Windows command line for support work

A support ticket arrives: 4 of 8 project laptops cannot reach the file share after a weekend update. The technician who takes the call never sits at any of them. Three minutes later the desk knows which layer is wrong, because the first commands are the same every time: ipconfig to see each adapter’s state, ping to the gateway, nslookup against the office DNS and a Test-NetConnection to the share.

Windows ships two shells, Command Prompt and PowerShell, and most of a help desk’s work happens in one of them: reading a PC’s network, user and policy state, running the three repair commands in the right order, and copying files without ever losing one. You will do each of those on sample output written in the layouts Windows prints, in the order the desk follows them, and finish by swapping the old WMIC commands for their PowerShell replacements.

Command Prompt and PowerShell: two shells, the same tasks

Windows gives you two shells and both are built in. The Command PromptCommand Prompt: Windows' older command-line shell, cmd.exe, which runs built-in commands and classic utilities such as ipconfig and sfc, uses backslash paths, and prints help for each command when the command is called with /? at the end. runs the built-in commands that have shipped with Windows for decades, plus every classic utility such as ipconfig, whoami, sfc and chkdsk. PowerShell adds a second language on top: every command there is a PowerShell cmdletPowerShell cmdlet: A PowerShell command of the shape Verb-Noun (Get-Process, Set-Location, Test-NetConnection), implemented in .NET and returning objects another cmdlet can take as input; Get-Help names its parameters and shows examples. of the form Verb-Noun (Get-Process, Test-NetConnection, Resolve-DnsName), each returning an object another cmdlet can take as input.

Most of a desk’s day is in Command Prompt because the muscle memory of dir, cd and copy is quick; PowerShell comes out when you need a filter the old commands cannot express (“every process whose name starts with Teams and uses more than 1 GB of memory”). The two shells share the same disk, so a file created in one is visible in the other at once.

The same work in the two shells, side by side:

Microsoft’s Get-Help cmdlet is the PowerShell neighbour of /?: it reads the help topic that ships beside each cmdlet, and the -Examples switch jumps straight to the ones you can copy. For a Command Prompt utility, /? at the end prints the same information. Nobody memorises every switch; everybody looks them up.

Some commands need more rights than a normal sign-in gives. An elevated promptelevated prompt: A Command Prompt or PowerShell window started with administrator rights, so commands that touch system files or settings succeed instead of being refused; whoami /groups prints a Mandatory Label of High Mandatory Level in such a window. is a Command Prompt or PowerShell window started with “Run as administrator”: sfc, DISM, chkdsk /f and anything that writes to HKEY_LOCAL_MACHINE need one. whoami /groups in that window lists Mandatory Label\High Mandatory Level, which is the quick way to tell. The Windows accounts, UAC and user profiles lesson goes into why.

ipconfig shows the state of every adapter at once

The first command on nearly every connectivity ticket is ipconfig /all. Microsoft’s reference page says it “displays all current TCP/IP network configuration values and refreshes DHCP and DNS settings”; without parameters, it prints the IPv4 and IPv6 address, mask and default gateway for every adapter. The /all form adds the DNS servers, the physical (MAC) address and whether DHCP is on.

The output is a block of key-value lines per adapter, so a short script can turn it into records a technician can scan or a ticket system can file. The program below reads a sample in the layout ipconfig /all prints, with addresses from the documentation ranges (RFC 5737) and MAC addresses from the RFC 9542 documentation range, and returns one record per adapter and a list of flags for any adapter whose state is wrong:

# Read a sample of what `ipconfig /all` prints and summarise every adapter,
# with the three flags a help desk looks for: an APIPA address (RFC 3927,
# the 169.254.0.0/16 link-local range), an adapter with an IPv4 but no
# default gateway, and DHCP switched off on an adapter that has no address.
# The sample follows the field names Microsoft's ipconfig page documents
# (Description, DHCP Enabled, IPv4 Address, Subnet Mask, Default Gateway,
# DNS Servers, Media State, Autoconfiguration IPv4 Address). It is a sample
# written in that layout, with addresses from the documentation ranges
# (RFC 5737: 192.0.2.0/24, 198.51.100.0/24) and MAC addresses from RFC 9542.

SAMPLE = r"""Windows IP Configuration

   Host Name . . . . . . . . . . . . : LAB-PC-07
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : corp.example
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection
   Physical Address. . . . . . . . . : 00-00-5E-00-53-10
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.0.2.47(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.0.2.1
   DNS Servers . . . . . . . . . . . : 192.0.2.53
                                       198.51.100.53

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201
   Physical Address. . . . . . . . . : 00-00-5E-00-53-11
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Autoconfiguration IPv4 Address. . : 169.254.112.68(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . :

Ethernet adapter Ethernet 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek USB GbE Adapter
   Physical Address. . . . . . . . . : 00-00-5E-00-53-12
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
"""


def _clean_key(part):
    # The documented layout spells each key with trailing dot fillers,
    # for example "DHCP Enabled. . . . . . . . . . . ". Strip the dots and
    # spaces off the right so a plain name is left.
    return part.strip().rstrip(". ").strip()


def _clean_value(value):
    # Microsoft marks preferred and tentative addresses with a parenthesised
    # note; the IPv4 for a parser is the address before the parenthesis.
    return value.split("(", 1)[0].strip()


def parse_ipconfig(text):
    """Turn one `ipconfig /all` output into adapter records and flags.

    Each adapter record is a dict with these keys:
      name          the heading after "adapter " (Ethernet, Wi-Fi, ...)
      description   the Description line
      ipv4          IPv4 Address or Autoconfiguration IPv4 Address, as text
      mask          Subnet Mask, as text
      gateway       Default Gateway, as text ("" when the line is empty)
      dhcp          True for Yes, False for No, None when the key is missing
      dns           every DNS server listed under this adapter, in order
      disconnected  True when Media State says "Media disconnected"

    The flags list holds (name, reason) tuples: APIPA (RFC 3927), an adapter
    whose IPv4 is set but whose gateway is empty, and DHCP off with no IPv4.
    Disconnected adapters are left out of the flags: they are off, not sick.
    """
    adapters = []
    current = None
    expect_dns = False
    for line in text.splitlines():
        stripped = line.strip()
        if not stripped:
            expect_dns = False
            continue
        if (
            line == line.lstrip()
            and " adapter " in line
            and line.endswith(":")
        ):
            if current is not None:
                adapters.append(current)
            name = line.split(" adapter ", 1)[1].rstrip(":").strip()
            current = {
                "name": name,
                "description": "",
                "ipv4": "",
                "mask": "",
                "gateway": "",
                "dhcp": None,
                "dns": [],
                "disconnected": False,
            }
            expect_dns = False
            continue
        if current is None:
            continue
        if ":" in line:
            key_part, _, value = line.partition(":")
            key = _clean_key(key_part)
            value = value.strip()
            if key == "DNS Servers":
                expect_dns = True
                if value:
                    current["dns"].append(value)
            else:
                expect_dns = False
                if key == "Description":
                    current["description"] = value
                elif key == "DHCP Enabled":
                    current["dhcp"] = value.lower() == "yes"
                elif key in ("IPv4 Address", "Autoconfiguration IPv4 Address"):
                    current["ipv4"] = _clean_value(value)
                elif key == "Subnet Mask":
                    current["mask"] = value
                elif key == "Default Gateway":
                    current["gateway"] = value
                elif key == "Media State" and value.lower() == "media disconnected":
                    current["disconnected"] = True
        elif expect_dns:
            current["dns"].append(stripped)
    if current is not None:
        adapters.append(current)

    flags = []
    for adapter in adapters:
        if adapter["disconnected"]:
            continue
        if adapter["ipv4"].startswith("169.254."):
            flags.append((adapter["name"], "APIPA: no DHCP reply, link-local address"))
        if adapter["ipv4"] and not adapter["gateway"]:
            flags.append((adapter["name"], "no default gateway"))
        if adapter["dhcp"] is False and not adapter["ipv4"]:
            flags.append((adapter["name"], "DHCP off and no address"))
    return {"adapters": adapters, "flags": flags}


result = parse_ipconfig(SAMPLE)

print(f"{'adapter':<12}{'ipv4':<17}{'gateway':<12}{'dhcp':<6}dns")
for adapter in result["adapters"]:
    if adapter["disconnected"]:
        state = "down"
    elif adapter["dhcp"] is False:
        state = "off"
    else:
        state = "on"
    dns = ", ".join(adapter["dns"]) or "-"
    gateway = adapter["gateway"] or "-"
    ipv4 = adapter["ipv4"] or "-"
    print(f"{adapter['name']:<12}{ipv4:<17}{gateway:<12}{state:<6}{dns}")

print()
if not result["flags"]:
    print("No flags: every connected adapter has an address and a gateway.")
for name, reason in result["flags"]:
    print(f"{name}: {reason}")

adapter     ipv4             gateway     dhcp  dns
Ethernet    192.0.2.47       192.0.2.1   on    192.0.2.53, 198.51.100.53
Wi-Fi       169.254.112.68   -           on    -
Ethernet 2  -                -           down  -

Wi-Fi: APIPA: no DHCP reply, link-local address
Wi-Fi: no default gateway

Three things worth noticing in the run. The Ethernet adapter has a routable IPv4 and a gateway, and both of its DNS servers are listed under the one key: a classic working lease. The Wi-Fi adapter has the address 169.254.112.68, which is in the IPv4 link-local range 169.254.0.0/16 defined by RFC 3927; Microsoft calls it APIPAAPIPA: Automatic Private IP Addressing, Windows' name for the IPv4 link-local range 169.254.0.0/16 defined by RFC 3927, which an adapter uses when DHCP cannot reach a server and which allows communication only on the same physical link. and gives it to an adapter when DHCP cannot reach a server. The script’s second flag, “no default gateway”, says the same thing from a different angle: an adapter with an IPv4 but no gateway can talk to its own subnet and nothing beyond it. The third adapter is physically disconnected, so it has no address and no flag; a disconnected adapter is off, not sick.

The companion commands fill in what ipconfig leaves out. hostname prints the computer name (useful before a remote command). systeminfo prints the Windows edition, build and the installed memory. whoami /upn is the one-line answer to “who am I signed in as”. Two MySmartCoPilot tools help with what ipconfig cannot see: what is my IP shows the public address the office’s traffic leaves from, and the subnet calculator works out which addresses a mask such as 255.255.255.0 puts on the same subnet.

Each rung of the connectivity ladder rules out one layer

The commands above read the PC’s own state; the next few test whether that state actually works. The order matters: each step rules out one layer, so skipping ahead means skipping evidence. The figure below walks the ladder in the order a help desk follows:

The first branch happens before the ladder even begins. An APIPA address or an empty one sends you back to DHCP, and a name that still points at an old address sends you to the DNS cache:

Microsoft’s reference describes /flushdns as resetting the resolver cache; it does not touch the configured DNS servers, the hosts file or an existing TCP connection.

Once the PC has an address, ping the default gateway. A reply says the local subnet works, and the problem is somewhere further out; silence says to look at cables, Wi-Fi, the switch or the VLAN first. Pinging an address outside the office that your network lets through, after that, separates “we can route” from “we cannot resolve names”.

Names move the ladder to DNS, then to the port, then along the path:

• nslookup intranet.corp.example asks the configured server for the address of the host, and Resolve-DnsName is the PowerShell equivalent, returning objects you can filter. Both name the server that answered, so when a lookup fails the ticket already carries the DNS server to open with the next team; for a public name, the DNS lookup tool gives a second opinion from outside the office.
• Test-NetConnection intranet.corp.example -Port 443 opens a TCP connection and reports TcpTestSucceeded : True or False; the Microsoft page’s example 3 shows the full output with -InformationLevel Detailed.
• Where it fails, tracert names each router on the way and pathping measures loss on each hop over a few minutes, which catches a flaky link that a single ping misses.

Two more commands belong on this rung for a desk:

• netstat -ano lists every TCP connection and listening port on the PC with the owning process id (PID), so a “port 8080 is already in use” message leads straight to the application holding it; the Task Manager’s Details tab shows which program the PID belongs to, and the port number lookup says what a number such as 445, SMB’s own port, is used for.
• net use lists the drives mapped in the current session, and net use Z: \\fileserver\share maps one; Microsoft’s reference lists /persistent:yes for a mapping that should come back at the next sign-in.

gpresult shows which policies reached a user, and gpupdate reapplies them

A domain-joined PC inherits settings from Group PolicyA directory-based system of settings for computers and users on a Windows domain or Microsoft Entra network, where an administrator writes rules once and every PC applies them. when it starts and when a user signs in, and refreshes them in the background between those times. When a change does not seem to have taken, two commands tell you where it is:

gpupdate /force reapplies every policy setting rather than only the ones that changed, and Microsoft’s reference lists /boot and /logoff for the few settings that need a restart or a sign-out to apply.

gpresult /r is the second half of the pair. It prints the Resultant Set of Policy for the PC and the user: the computer object, the Organisational Unit, the security groups and, most useful of all, “Applied Group Policy Objects” and “The following GPOs were not applied because they were filtered out”. When a user says “the shortcut didn’t appear”, gpresult /r says whether the GPO reached them; gpresult /h report.html writes the same information as a web page the ticket can carry. /scope user and /scope computer narrow the output when it is long.

Reading the output together with a map of the organisation’s OUs is the technique: a policy applied at the OU above the user still appears here, with the OU named. Deeper directory lessons later in the track cover domain, OU and inheritance; here it is enough to know the pair of commands and that the output names every GPO that touched the sign-in.

DISM repairs the store before sfc repairs the files

When a PC starts behaving as if a system file is damaged (features refuse to open, settings pages fail to load, the sign-in page is slow), Windows ships two tools that fix it, and the order Microsoft gives in its own support article is DISM first, then System File CheckerSystem File Checker: The Windows tool sfc, which scans every protected system file against its cached original and replaces any copy it finds damaged; sfc /scannow runs the whole scan from an elevated prompt and reports the result when it finishes. (sfc). The reason is that sfc /scannow copies clean files out of the component store, so the store itself has to be clean first:

Each step has one line to look for. DISM /Online /Cleanup-Image /ScanHealth ends with “No component store corruption detected” or “The component store is repairable”. DISM /Online /Cleanup-Image /RestoreHealth ends with “The restore operation completed successfully”. sfc /scannow ends with one of four lines Microsoft’s support article names: no violations found, could not perform the requested operation, found corrupt files and successfully repaired them, or found corrupt files but was unable to fix some of them. Each line has its own next step on that same page.

Rebuilding the component store with DISMDISM: Deployment Image Servicing and Management, the Windows tool that services system images and the component store; Dism /Online /Cleanup-Image /RestoreHealth asks Windows Update for a fresh copy of the store so that sfc has clean files to copy from. is the step that takes several minutes and that needs internet, because its source is Windows Update. For a PC that cannot reach it, DISM ... /RestoreHealth /Source:<path> /LimitAccess points at a mounted Windows image instead, and the Microsoft page gives the exact form.

chkdsk is a different family. Microsoft’s page notes that it “checks the file system and file system metadata of a volume for logical and physical errors”. chkdsk C: with no switches is read-only. chkdsk C: /f fixes errors, but the volume must be locked, so Windows asks to schedule it at the next restart. /r on an HDD finds bad sectors and recovers readable data; on an SSD, the reference page says it is “faster but still requires reading every single sector”, and warns that repeated full-surface scans slightly reduce an SSD’s lifespan. On an NTFS volume chkdsk /scan runs an online scan without a lock, which fits a server that must stay up.

A destructive command runs as a list first

A handful of commands can erase thousands of files, format a drive or wipe a volume. Each is useful, and each has a way to show what it would touch before it touches anything:

The most common of the four is robocopy. Microsoft’s reference says /mir “mirrors a directory tree”, which means it both copies new or changed files and deletes files in the destination that are missing from the source. That second half is why a wrong source turns a mirror job into a bulk delete. The safe routine is to run robocopy <source> <destination> /mir /L first; /L is “list only, do not copy, timestamp or delete any files” (from the Logging options), so the printout is exactly the file list the real run would act on. Only when that list is right is the /L removed.

The other three live in Command Prompt. del with a wildcard removes files but keeps the folder; rd /s removes a folder and everything under it. Try the pattern as dir /s or Get-ChildItem -Recurse first and read the list. format D: writes a fresh file system on a drive, so the first thing to check is the drive letter against diskmgmt.msc or Get-Disk. diskpart’s clean command removes the partitions of the disk it has selected, and clean all writes zeros over the whole disk. After select disk 1, diskpart answers that disk 1 is now the selected disk, and list disk marks the selected one with an asterisk; reading that line out loud before pressing Enter has saved more than one weekend.

WMIC is gone: Get-CimInstance replaces it

For many years the quick way to read a Windows PC’s hardware was WMIC: wmic bios get serialnumber or wmic cpu get name. Microsoft’s deprecated-features page says the Windows Management Instrumentation command-line utility is removed and is no longer available as a Feature on Demand on Windows 11, version 24H2 and later. WMI itself is unaffected; only the WMIC command is gone.

The replacement is PowerShell’s Get-CimInstance, which reads from the same CIM classCIM class: A Common Information Model class, such as Win32_BIOS, Win32_Processor or Win32_LogicalDisk, that PowerShell's Get-CimInstance cmdlet reads; each class has a documented set of properties the cmdlet returns for every instance. catalogue. The class and the property name are the same words:

A few habits travel. The class name and the property name are what Microsoft’s reference lists, so a spelling you cannot remember is three clicks on the Get-CimInstance page away. Get-CimInstance -ClassName <class> | Format-List * prints every property of one object, which is quick when you need to find the right name. For reading the same values from another PC, add -ComputerName <name>, and the cmdlet uses the modern WS-Management protocol instead of DCOM.

Practise: parse a sample ipconfig output

Every connectivity ticket starts with the same block of adapter lines. Write the parser that turns it into records a help desk can scan, and the three flags that catch the common cases: an APIPA address, an adapter with an IPv4 but no gateway, and DHCP switched off with no address. The sample tests include every one of those cases plus an adapter with two DNS servers.

def parse_ipconfig(text):
    """Return adapter records and flags for one `ipconfig /all` output."""
    return {"adapters": [], "flags": []}

from parse_ipconfig import parse_ipconfig


APIPA_SAMPLE = r"""Windows IP Configuration

   Host Name . . . . . . . . . . . . : LAB-PC-07

Wireless LAN adapter Wi-Fi:

   Description . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201
   Physical Address. . . . . . . . . : 00-00-5E-00-53-11
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration IPv4 Address. . : 169.254.112.68(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . :
"""


ETHERNET_SAMPLE = r"""Ethernet adapter Ethernet:

   Description . . . . . . . . . . . : Intel(R) Ethernet Connection
   Physical Address. . . . . . . . . : 00-00-5E-00-53-10
   DHCP Enabled. . . . . . . . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.0.2.47(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.0.2.1
   DNS Servers . . . . . . . . . . . : 192.0.2.53
                                       198.51.100.53
"""


DISCONNECTED_SAMPLE = r"""Ethernet adapter Ethernet 2:

   Media State . . . . . . . . . . . : Media disconnected
   Description . . . . . . . . . . . : Realtek USB GbE Adapter
   DHCP Enabled. . . . . . . . . . . : No
"""


STATIC_NO_GATEWAY = r"""Ethernet adapter Ethernet 3:

   Description . . . . . . . . . . . : Static-only adapter
   DHCP Enabled. . . . . . . . . . . : No
   IPv4 Address. . . . . . . . . . . : 203.0.113.9
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
"""


def test_apipa_flags_an_adapter_without_dhcp():
    """169.254.x.x and an empty gateway each raise a flag"""
    result = parse_ipconfig(APIPA_SAMPLE)
    assert len(result["adapters"]) == 1
    adapter = result["adapters"][0]
    assert adapter["name"] == "Wi-Fi"
    assert adapter["ipv4"] == "169.254.112.68"
    assert adapter["gateway"] == ""
    assert ("Wi-Fi", "APIPA") in result["flags"]
    assert ("Wi-Fi", "no default gateway") in result["flags"]


def test_ethernet_captures_two_dns_servers():
    """both DNS servers come back, in order"""
    result = parse_ipconfig(ETHERNET_SAMPLE)
    adapter = result["adapters"][0]
    assert adapter["name"] == "Ethernet"
    assert adapter["ipv4"] == "192.0.2.47"
    assert adapter["mask"] == "255.255.255.0"
    assert adapter["gateway"] == "192.0.2.1"
    assert adapter["dhcp"] is True
    assert adapter["dns"] == ["192.0.2.53", "198.51.100.53"]
    assert result["flags"] == []


def test_disconnected_adapter_has_no_flag():
    """a disconnected adapter is off, not sick"""
    result = parse_ipconfig(DISCONNECTED_SAMPLE)
    adapter = result["adapters"][0]
    assert adapter["disconnected"] is True
    assert result["flags"] == []


def test_static_adapter_with_missing_gateway():
    """an adapter with a static IPv4 and no gateway still raises the gateway flag"""
    result = parse_ipconfig(STATIC_NO_GATEWAY)
    adapter = result["adapters"][0]
    assert adapter["name"] == "Ethernet 3"
    assert adapter["ipv4"] == "203.0.113.9"
    assert adapter["gateway"] == ""
    assert adapter["dhcp"] is False
    assert result["flags"] == [("Ethernet 3", "no default gateway")], "a static address is not 'DHCP off and no address'"


def test_dhcp_off_with_no_address_flags_the_adapter():
    """DHCP off and no IPv4 raises the DHCP flag"""
    text = r"""Ethernet adapter Ethernet 4:

   Description . . . . . . . . . . . : Unused onboard adapter
   DHCP Enabled. . . . . . . . . . . : No
   Default Gateway . . . . . . . . . :
"""
    result = parse_ipconfig(text)
    assert ("Ethernet 4", "DHCP off and no address") in result["flags"]


def test_three_adapters_are_returned_in_order():
    """every adapter heading starts a new record"""
    combined = APIPA_SAMPLE + "\n" + ETHERNET_SAMPLE + "\n" + DISCONNECTED_SAMPLE
    result = parse_ipconfig(combined)
    names = [adapter["name"] for adapter in result["adapters"]]
    assert names == ["Wi-Fi", "Ethernet", "Ethernet 2"]
    reasons = [reason for _, reason in result["flags"]]
    assert "APIPA" in reasons
    assert "no default gateway" in reasons

Interview questions

Warm-up (fresher): what does ipconfig /flushdns actually change, and what does it leave alone?

It clears the DNS client resolver cache on the PC, so the next name lookup goes back to the configured DNS servers rather than reusing a cached answer. It changes nothing about the servers themselves, the hosts file, any adapter’s IP configuration or an open TCP connection, and it does not release or renew a DHCP lease; those are ipconfig /release and ipconfig /renew. The usual case is a service that moved to a new IP: once the cache is empty, the next nslookup or Resolve-DnsName returns the fresh answer. If a lookup still fails after a flush, the DNS server itself is the next thing to check, not the cache.

Two harder cases follow: a PC where sfc reports files it could not repair and that must stay online, and a mapped drive that works for one user and fails for the next on the same PC. Pick the first command you would run on each, then line it up against the opening step on its page:

Key takeaways

• Command Prompt and PowerShell share the same disk and most of a desk’s commands have an equivalent in each; /? after a classic command and Get-Help for a cmdlet are the two ways to look up switches.
• The connectivity ladder is one order: read the PC’s state with ipconfig /all, ping the gateway, resolve a name with nslookup or Resolve-DnsName, test the port with Test-NetConnection, and follow the path with tracert or pathping.
• gpresult /r is the fastest answer to “did my policy change reach this user”, and gpupdate /force reapplies every setting rather than only the changed ones.
• The repair order is DISM first to refresh the component store, then sfc /scannow, with a second sfc after a restart to confirm the result; chkdsk C: /f runs at the next restart because the system volume cannot be locked while Windows is on it.
• Every destructive command runs its listing form first: robocopy /L, del previewed with dir, diskpart’s “selected” line read out loud; the list is exactly what the real run will touch.
• WMIC is removed from Windows 11, version 24H2 and later; Get-CimInstance reads the same classes, so (Get-CimInstance Win32_BIOS).SerialNumber replaces wmic bios get serialnumber.