Embedded Files
WINDOWS COMMANDLINE PART 1
The Command Line’s Power:
Remains a powerful tool for administrators and users
GUI is convenient but limited
Some tasks aren’t accessible through the GUI
Relying on the GUI can be inefficient and error-prone
Automation and Efficiency:
Enables task automation
Saves time on repetitive work
Reduces the chance of human error
Allows quick execution of multiple tasks without manual GUI steps
Windows PowerShell vs Command Line:
PowerShell is the primary and actively developed shell in modern Windows
Command Prompt is still included and supported for compatibility
Recent Windows versions continue to enhance PowerShell (and introduce cross-platform PowerShell Core)
The book’s discussion can be mapped to how these tools coexist and evolve in current Windows versions
Why the Command Line is Better:
GUI search is often limited or inefficient for specific files and tasks
Searching for executables is especially weak in the GUI
Command-line tools provide faster, more precise searches
Utilities like FindStr enable high-speed searching the GUI can’t match
Detailed Information and Real-World Use:
This guide goes beyond basic command usage with in-depth explanations, tips, and real-world scenarios
Makes commands more practical and useful, not just theoretical
Suitable for both beginners and experienced users
Includes a beginner-friendly Chapter 1 for those new to the command line
Real World Scenarios:
Commands and utilities are supported by real-world examples
Explains how and why to use each tool
Highlights common pitfalls and mistakes to avoid
Scripts and Batch Files:
The author provides scripts and batch files based on personal experience, which readers can use or adapt for their needs. These tools are presented as real-world, tested solutions.
THE BOOK AND WHAT YOU’LL LEARN
Broad Appeal (Chapters 1-5):
The initial chapters are designed for anyone who uses Windows, regardless of their technical expertise.
These chapters will introduce powerful command-line tools that can simplify everyday tasks.
Basic Windows Knowledge Assumed:
Early chapters are intended for all readers
Assumes basic Windows knowledge (file navigation, keyboard/mouse use)
Does not cover Windows fundamentals
Jumps straight into command-line usage
Developer and Administrator Focus (Chapters 6-17):
Covers advanced command-line topics
Includes tasks not possible through the GUI
Explains accessing functions in DLL files
Focuses on task automation
Introduces useful third-party tools
Explores .NET Framework features (e.g., compiling JScript)
Looking Ahead to Vista and PowerShell (Chapters 18–19):
Explores the command-line experience in Windows Vista
Introduces Windows PowerShell as a major advancement
Highlights PowerShell’s power, efficiency, and improved security
Notes similarities to UNIX shells
Mentions that PowerShell can be installed on older Windows versions
STANDARD WINDOWS UTILITIES
🔧 Standard Windows Utilities — Chapter Breakdown
Ch. 1: Using the Command Line Effectively
Ch. 2: Completing Data-Specific Tasks
Ch. 3: Discovering the System Status
Ch. 4: Locating Files & Other Resources
Ch. 5: Securing & Monitoring a System
Ch. 6: Developer & Low-Level Utilities
📘 Chapter 1: Using the Command Line Effectively
⛈ Why It Matters
Command line = powerful tool; GUI = convenient but limited
CLI enables faster work, automation, and fewer mistakes
Many critical system features are accessible only via CLI (including PowerShell)
Modern Windows CLI is more scriptable, robust, and user-friendly than older versions
"It’s not outdated—it’s underground"
🗨️ Why People Dropped It
GUI made computers more approachable, but didn’t replace all tasks
CLI may seem harder (syntax, memorization), but scripting and tab completion make it easier today
Many tasks remain faster, more precise, or only possible via CLI
🔄 Evolution of the Command Line
DOS era: Full command-line environment
Windows: GUI became dominant, but CLI (Command Prompt & PowerShell) remained supported
Vista onward: Introduced new CLI enhancements and tools; PowerShell emerged as the primary advanced shell
Book covers ~280 utilities (standard + modern Windows/Powershell-specific)
💡 What You Can Do with It
Automate tasks using batch files or PowerShell scripts (no need to memorize commands every time)
Run commands in the background, on schedule, or without user interaction
Replace third-party tools with native utilities (e.g., FindStr, Dir, Get-ChildItem in PowerShell)
🛠️ Tools & Concepts Introduced in Chapter 1
Organizing commands by purpose rather than alphabetically
Internal vs External commands: Internal = built into cmd.exe (e.g., dir, cd); External = separate executables
Customizing the command window (font, size, colors, scrollback, etc.)
Updating utilities via official Microsoft sources or PowerShell modules
Modern differences in commands/parameters across Windows versions, including PowerShell equivalents
📌 Takeaways
CLI provides efficiency, power, and control
Scripts and batch files save time and reduce repetition
Modern Windows includes a rich set of built-in tools; the book helps you discover and leverage them
📌 Understanding Why the Command Line Is So Important - A Little History
Windows was born to:
Allow multitasking (DOS was one-app-at-a-time).
Be more “user-friendly” (no need to memorize commands).
GUI succeeded in making interactive apps easier (word processors, dev tools).
But many noninteractive/background tasks are still better handled with CLI.
🛠️ When GUI Just Ain’t It
Example: Backups.
Should run in background.
Need speed, accuracy, and repeatability.
GUI = not ideal (you’re using files, it slows down, and not easily automated).
CLI = perfect (no need for user input, can run scheduled).
CLI > GUI for automation.
🔍 Real Talk: Search is Broken in Explorer
GUI search is slow, inaccurate, and doesn’t index everything (even on Vista).
Want to search inside binaries or random file types? GUI fails.
CLI tool like FindStr crushes it.
Searches inside any file, including executables.
Fast, direct, and accurate.
🕵️♂️ Security: What’s Actually Running?
GUI’s Task Manager:
Limited view (SvcHost entries are vague).
Even Window’s “Services” tab helps a little.
CLI’s TaskList:
Shows exact services running inside each SvcHost.
Reveals PID (Process ID) so you can trace what's really happening.
You can’t defend your system if you don’t know what it’s doing. CLI tells the truth, GUI hides it.
CLI: Your X-Ray Goggles for Windows
🌐 Network & Web Intelligence
DNS resolution: Use CLI to find exact IP addresses behind URLs
Example: nslookup openai.com helps identify spoofed or suspicious sources
Diagnose slow internet: Determine if issues are with Wi-Fi, ISP, or network routes
Tools: ping, tracert, pathping provide quick, accurate diagnostics before contacting support
🏠 Local + Network Resource Discovery
CLI doesn’t just talk to the web—it maps your local network too.
netstat, ipconfig, nbtstat, arp, and friends help you find rogue devices, hidden services, and weird traffic.
Forget the GUI’s “Network” tab—it only shows happy paths. CLI shows everything, including what shouldn’t be there.
💻 Deep System Visibility
The command line sees stuff the GUI pretends doesn’t exist. You want actual disk usage? Real-time CPU info? Driver status? It's all there.
CLI doesn’t assume what you’re trying to do—it just does what you tell it.
🏴☠️ Why CLI Is Essential (Even If You Don't Use It Daily)
⚠️ Reality Check
For serious system security or performance, the GUI alone isn’t enough
The CLI remains fully supported and powerful
You don’t need to use it constantly, but you should know it thoroughly—like a reliable sidearm
Modern CLI (Command Prompt + PowerShell) gives access to tools and capabilities the GUI can’t match
Command Line is NOT That Deep
😴 What People Think the CLI Is:
“You just type a bunch of cryptic stuff, hope you don’t brick your machine, then stare at white text on a black screen like a hacker in a bad movie.”
Wrong. That’s the myth.
⚠️ Reality Check
🚪 CLI Is Easy If You Know the Secret Knock
You don’t need to memorize commands like it’s the SAT. You need just one trick:
Add /? to any command to get instant help. That’s it. 🔑
tasklist /?
xcopy /?
netstat /?
shutdown /?
Almost every built-in Windows CLI tool responds to that magic switch and dumps a cheat sheet right in your terminal.
You’ll see all the options the command supports (scrollable if it's long).
✨ Why You Should Use Commands Directly First
✨ Why You Should Use Commands Directly First
Yeah, scripting and batch files are cool...
But before you automate anything, you’ve gotta understand:
What each command does
What input it needs
What output it gives
Once you get a few commands, stringing them together into automation is child’s play.
Knowing how to use command /? to read help puts you ahead of most Windows users
Next step: organize commands by purpose (file operations, networking, diagnostics, etc.)
This approach helps you quickly find the right tool without guessing
Builds a clear mental map of Windows CLI capabilities
COMMANDLINE SWITCHES AND PIPES
Command-Line Switches
A switch is an option or modifier added to a command to change its behavior or output
Think of it as giving extra instructions to the main command
Switches let you customize the command’s actions or output
Syntax: Usually starts with a forward slash (/) or sometimes a dash (-), followed by a letter or word
Example: dir Command
Typing dir alone shows a basic file/folder listing
Add switches to get more specific output:
/W → "Wide" format listing
/A → Filter by file attributes
Example: /A:H shows hidden files
/O → Sort the output (e.g., /O:N sorts by name)
/S → Include subdirectories
/P → Pause output one screen at a time
Combining switches gives even more control:
Example: dir /A:H /O:N /P → Shows hidden files, sorted by name, pausing each screen
Modern tip: PowerShell uses parameters instead of switches, often with a - prefix (e.g., Get-ChildItem -Hidden -Recurse)
Pipes (|):
A pipe (|) sends the output of one command as input to another command
Think of it as connecting two commands: the first command produces data, the second command processes it
Useful for filtering, sorting, or processing data without creating temporary files
Example: List all files in a directory containing "Gemini" in their name.
Pipes can chain multiple commands for complex operations:
Example: dir | find "Gemini" | sort → Lists, filters, and sorts results in one line
Command-Line Switches
Switches modify the behavior of a single command
Typically start with / (Command Prompt) or - (PowerShell/Unix-style)
Switches / options use the forward slash / (not the dash - like in PowerShell, Linux, macOS, etc.)
/s → include subdirectories
/b → bare format (just names, no extra info)
/a-d → show files only (exclude directories)
Pipe with:
dir lists files/folders
sends that list to find
find "2025" shows only lines containing "2025" (e.g., files from 2025)
Combining both:
ipconfig /all → shows full network configuration
pipes it to findstr
findstr /i "ipv4 physical dns" → case-insensitive search for those keywords (shows IP addresses, MAC, DNS servers, etc.)
Quick comparison table
COMMAND LINE SYNTAX ⚡
Most Windows CLI commands follow this format:
Understanding Optional Parameters (Square Brackets [ ])
In command syntax, square brackets [ ] mean that the enclosed parameter is optional, you can include it or omit it.
Example:
Commands can be run with or without optional parameters
Square brackets [ ] in our image above here, indicate optional parts
Do not type the brackets themselves
Example with tasklist:
/S system → optional
/U username → optional, only if /S is used
/P password → optional, only if /U is used
Brackets are documentation shorthand, not literal characters to type
✅ Correct Ways to Run It:
You can do this with Virtual Machines which is a simpler way to explore.
Let’s do it, I have some VMs ready.
[ ] indicates an optional switch (include or exclude as needed)
Do not type [ ] in the actual command
Order matters:
/S must come before /U
/U must come before /P
If /P is used without a password, you will be prompted
Windows Command Prompt prefers / over - like Linux
PowerShell often accepts both / and -
PARAMETERS
Parameters are values given to a command without using / or - like switches
They tell the command what to act upon
Some commands accept drive letters (e.g., D:) as parameters to specify the target storage location
Here, D: is the parameter telling the cd command where you want to go.
If you want to see the files and folders at the root of your D: drive, you can use:
✅ Good Starter Commands to Try `/?” On
Back to parameters (Values we pass to the actual commands).
1. Path Parameters
No / is used—just the raw path.
2. Filename/Extension Parameter
*.txt and report.doc are parameters (filtering files).
3. Drive Letter Parameter
D:\ is a parameter (the drive to scan).
Key Differences Between Parameters and Switches
🔥 Parameters
What they are: The where or what the command is working on.
Purpose: They give the command the actual value or target it should operate on.
Think of them as: The destination you're pointing to.
Example:
“Show me what’s inside the Downloads folder.”
Parameter = destination.
🔥 Switches
What they are: The how the command should behave.
Purpose: They modify or enhance what the command does.
Think of them as: The tools you bring with you to the destination.
Example:
Include subfolders when listing files.
🛠️ Switch = tools you bring with you.
✅ Put Together:
“List everything in Downloads, including all its subfolders.”
WHY USE BATCH FILES? 📂
Batch files are still useful for automating repetitive tasks
They save you from memorizing every command and switch
Act as a personal memory vault for complex or frequently used command sequences
Write commands once in a .bat file, then run it anytime via double-click or the command line
Ideal for quick automation without writing full scripts or programs
✍️ What Is a Batch File, technically?
A batch file is just a plain text file with the extension .bat or .cmd.
It contains a list of command line commands that execute in order.
You can open and edit them in any text editor (e.g., Notepad, Notepad++).
📌 Real-World Example
Let’s say you have to check the running processes on a remote computer every morning.
Typing this out every time:
But you can write a batch script:
Now every time you run that file, it:
Runs the command.
Prompts for the password.
Pauses so you can read the output.
Boom. 2 seconds of work.
What Makes Batch Files Special?
No need for fancy compilers or runtimes. They run directly through cmd.exe.
Flexible. You can add logic like IF, GOTO, and FOR to make them dynamic.
Portable. You can carry them on a flash drive and run them on any Windows machine.
⚠️ Gotchas to Keep in Mind
Powerful but not secure: anyone can open a batch file and see stored commands or passwords
Use BitLocker or other encryption if you’re storing sensitive info in batch files
Limited error handling: failures mid-execution may not provide clear feedback
Not ideal for complex tasks: for long-term scripting or interactive tasks, PowerShell or Python is better
🧩 Coming Soon: Chapter 7 – Deep Dive into Batch Files
That chapter will show you:
How to use variables in batch files.
Conditional logic (yes, IF statements).
Looping over files or input.
Making them interactive (e.g., user input).
But we ain’t there yet.
This section plants the seeds.
Start thinking about commands, repeat, repeat, then start writing batch files.
🖥 Writing Scripts — What’s the Difference?
Scripts are like batch files' smarter older siblings.
They're still not real applications, but they can:
Handle more logic (loops, conditionals, variables)
Access Windows APIs or features directly (e.g., WMI, Active Directory)
Work with objects, not just raw text or command output
Be reused and maintained more easily
Batch files? Great for quick automation.
Scripts? Great when you want the OS to actually help you do smarter stuff.
What's a Script? 💡
A script is a file written in a scripting language that gets run by a script interpreter. Windows ships with interpreters for:
VBScript (Visual Basic Scripting Edition): .vbs
JScript (Microsoft’s version of JavaScript): .js
PowerShell (The king now): .ps1
Each of these lets you do more than batch files ever could. Think:
Reading from files.
Creating GUIs.
Interacting with Windows services.
Querying network info, system health, etc.
📦 What You Get from Scripting (vs Batch)
⚙️ Script Interpreter
Unlike batch files, scripts need an interpreter:
.vbs → Run with wscript.exe or cscript.exe
.ps1 → Run with powershell.exe or pwsh (PowerShell Core)
.js → Also cscript.exe (yep, Microsoft’s JScript engine)
Example (PowerShell script):
Get a list of all the running processes, and then filter that list to show only the processes where the CPU usage is greater than 100.
Handles: Number of references the process has to system resources (files, registry keys, etc.); high numbers may indicate heavy usage or a resource leak
NPM(K) – Non-Paged Memory (KB): Memory allocated that must stay in RAM and cannot be paged to disk
PM(K) – Paged Memory (KB): Memory allocated that can be written to disk if RAM is needed
WS(K) – Working Set (KB): Physical RAM currently used by the process; subset of paged and non-paged memory actively in use
CPU(s): Total CPU time (in seconds) the process has used since starting
Id (PID): Unique Process Identifier assigned by the OS to manage the process
SI – Session ID: Indicates which session the process is running in (e.g., session 0 = system services, others = user accounts)
ProcessName: Name of the executable that started the process (e.g., chrome.exe, explorer.exe, AvastSvc.exe)
🤖 Why Scripts Matter
Need to query Active Directory for disabled accounts? Script it.
Want to clean up old temp files across network shares? Script it.
Automate software installs, audits, backups, or reports? Script it.
You get the idea: when batch files just ain’t cutting it, scripts are the next logical step.
Sample VBScript:
Sample Jscript – similar syntax to Js:
Sample powershell script:
Command Line
These images show us something. This means:
The term “command line” is broader than just cmd.exe
Includes traditional batch files (.bat), VBScript, JScript, and PowerShell
Encompasses any text-based interface where you type commands or scripts to perform tasks
Covers automation, scripting, and direct system control beyond the GUI
It refers to text-based interfaces for interacting with the OS, as opposed to GUI tools
cmd.exe (Command Prompt):
Traditional Windows CLI
Runs built-in commands and batch files (.bat, .cmd)
PowerShell:
Advanced shell and scripting language
Works with objects instead of just text
Uses cmdlets and supports sophisticated scripts
JScript & VBScript:
Microsoft scripting languages
Run from CLI using jscript.exe, cscript.exe, or wscript.exe
Part of Windows’ broader “command-line ecosystem”
JScript vs JavaScript
ECMAScript → the official blueprint or standard for the scripting languages. This means If I want to create a language like JS or Jscript, I will have to use the official EcmaScript documentation called ECMA-262.
JavaScript → the most common implementation of that standard (originally by Netscape)
JScript → Microsoft’s implementation of the same standard
Differences may appear in:
Extra features Microsoft added to JScript
Slight compatibility variations
Browser usage: JavaScript dominates; JScript was mostly for IE and server-side ASP
COMMAND-LINE UTILITIES BY PURPOSE
COMMAND-LINE UTILITIES BY PURPOSE
1. Windows CLI: Data-Specific Commands
Designed for direct manipulation of data and the file system
Handle tasks such as:
File creation, deletion, and modification
Directory management
Essential for automation of repetitive tasks
Help maintain consistent system configurations
Examples:
dir: Lists files and directories.
copy, xcopy: Copies files and directories.
del, erase: Deletes files.
mkdir, rmdir: Creates and removes directories.
sort: Sorts file contents.
type: Displays file contents.
print: Prints files.
Use Cases:
Automating user setup: Creating batch scripts to configure user environments quickly and consistently.
Archiving data: Using batch files to automate file archiving processes.
Bulk file operations: Performing mass file manipulations efficiently.
Creating automated backups.
2. System Status Commands:
Purpose:
These commands provide information about the system's hardware and software configuration.
They are crucial for diagnosing problems, monitoring system performance, and managing hardware.
They allow for remote system management, reducing the need for physical access.
Examples:
systeminfo: Displays detailed system configuration.
tasklist: Lists running processes.
driverquery: Lists installed device drivers.
wmic: Windows Management Instrumentation Command-line, for system management.
typeperf: performance monitoring.
dxdiag: DirectX diagnostics.
Use Cases:
Troubleshooting hardware and software issues.
Monitoring system performance and resource usage.
Remote system administration and diagnostics.
Creating automated performance logs and alerts.
3. File and Resource Management Commands:
Purpose:
These commands manage files and system resources, including hardware and services.
They provide tools for manipulating file content, managing power settings, and controlling services.
They are essential for system optimization and resource allocation.
Examples:
findstr: Searches for strings within files.
powercfg: Manages power configuration settings.
net start, net stop: Manages services.
netsh: Network shell, used to configure network devices.
Use Cases:
Searching for specific data within files.
Optimizing power consumption.
Managing network services and configurations.
Automating service management.
4. Security and System Monitoring Commands:
Purpose:
These commands focus on monitoring and improving system security.
They help detect potential security threats and maintain system integrity.
They are vital for proactive security management and intrusion prevention.
Examples:
ipconfig: Displays network configuration.
netstat: Displays network connections and statistics.
auditpol: Manages security audit policies.
whoami: Displays user information.
gpresult: Displays group policy settings.
Use Cases:
Monitoring network activity for suspicious connections.
Auditing user activity and system events.
Configuring security policies and access controls.
Troubleshooting network connectivity issues.
5. Developer and Low-Level Task Commands:
Purpose:
These commands provide low-level access to system resources and are often used by developers and advanced users.
They can perform critical system operations, such as disk partitioning and DLL management.
They require caution and expertise due to their potential impact on system stability.
Examples:
diskpart: Manages disk partitions.
sfc: System File Checker, repairs system files.
regsvr32: Registers and unregisters DLLs.
shutdown: Shuts down or restarts the system.
Use Cases:
Disk partitioning and management.
System file repair and integrity checks.
DLL registration and troubleshooting.
Automated system shutdowns and restarts.
These are powerful ones for system administration and automation.
1. Active Directory (AD) Commands:
Purpose:
These commands are specifically designed for managing Active Directory environments.
They automate tasks related to user accounts, groups, organizational units (OUs), and other AD objects.
They are essential for enterprise-level system administration, ensuring consistency and efficiency.
Active Directory Components - Active Directory enables consistent, centralized network administration and resource management
Domain Controller (DC):
Central component of Active Directory
Stores the directory database
Provides authentication and authorization services within the domain
Windows Server:
Operating system hosting Active Directory
Examples: Windows Server 2016, 2019, 2022 (latest supported versions)
Clients and Member Servers:
Client PCs (e.g., Windows 10, Windows 11) and member servers connect to the DC
AD manages resources, users, and permissions across the network domain
Illustrates core AD functions: centralized management and access control
Key Concepts:
Automation: AD commands are often used within scripts to streamline repetitive tasks.
Consistency: Scripts ensure uniform configuration across the AD environment.
Reliability: Automated tasks reduce human error and improve reliability.
Use Cases:
User account creation and management.
Group policy administration.
OU management.
Automated reporting and auditing.
Automating user onboarding, offboarding, and group management.
Example Scenarios:
Creating a script to automatically provision new user accounts with specific attributes and group memberships.
Using commands to generate reports on user account activity or group memberships.
Modifying group policies across many computers.
2. Services Commands:
Purpose:
Services are background applications that run without direct user interaction.
Service commands allow you to manage these services, including starting, stopping, and configuring them.
Effective service management is crucial for system performance and security.
Key Concepts:
Resource Management: Unnecessary services can consume system resources.
Security: Some services can create security vulnerabilities.
Automation: Batch scripts can automate service management tasks.
Use Cases:
Starting and stopping services as needed.
Disabling unnecessary services to improve performance.
Automating service configuration during system startup or shutdown.
Automating services for development environments.
Example Scenarios:
Creating a batch script to start development-related services when needed.
Disabling potentially vulnerable services when not in use.
Automating service restarts after system updates.
Important Considerations:
Service names can vary between Windows versions.
Incorrect service management can lead to system instability.
3. Task Scheduling Commands:
Purpose:
Task scheduling allows you to automate the execution of commands and scripts at specific times or events.
It's essential for automating routine maintenance tasks and ensuring timely execution of critical processes.
It allows for background task automation.
Key Concepts:
Automation: Scheduling tasks eliminates the need for manual intervention.
Efficiency: Tasks can be run during off-peak hours to minimize impact on system performance.
Reliability: Scheduled tasks ensure that critical processes are executed consistently.
Use Cases:
Automating backups and system maintenance.
Running scripts at scheduled intervals.
Generating reports and logs automatically.
Automating after hours scripting.
Example Scenarios:
Scheduling a daily backup script to run at midnight.
Automatically generating system performance reports on a weekly basis.
Automating log file rotation.
Automatically running virus scans.
schtasks: The primary command-line tool for managing scheduled tasks.
Summary:
Low-level commands require careful handling due to their potential impact.
Remote management is made much easier with the command line.
Active Directory commands are crucial for enterprise system administration.
Service management is essential for system performance and security.
Task scheduling automates routine processes, improving efficiency and reliability.
MICROSOFT UTILITIES UPDATES
📦 Updating Your Utilities – Microsoft Download Center
Command line tools can get outdated, but Microsoft provides updated versions on the Download Center
The Download Center is separate from Windows Update and hosts tools Microsoft doesn’t push automatically
Microsoft Download Center: hidden catalog of updated utilities and tools
🧭 Navigating the Site
Favorites at the Top: homepage highlights popular tools and current patches
Search by Technology: search by category like “Windows Server tools,” “PowerToys,” “Sysinternals” for better results
Search by Keyword: use the keyword search form for specific tools
⚔️ Pro Tip Hack: Google Advanced Search
Use Google if Microsoft search is unreliable
“All these words” → type tool/utility name (e.g., Process Explorer)
“Site or domain” → www.microsoft.com
🗂️ Explore by Category
Useful if you don’t know the exact name or are just browsing
Categories like “Developer Tools,” “System Utilities,” or “Command Line Tools” help discover:
Windows Terminal
PowerToys
🛠️ Third-Party Utilities = Power Tools
Supercharging the Command Line
Default Windows CMD = basic, like a plastic butter knife
Advanced tools (“chainsaws”):
Sysinternals Suite: Process Explorer, Procmon, PsExec, Autoruns — essential for reverse engineering and malware analysis
PowerToys: Modern tweaks — window snapping, keyboard shortcuts, bulk renaming
7-Zip Command Line: Fast, scriptable archiving and extraction
Windows Terminal: Tabs, themes, UTF-8, WSL integration
Chocolatey / Scoop: Command-line package managers for fast tool installation
Reverse Engineering Tie-In
Using Sysinternals elevates you to advanced CMD user level
Procmon and similar tools are mandatory for observing malware behavior
Built-in commands are fine, but real power comes from these extra utilities
Treat CLI like a development environment — comfortable, efficient, responsive
Pro tip: block cursor + full-screen = distraction-free sessions
Modern Bonus – Windows Terminal Profiles
You can go next level by setting different profiles and changing your windows terminal to look any way you like in the settings json file:
QUICK EDIT MODE
Enables mouse-driven copy and paste in CMD
Makes the CMD window more usable with drag-to-select and right-click paste
Eliminates the need for old-school Ctrl+C/Ctrl+V hacks
Right-click the CMD title bar → Properties → Options tab → check QuickEdit Mode
Disable only if using legacy full-screen apps that require direct keyboard input
⚡ What QuickEdit Mode Does:
Select text with your mouse just by dragging (like you would in any normal text editor).
2. Right-click to copy the selected text.
3. Right-click again to paste it at the command prompt.
Understanding Internal Commands (CMD vs Utilities)
I. CMD.EXE = the Command Line Host
When you run cmd, you’re launching CMD.EXE, the shell that processes your commands.
It stays open, reading your input, and running instructions directly.
II. Internal Commands (Built-In to CMD.EXE)
These are baked into CMD.EXE itself.
They don’t exist as standalone .exe files.
You can’t find them on disk by running dir — they live inside the CMD process.
Examples:
dir
copy
del
cd
echo
set
if, for, goto (used in batch scripting logic)
III. Utilities (External Commands)
These DO exist as .exe files on your system.
You can find them using dir, run them directly, or even from PowerShell or a script.
Examples:
tasklist.exe
ipconfig.exe
ping.exe
telnet.exe
robocopy.exe
Located in: C:\Windows\System32\ or similar system paths.
These are referred to as utilities in the book.
Some utilities (like Telnet) create their own mini environments inside CMD.
Commands you type inside Telnet don’t work outside of it — they’re not in CMD, they’re specific to that tool.
👁️🗨️ Just like dir is internal to CMD, Telnet has its own internal commands once you’re inside it.
When you type something in CMD:
CMD.EXE checks: is this an internal command?
If yes → run it directly
If no → look for a matching .exe file (utility)
USER ACCOUNT CONTROL, RUNAS
UAC in Windows 10/11: Offers more granular control than Vista’s all-or-nothing approach
Users can choose notification levels: always notify → notify only when apps try changes (no desktop dim)
Prompts are less frequent and less disruptive for common admin tasks
Purpose: prevent apps, scripts, or malware from performing admin-level tasks silently
Works with other security features: Windows Defender Antivirus, Exploit Protection, robust permission models
Your regular Windows login password lets you sign in and run everyday apps
The Administrator account has higher privileges than a normal user account
Admin actions (installing software, changing system-wide settings) require explicit approval
Even if you’re logged in, Windows may ask for admin credentials or confirmation
This separation prevents programs or malware from making system-level changes without permission
Runas Command for Elevation
runas lets you run a command or program as another user (usually an admin)
It will prompt for the admin password
runas does NOT bypass UAC
It’s used to switch user context, not disable security
Useful for launching tools that need admin rights without logging out
Common Use Cases
Run a tool as an admin from a standard user session
Test how something behaves under a different account
Launch an elevated CMD or PowerShell window
Where UAC Fits In
UAC still applies after runas
Admin approval is required for system-level changes
You don’t need to disable UAC to use runas
That’s it. Everything else is implementation detail and policy tuning—not required to use runas.
Modern Way to Give Yourself Permissions 🔥
If you need to access or modify protected folders (like C:\ or C:\Windows, etc.):
1. Take Ownership of the folder
Run an elevated CMD or PowerShell, then:
✅ 2. Grant yourself full control
Still in the elevated terminal:
runas doesn’t bypass UAC, but it’s a good way to manually switch context if needed.
🔑 UAC Settings in Windows 10/11
Access via Control Panel → System & Security → Security and Maintenance → Change User Account Control settings; slider has 4 levels (default = level 2)
Level 1: fewer prompts for dev/testing; Level 0: fully disabled (only in VM/lab)
For finer control, use Local Security Policy (secpol.msc) to adjust:
Elevation prompt behavior
Admin Approval Mode for built-in Administrator
System folders (C:\Windows, System32) remain protected; elevated shells or takeown/icacls needed for changes
UAC is protective, not restrictive; run CMD/PowerShell as admin when needed.
🔐 icacls — Your God-Key to NTFS Permissions
icacls (introduced in XP SP2 / fully baked by Vista+) is the successor to cacls and xcacls, and it lets you:
View and modify file/folder permissions
Grant/revoke rights to users or groups
Backup/restore access control lists (ACLs)
Set inheritance rules
Take ownership
Basically, it’s your CLI way to do what the GUI “Security” tab does, but way more powerful when scripting or working fast.
📜 View Permissions:
✍️ Grant Full Control to a User:
F = Full Control, you can also use:
M = Modify
RX = Read & execute
R = Read
W = Write
🧼 Remove a User’s Permissions
🔄 Reset Permissions (very useful for fixing locked folders)
🔐 Take Ownership
Powerful stuff.
Use with caution.
One wrong move, and you’ll nuked access for everyone.
Giving Yourself Permission (2026 Version)
Windows 10/11 tightened security but gave you better tools to control it.
Here’s the real process, skipping Vista-era procedures:
Step 1: Run Everything as Admin
Whether you’re using:
File Explorer
CMD / PowerShell / Windows Terminal
👉 When editing protected system folders like C:\ or C:\Program Files etc.
Right-click → “Run as administrator.” (You can set it permanently via shortcut properties.)
Step 2: Take Ownership & Grant Yourself Access
When a folder like System32 or C:\Program Files blocks you, here’s the proper flow.
Take Ownership:
/f "C:\System32" - Specifies the file or directory (in this case, the System32 folder)
/r - Recursive, applies the operation to all files and subdirectories
/d is a parameter that specifies the default answer to be used when a confirmation prompt would otherwise be displayed.
Y means "Yes", so /d Y automatically answers "Yes" to any confirmation prompts.
This command is taking ownership of the entire C:\System32 directory and all its contents, automatically confirming any prompts that might appear during the process.
Grant Permissions:
%USERNAME% automatically inserts your current username
/T = recursive through all subfolders and files
:F = full control
⚠️ Be very careful doing this on System folders — one wrong move, and Windows might have a bad time. Use this on test VMs first.
Step 3: Re-enable Security (If You Temporarily Lowered UAC)
Pro Tip: Add Yourself to Folder Security GUI (Advanced Way)
Right-click folder → Properties
Go to Security tab → Click Advanced
Change Owner → Set to your user account
Then add your user to the list with full control.
⚠️ Don't rely on "Administrators" group alone. You must add your actual user account for changes to stick and apply recursively.
💡 Bonus: Permissions No Longer “Flow Down” Like They Used To
Modern NTFS locks don’t inherit the same way anymore, so just giving yourself rights on C:\ doesn't unlock C:\Windows or C:\System32.
Each folder may have its own ACLs that must be overridden individually.
That’s why:
...is separate from:
Small confusion on my end. So icalcls is access control list?
And it uses /T? Why not /r for recursive like takeown uses?
icacls = Integrity Control Access Control Lists
The name itself is lowkey geeky as hell:
i = Integrity (for Mandatory Integrity Control stuff)
c = Control
acls = Access Control Lists
It’s basically Microsoft showing off NTFS permissions
Handles the key things you need to manage access:
ACLs – who can do what
SIDs – unique IDs for users and groups
Inheritance – permissions passed down to files/folders
Ownership – who controls a file or folder
Restrictions – blocks actions you’re not allowed to do
Recursive flags in Windows are not all the same.
Using takeown, the /r flag makes the command recursive, meaning it will apply to the folder and all its subfolders and files.
This flag is specifically used to make yourself the owner of a file or folder and everything inside it.
When using icacls, the /T flag makes the command recursive, applying permission changes to a folder and all its subfolders and files.
This is used for modifying permissions throughout an entire folder tree.
🧪 Real-World Tip
If you’re scripting or fixing broken access:
1. Take ownership first
2. Then give yourself full permissions
If you skip ownership, icacls might just say:
⚠ Access is denied. 🙃
What’s the Deal with Zones on Network Drives? 🚨
I. Network Drive Security Zones (Modern Windows)
Windows assigns security zones to network drives, similar to Internet zones, to protect against malware
Mapped drives (e.g., \\Server\SharedFolder) may default to the “Internet” zone, causing restrictions:
Scripts are blocked
Files may refuse to run
Permissions can behave unexpectedly
Drag-and-drop may be limited
This can happen even on your own machine acting as a server
Fix / Workaround: Add the network location to Trusted Sites in Internet Options (Zone Upgrade)
Modern Windows handles this more gracefully than Vista, but some restrictions still apply for security reasons
Open Internet Options - Start > Internet Options or run:
The following appears:
Go to: Security tab → Click on Trusted Sites → Click Sites.
In the box, add your network drive’s UNC (Universal Naming Convention) path:
Or for IP-based access:
Don't put mapped drives like Z:\.
It has to be the actual network path like \\192.168.1.100\SharedFolder
Uncheck the box: "Require server verification (https:) for all sites in this zone"
Otherwise, it might block your entry. Hit Add, Close, then OK.
👨💻 Why This Works
When you open files from the network, they're subjected to Internet Explorer's security model — yes, even in 2026.
This Trusted Sites move reclassifies that location as "safe" so you:
Avoid UAC nags
Can run .bat, .exe, .ps1, .vbs off that network
Avoid the "This file came from another computer..." warning
And your scripts/policies won't fail silently
💡 Pro-Tip with GPO (Group Policy)
If you're in a domain or want to automate this on many machines, you can do it via Group Policy: User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List
Result: Sites are treated as Trusted Sites automatically.
Vista Command Line Legacy (Modern Take)
Most Vista-era command removals are irrelevant today
Modern Windows uses updated tools (choice, bcdedit)
Old DOS/16 bit commands are gone — ignore them
Batch Files Failing?
Most failures are permissions/UAC, not bad logic
Always test batch files Run as Administrator if they touch:
Registry
Program Files, Windows, System32
Services or scheduled tasks
Key Takeaways for Modern Windows
Key Takeaways for Modern Windows
CMD is still powerful and relevant
Learn both CMD and PowerShell — they complement each other
UAC still blocks scripts silently without elevation
Deprecated commands are gone for good — don’t rely on them
Windows doesn’t push CLI usage — that’s an advantage, not a flaw
Next Chapter Focus
Reverse engineering software, analyzing malicious software and the windows commandline.
Core file commands: dir, xcopy, robocopy, del, attrib
Command-line editing
Registry interaction
Backup and automation basics
✨Let’s get it moving superstar!! ✨😤😤
Page updated
Google Sites
Report abuse