Windows Command Prompt (CMD) Commands for Server Admins

Applies to: Command Prompt (cmd.exe) on Windows Server 2016 to 2025 and Windows 10 and 11 (syntax from Microsoft’s Windows commands reference; PowerShell aliases checked in PowerShell 7.4)

These are the Command Prompt commands you will use most on a Windows server, grouped by task. For anything that changes the system, open Command Prompt as administrator: right-click Command Prompt in the Start menu and select Run as administrator. Add /? to any command to see its help, for example ipconfig /?.

Run them in Command Prompt. PowerShell also runs the separate tools such as ipconfig, netstat and robocopy, but there dir, del, copy, move, ren and type are aliases for PowerShell cmdlets (for example del is Remove-Item), so options like /a or /q don’t work. Microsoft recommends PowerShell for new automation: see PowerShell commands for Windows servers.

System information

• hostname: the computer name.
• whoami: the account you are logged in with.
• systeminfo: operating system configuration, product ID and hardware such as RAM, disk space and network cards.
• ver: the Windows version number.

Network

ipconfig
ipconfig /all
ipconfig /flushdns
ping 203.0.113.10
tracert example.com
pathping example.com
nslookup example.com
netstat -ano
netstat -ano | findstr :3389
route print

• ipconfig shows the IPv4 and IPv6 addresses, subnet mask and default gateway; /all adds DNS servers and more; /flushdns empties the DNS client cache.
• tracert lists each hop to a host; pathping also measures packet loss per hop.
• netstat -ano: -a shows all connections and listening ports, -n numbers instead of names, -o the process ID (PID). Pipe it to findstr to find one port.
• route print shows the routing table, the same as netstat -r.

Processes and services

tasklist
tasklist /fi "IMAGENAME eq w3wp.exe"
tasklist /fi "PID eq 1234"
tasklist /svc
taskkill /pid 1234
taskkill /pid 1234 /t
taskkill /im notepad.exe /f
sc.exe query state= all
sc.exe query wuauserv

• tasklist /svc shows which services run inside each process.
• taskkill /t also ends the child processes; /f ends the process by force.
• sc.exe query state= all lists running and stopped services. Keep the space after state=: according to Microsoft the command fails without it.

To find what is using a port: netstat -ano | findstr :80, take the PID from the last column, then tasklist /fi "PID eq 1234".

Files and folders

dir /a
cd /d D:\sites
mkdir D:\backup\sites
copy web.config web.config.bak
move report.txt D:\archive\
ren old.txt new.txt
type C:\logs\app.log
findstr /s /i /n "connectionString" *.config
tree D:\sites
del /q *.tmp
rmdir /s /q D:\old-site

• dir /a includes hidden and system files; cd /d changes the drive as well as the folder.
• findstr /s /i /n searches subfolders too, ignores case and prints line numbers.
• del /q doesn’t ask for confirmation, and Microsoft warns that files deleted with del can’t be retrieved. Run dir with the same wildcard first.
• rmdir /s /q deletes a folder with everything in it, without asking. It can’t delete the folder you are currently in.

Copy large folders with robocopy

robocopy C:\sites D:\backup\sites /e /z /r:2 /w:5 /log:C:\logs\backup.log
robocopy C:\sites D:\mirror\sites /mir /r:2 /w:5 /log:C:\logs\mirror.log

• /e copies subfolders, including empty ones; /z can resume an interrupted file.
• /mir makes the destination an exact copy and deletes files there that are not in the source.
• Always set /r and /w: by default robocopy retries a failed file 1,000,000 times, 30 seconds apart.
• Exit codes below 8 mean no failures (1 = files copied); 8 or higher means at least one file failed.

Users

net user
net user alice
net user alice * /add
net user alice /active:no
net user alice /delete

With * in place of a password, Windows prompts for it and doesn’t show it as you type.

Repair, restart and shut down

sfc /scannow
chkdsk C:
shutdown /r /t 0
shutdown /r /t 300 /c "Installing updates"
shutdown /a
shutdown /s /t 0

• sfc /scannow checks protected system files and repairs them where possible (administrators only).
• chkdsk C: without /f only reports; with /f on the system drive it offers to run at the next restart, because the volume is in use.
• shutdown /r restarts, /t sets the delay in seconds (default 30), /c adds a message and /a cancels a pending shutdown. According to Microsoft, any delay above 0 also implies /f, which closes programs without warning.
• On a remote server use shutdown /r, not /s: after a full shutdown you need the control panel or console to power it on again.

Outdated commands

wmic is deprecated; Microsoft says it is superseded by Windows PowerShell for WMI.

Related: change the Remote Desktop port and flush the DNS cache. Running Windows in the cloud: Windows VPS, with the Windows Server licence included.

Official documentation: Microsoft: Windows commands reference.