Cheatsheets

dir                :: List files and directories
dir /a:h           :: List hidden files
dir /s             :: List recursively (include subdirectories)
dir /b             :: Bare format (names only)
dir /o:n           :: Sort by name
dir /os            :: Sort by size
dir /ot            :: Sort by date/time
cd \path\to\dir    :: Change directory
cd ..              :: Go up one level
cd /d D:           :: Change drive and directory
d:                 :: Switch to D: drive
tree               :: Graphically display directory structure
tree /f            :: Include files in tree view

copy file.txt new.txt      :: Copy file
copy *.txt C:\backup\      :: Copy all .txt files to backup
xcopy /s /e source dest    :: Copy directory tree (files + empty dirs)
xcopy /s /e /i source dest :: Copy tree, auto-create destination
robocopy source dest /mir  :: Robust File Copy (mirror entire tree)
robocopy source dest /e /copy:DAT :: Copy with all attributes
robocopy source dest /mov  :: Copy then delete originals (move)
move file.txt folder\      :: Move file
move old.txt new.txt       :: Rename file (same directory)
ren old.txt new.txt        :: Rename file (alias for move)
del file.txt               :: Delete file
del /q *                   :: Delete all files quietly
del /s *.tmp               :: Delete .tmp files recursively
type file.txt              :: Display file content
type file.txt | more       :: Display content page by page
more file.txt              :: Same but with more pager
attrib +h file.txt         :: Make file hidden
attrib -h file.txt         :: Un-hide file
attrib +r file.txt         :: Make read-only
attrib +s +h file.txt      :: Make system + hidden
fc file1.txt file2.txt     :: Compare two files (shows differences)
comp file1.txt file2.txt   :: Compare files byte-by-byte
sort file.txt              :: Sort file content alphabetically
sort /r file.txt           :: Sort in reverse order
find "search" file.txt     :: Find text in file
find /i "search" file.txt  :: Case-insensitive search
findstr "error" *.log      :: Find regex pattern in files (more powerful)
findstr /i /r "err[0-9]" *.log :: Case-insensitive regex search
where cmd                  :: Locate executable in PATH
where /r C:\Windows *.dll  :: Search recursively for files

mkdir foldername           :: Make directory (md also works)
mkdir a\b\c                :: Create nested directories in one command
rmdir foldername           :: Remove directory (must be empty)
rmdir /s /q foldername     :: Remove directory tree quietly (no prompt)
del /f /s /q foldername    :: Delete all files in a tree first
ren source_folder dest     :: Rename a directory

ipconfig                       :: Show all network adapter info
ipconfig /all                  :: Detailed info (MAC, DHCP, DNS)
ipconfig /release              :: Release DHCP lease
ipconfig /renew                :: Renew DHCP lease
ipconfig /flushdns             :: Clear DNS resolver cache
ipconfig /displaydns           :: Show DNS resolver cache entries
ipconfig /registerdns          :: Refresh DHCP DNS registration

ping 8.8.8.8                   :: Ping IP (tests basic connectivity)
ping -n 10 8.8.8.8             :: Send 10 pings
ping -t 8.8.8.8                :: Continuous ping (Ctrl+C to stop)
ping -l 1500 8.8.8.8           :: Ping with custom packet size
ping -a 192.168.1.1            :: Resolve hostname from IP
ping -4 google.com             :: Force IPv4
ping -6 google.com             :: Force IPv6

nslookup google.com            :: Query DNS for IP
nslookup -type=mx example.com  :: Query MX records
nslookup -type=ns example.com  :: Query nameservers
nslookup -type=any example.com :: Query all record types
nslookup                       :: Interactive mode (then set type=any)

tracert 8.8.8.8               :: Trace route to destination (ICMP)
tracert -d 8.8.8.8            :: Trace without DNS lookups (faster)
tracert -h 15 8.8.8.8         :: Set max hops to 15
pathping 8.8.8.8              :: Combined trace + latency (takes ~60s)
pathping -n 8.8.8.8           :: Without DNS resolution
route print                   :: Show routing table
route add 10.0.0.0 mask 255.0.0.0 192.168.1.1 :: Add static route
route delete 10.0.0.0         :: Delete a route

netstat                       :: Show active connections
netstat -a                    :: All connections + listening ports
netstat -b                    :: Show executable per connection (admin)
netstat -n                    :: Show IPs/ports numerically
netstat -o                    :: Show owning process PID
netstat -an | find "ESTABLISHED" :: Filter established connections
netstat -an | find ":443"     :: Filter connections on port 443
netstat -r                    :: Same as route print
netstat -s                    :: Per-protocol statistics
netstat -e                    :: Ethernet statistics

arp -a                        :: Show ARP cache table
arp -a -N 192.168.1.1         :: Show ARP for specific interface
arp -d                        :: Clear ARP cache
arp -s 192.168.1.100 00-11-22-33-44-55 :: Add static ARP entry

systeminfo                    :: Complete system summary
systeminfo | find "Boot Time" :: Find specific info
systeminfo /s COMPUTERNAME    :: Remote system info (admin req)
 
ver                           :: Show Windows version
hostname                      :: Show computer name
whoami                        :: Show current user
whoami /user                  :: Show user SID
whoami /groups                :: Show group memberships
 
date /t                       :: Show current date only
time /t                       :: Show current time only
date                          :: Show/Set date (prompts)
time                          :: Show/Set time (prompts)

tasklist                      :: List all running processes
tasklist /v                   :: Verbose output with details
tasklist /svc                 :: Show services inside each process
tasklist /fi "status eq running" :: Filter: running processes
tasklist /fi "pid gt 1000"    :: Filter: PID > 1000
tasklist /fi "imagename eq notepad.exe" :: Filter by name
tasklist /s SERVER01 /u DOMAIN\user :: Remote process list
 
taskkill /pid 1234            :: Kill process by PID
taskkill /im notepad.exe      :: Kill by image name
taskkill /f /im notepad.exe   :: Force kill
taskkill /f /fi "memusage gt 50000" :: Kill by memory threshold
taskkill /t /pid 1234         :: Kill process and its child processes

schtasks                      :: List scheduled tasks
schtasks /query               :: Show all tasks
schtasks /query /fo LIST /v   :: Verbose list format
schtasks /create /tn "Name" /tr "notepad.exe" /sc daily /st 09:00
    :: Create daily task at 9 AM
schtasks /create /tn "Name" /tr "C:\script.bat" /sc onlogon
    :: Task runs at user logon
schtasks /create /tn "Name" /tr "cmd.exe" /sc weekly /d mon /st 12:00
    :: Weekly task on Monday at noon
schtasks /change /tn "Name" /disable   :: Disable a task
schtasks /change /tn "Name" /enable    :: Enable a task
schtasks /run /tn "Name"               :: Run a task immediately
schtasks /end /tn "Name"               :: Stop a running task
schtasks /delete /tn "Name" /f         :: Delete a task (no prompt)

chkdsk                        :: Check current drive for errors
chkdsk C:                     :: Check C: drive (read-only)
chkdsk C: /f                  :: Fix errors on C: (may need reboot)
chkdsk C: /r                  :: Locate bad sectors + recover data
chkdsk C: /f /r               :: Full repair with bad sector recovery
chkdsk /?                     :: Show all chkdsk options
 
sfc /scannow                  :: Scan and repair protected system files
sfc /verifyonly               :: Scan but don't repair
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows :: Offline scan
 
dism /online /cleanup-image /checkhealth            :: Quick health check
dism /online /cleanup-image /scanhealth             :: Scan for corruption
dism /online /cleanup-image /restorehealth          :: Repair system image
dism /online /cleanup-image /restorehealth /source:C:\RepairSource\install.wim
    :: Repair from install media
dism /online /enable-feature /featurename:NetFx3 /all /source:D:\sources\sxs
    :: Enable .NET Framework 3.5 from install media
 
diskpart                      :: Start disk partition tool (interactive)
:: Inside diskpart:
::   list disk                :: Show physical disks
::   select disk 0            :: Select disk 0
::   list partition           :: Show partitions
::   select partition 1       :: Select partition
::   detail disk              :: Show disk details
::   clean                    :: Wipe disk (DANGER!)
::   create partition primary :: Create new partition
::   format fs=ntfs quick     :: Quick format as NTFS
::   assign letter=D          :: Assign drive letter
::   active                   :: Mark partition as active
::   exit                     :: Quit diskpart
 
diskpart /s script.txt        :: Run diskpart commands from a script

powercfg /list                :: List all power schemes
powercfg /query               :: Show current power scheme details
powercfg /energy              :: Generate energy efficiency report (60s)
powercfg /batteryreport       :: Generate battery health report (laptops)
powercfg /sleepstudy          :: Generate sleep study report
powercfg /hibernate on        :: Enable hibernation
powercfg /hibernate off       :: Disable hibernation
powercfg /change monitor-timeout-ac 15      :: Turn off monitor after 15 mins
powercfg /change standby-timeout-ac 30      :: Sleep after 30 mins (AC)
powercfg /change standby-timeout-dc 10      :: Sleep after 10 mins (battery)
 
shutdown /s /t 0              :: Shutdown immediately
shutdown /s /t 60 /c "Scheduled maintenance" :: Shutdown in 60s with message
shutdown /r /t 0              :: Restart immediately
shutdown /r /t 30             :: Restart with 30s delay
shutdown /r /o                :: Restart and open advanced boot options
shutdown /l                   :: Log off
shutdown /h                   :: Hibernate
shutdown /a                   :: Abort pending shutdown
shutdown /sg                  :: Shutdown, then auto-restart next boot

reg query HKLM\Software\Microsoft\Windows\CurrentVersion
    :: Query a registry key (show subkeys)
reg query HKLM\Software\Microsoft\Windows\CurrentVersion /v ProgramFilesDir
    :: Query a specific value
reg query HKLM\Software\Microsoft\Windows\CurrentVersion /s
    :: Query recursively (show all values + subkeys)
 
reg add HKCU\Software\MyApp /v DebugMode /t REG_DWORD /d 1 /f
    :: Add a DWORD value /f=force no prompt
reg add HKCU\Control Panel\Desktop /v Wallpaper /t REG_SZ /d "C:\img.jpg" /f
    :: Add/modify a string value
reg add HKLM\Software\MyApp /v Path /t REG_EXPAND_SZ /d "%SystemRoot%\myapp" /f
    :: Add an expandable string value
 
reg delete HKCU\Software\MyApp /v DebugMode /f
    :: Delete a specific value
reg delete HKCU\Software\MyApp /f
    :: Delete entire key and all subkeys
 
reg export HKCU\Software\MyApp backup.reg
    :: Export registry key to a .reg file
reg import settings.reg
    :: Import settings from a .reg file
reg compare HKLM\Software\MyApp HKCU\Software\MyApp
    :: Compare two registry keys

set                           :: Show all environment variables
set PATH                      :: Show PATH variable
set TEMP                      :: Show TEMP variable
set MYVAR=hello               :: Set variable (session only)
set MYVAR=                    :: Clear/remove variable
set /a result=5+3             :: Set variable to arithmetic result
set /p name=Enter your name:  :: Prompt user for input
 
:: Common variables:
::   %USERPROFILE%    - C:\Users\Username
::   %SYSTEMROOT%     - C:\Windows
::   %TEMP% / %TMP%   - Temp folder
::   %APPDATA%        - Roaming app data
::   %LOCALAPPDATA%   - Local app data
::   %PATH%           - Executable search paths
::   %COMPUTERNAME%   - Machine name
::   %USERNAME%       - Current user
::   %DATE%           - Current date
::   %TIME%           - Current time
::   %RANDOM%         - Random number 0-32767
 
setx MYVAR "persistent value"                     :: Set user env variable
setx /M MYVAR "machine wide"                      :: Set system-wide (admin)
setx PATH "%PATH%;C:\tools"                       :: Append to PATH (user)
setx /M PATH "%PATH%;C:\tools"                    :: Append to system PATH
 
:: Note: setx affects NEW cmd windows, not current one.
:: Expansion: %USERNAME% at parse time, !USERNAME! at runtime (delayed).

@echo off                      :: Hide commands from output
echo Hello World               :: Print text
echo.                          :: Print blank line
 
:: Variables
set name=John
echo Hello, %name%
 
:: User input
set /p input=Enter something:
echo You entered: %input%
 
:: Arithmetic
set /a result = 10 + 5
echo Result: %result%
 
:: If / Else
if exist "C:\file.txt" (
    echo File exists
) else (
    echo File not found
)
 
if "%var%"=="hello" (
    echo It's hello
)
 
if %errorlevel% equ 0 (
    echo Success
)
 
:: Loops
for %%f in (*.txt) do echo %%f
for /l %%i in (1,1,10) do echo Iteration %%i
for /f "tokens=*" %%a in (file.txt) do echo %%a
for /f "tokens=1,2 delims=," %%a in (data.csv) do echo %%a-%%b
 
:: Goto and labels
:start
echo Looping
goto start
 
:: Functions (call subroutines)
call :myfunc arg1 arg2
exit /b
 
:myfunc
echo First param: %1
echo Second param: %2
exit /b
 
:: Errorlevel checking
command.exe
if %errorlevel% neq 0 (
    echo Command failed with code %errorlevel%
    exit /b %errorlevel%
)
 
:: Substrings
set str=HelloWorld
echo %str:~0,5%      :: Hello
echo %str:~5%        :: World
echo %str:~-5%       :: World
 
:: String replacement
set str=Hello World
echo %str:World=Everyone%   :: Hello Everyone

color 0a                    :: Black background, green text
color 1f                    :: Blue background, light gray text
    :: Colors: 0=black,1=blue,2=green,3=cyan,4=red,5=magenta,6=yellow,7=white
    ::           8=gray,9=ltblue,a=ltgreen,b=ltcyan,c=ltred,d=ltmagenta,e=ltyellow,f=brightwhite
color                        :: Reset to default colors
 
title My Script              :: Change window title
 
mode con:cols=80 lines=40   :: Set console window size
mode con:cols=120 lines=50  :: Wide console
mode 80,40                  :: Same (cols,rows)
 
cls                          :: Clear the screen
 
prompt $P$G                  :: Default prompt (C:\>)
prompt $P$_$+$G              :: Multi-line prompt
prompt [$T] $P$G             :: Show time in prompt
    :: $P=path $G=> $T=time $D=date $_=newline $+=admin status

assoc                        :: Show all file extension associations
assoc .txt                   :: Show what .txt files map to (.txt=txtfile)
assoc .pl=txtfile            :: Associate .pl with txtfile
assoc .pl=PerlScript         :: Associate .pl with PerlScript
 
ftype                        :: Show all registered file types
ftype txtfile                :: Show command for txtfile
ftype txtfile=C:\Windows\notepad.exe %1 :: Set command for .txt files
ftype PerlScript=C:\Perl\bin\perl.exe %1 %* :: Set command for .pl

timeout /t 5                 :: Wait 5 seconds (press any key to skip)
timeout /t 10 /nobreak       :: Wait 10 seconds, ignore key presses
timeout /t -1                :: Wait indefinitely until a key is pressed
 
choice /c YNC /m "Continue?" :: Prompt with choices Y, N, C
choice /c ABC /n             :: Prompt with A, B, C (/n hides choices)
:: %errorlevel% = 1 for A, 2 for B, 3 for C, etc.
 
choice /c YN /t 5 /d N /m "Save changes?" :: Timeout 5s, default N