. Common operations inside diskpart: list disk, select disk, create partition primary, format fs=ntfs quick, assign letter=D.

Know what diskpart does (interactive command-line disk partitioning and management) and that it is the command-line counterpart to the Disk Management GUI (diskmgmt.msc from L4). You do not need to memorize the full diskpart command set for the A+ exam.

File Management Commands

md (or mkdir) — Make Directory Creates a new directory at the current path or a specified full path.

md Backups
md C:\Users\Tech\ProjectFiles

Both md and mkdir are accepted — they are identical commands.

rmdir (or rd) — Remove Directory Removes a directory. By default, the directory must be empty.

• rmdir FolderName — removes an empty directory only
• rmdir FolderName /s — removes the directory and all of its contents — every file and subfolder inside it; Windows prompts for confirmation before proceeding

robocopy — Robust File Copy An advanced file copy tool that preserves metadata the basic copy command discards. Robocopy maintains:

• NTFS permissions (ACLs) — destination files inherit the source access control entries
• Timestamps — file creation, modification, and last-access dates are carried to the destination
• File attributes — read-only, hidden, system attributes are preserved
• Interrupted copies — if a copy session is interrupted, robocopy restarts where it left off without re-copying already-completed files

Robocopy is the standard tool for migrating user data or performing backups where permissions must be maintained. The basic copy command copies file data only — ACLs and timestamps are not transferred.

Informational Commands

hostname Displays the computer's network hostname — the name the machine uses to identify itself on the network. No arguments needed.

net user — Manage Local User Accounts Manages local user accounts on this machine. Note: net use maps network drives; net user manages accounts — review the callout above if needed.

• net user — lists all local user accounts
• net user [username] — displays account details: full name, last logon time, group membership, password policy
• net user [username] [password] — sets or changes the account password
• net user [username] /add — creates a new local user account

net user manages local accounts only. Domain accounts are managed on the domain controller — not via net user on the local machine.

winver — Windows Version Opens a dialog box showing the Windows version, build number, and edition. A quick way to identify what version of Windows is installed without navigating to Settings → System → About.

whoami — Current User Displays the currently logged-in username.

• On a domain-joined machine: DOMAIN\username
• On a non-domain machine: COMPUTERNAME\username

Useful for confirming which account context is active — especially after running as administrator or switching accounts.

[command] /? — Built-in Help Appending /? to any Windows Command Prompt command displays its built-in syntax reference: available flags, usage examples, and brief descriptions.

chkdsk /?
netstat /?
robocopy /?
ipconfig /?

OS Management Commands

gpupdate — Group Policy Update Forces Group Policy to refresh immediately on the local machine. Group Policy normally refreshes automatically on a background schedule (every 90 minutes for users, with a random offset). Use gpupdate after a policy change to apply it without waiting for the next automatic cycle.

• gpupdate — refreshes only policy settings that have changed since the last refresh
• gpupdate /force — re-applies all Group Policy settings regardless of whether they have changed; use when a policy should be applied but is not taking effect

gpresult — Group Policy Result Shows which Group Policy settings are currently applied to the computer and the logged-in user — the Resultant Set of Policy (RSoP). Use it to confirm that a policy change applied correctly after running gpupdate.

• gpresult /r — displays a summary of applied policies directly in the command prompt window
• gpresult /h report.html — generates a full HTML report of all applied policy settings

sfc — System File Checker Scans all protected Windows system files for corruption and replaces any damaged or missing files using a cached backup copy stored locally. Use sfc when Windows is behaving unexpectedly and you suspect core system files are corrupted.

• sfc /scannow — begins an immediate scan and repair

Command Reference

The check questions below test your ability to match commands to tasks, select the correct flag for a scenario, and distinguish the commonly confused net use from net user.