Windows XP Command Line Reference

By

Roberto J. Dohnert ……Copyright © 2004

This whitepaper is not endorsed or certified by Microsoft or any of their partners. I offer no
warranty expressed or implied for any unintentional or accidental destruction of your system. You
use these commands at your own risk

You may use this text verbatim as long as the author attributions are remained intact

First Published: January 15, 2004

1
Revision History:

March 14, 2004 – Added page numbers for organization

March 20, 2004 – Added list and functions of Windows XP specific commands
starting at page 8

June 7, 2004 – Added Table of contents and per user request added a basic UNIX
to Windows Command Line comparison.

August 8, 2004 – Added a specific description of each command.

2
Table of Contents

Unix To Windows Command Comparisons……. Page 4

Console Command List…………………………..Page 5

Windows XP/Server 2003 New Commands …….Page 16

3
Common UNIX to Windows Command Comparisons

These are the common commands that are useful to new users of Windows XP and
Windows Server 2003 coming from the UNIX/Linux side of computing. This is the basic
set of instructions and should not be considered a complete list. System admins should
research the commands fo more advanced tasks.

A complete set of Command line instructions can be found on Microsofts web site

http://www.microsoft.com/technet/prodtechnol/winxppro/proddocs/ntcmds.asp

Action Unix command Windows Console command

list files ls dir

show details ls -l filename dir filename

about a
particular file

show contents of cat, more, less type, more

file

copy file cp copy

move file mv rename, ren

rename file mv rename, ren

delete file rm delete, del, erase

compare contents diff comp

of multiple files

change directories cd chdir, cd

show current pwd cd (no add. Syntax)

directory

create directory mkdir mkdir, md

delete directory rmdir rmdir, rd

4
Console Command List
While many people have grown to enjoy the luxuries of the GUI, Graphical
User Interface, many system administrators and hobbyists enjoy using the
CLI, command line interface, This has long been the attraction for UNIX and
Linux loyalists. They like going into the soul of the OS and using a much more
powerful interface. While most of the applications that people utilize has a GUI,
there are many powerful command line utilities and tools available for the
CLI. But, before you can use the CLI you must know the commands for
using it. This is a complete list of commands that are found in the XP
command line environment. In the previous chapter we looked at the basic UNIX to
Windows differences in commands, this is the more expansive list of Windows XP
commands. In the final chapter I reference new Windows XP and Server 2003 specific
commands. Please note that this listing is a reference only and it is more geared
toward the command line expert. To find out proper syntax for a specific command, type:
<command /?> or please refer to Microsoft’s Command Line page

http://www.microsoft.com/technet/prodtechnol/winxppro/proddocs/ntcmds.asp

Arp -- Displays and modifies entries in the Address Resolution Protocol (ARP) cache,
which contains one or more tables that are used to store IP addresses and their resolved
Ethernet or Token Ring physical addresses. There is a separate table for each Ethernet or
Token Ring network adapter installed on your computer. Used without parameters, arp
displays help.

Assoc -- Displays or modifies file name extension associations. Used without parameters,
assoc displays a list of all the current file name extension associations.

At -- Schedules commands and programs to run on a computer at a specified time and

date. You can use at only when the Schedule service is running. Used without
parameters, at lists scheduled commands.

Atmadm -- Monitors connections and addresses that are registered by the ATM Call
Manager on an asynchronous transfer mode (ATM) network. You can use atmadm to
display statistics for incoming and outgoing calls on ATM adapters. Used without
parameters, atmadm displays statistics for monitoring the status of active ATM
connections.

Attrib -- Displays, sets, or removes the read-only, archive, system, and hidden attributes
assigned to files or directories. Used without parameters, attrib displays attributes of all
files in the current directory.

5
B

Bootcfg -- Configures, queries, or changes Boot.ini file settings.

Break -- Windows XP does not use this command. It is accepted only for compatibility
with MS-DOS files.

Cacls -- Displays or modifies discretionary access control list (DACL) files.

Call -- Calls one batch program from another without stopping the parent batch program.
The call command accepts labels as the target of the call. Call has no effect at the
command-line when used outside of a script or batch file.

Change – Used for terminal services only, changes logon, boot properties on remote
nodes

Chcp -- Displays the number of the active console code page, or changes the console's
active console code page. Used without parameters, chcp displays the number of the
active console code page.

Chdir -- Displays the name of the current directory or changes the current folder. Used
with only a drive letter (for example, chdir C:), chdir displays the names of the current
drive and folder. Used without parameters, chdir displays the current drive and directory.

Chkdsk – Checks disks for errors, replaces Scandisk used in earlier versions of Windows

Chkntfs – Checks the integrity of the filesystem. Only works on drives configured to use
NTFS

Cipher -- Displays or alters the encryption of folders and files on NTFS volumes. Used
without parameters, cipher displays the encryption state of the current folder and any
files it contains.

Cls – Clears the console windows

Cmd – Opens a new console

Cmstp -- Installs or removes a Connection Manager service profile. Used without
optional parameters, cmstp installs a service profile with default settings appropriate to
the operating system and to the user's permissions.

Color -- Changes the Command Prompt window foreground and background colors for
the current session.

6
Comp-- Compares the contents of two files or sets of files byte by byte.
Compact -- Displays and alters the compression of files or directories on NTFS partitions.
Used without parameters, compact displays the compression state of the current
directory.

Convert – Converts FAT 32 drives to NTFS, not recommended for flash media or disks
used in non-NT systems

Copy -- Copies one or more files from one location to another.

Cprofile -- Cleans specified profiles of wasted space and, if user-specific file associations
are disabled, removes these associations from the registry. Profiles that are currently in
use are not modified.

Date – Displays the current date

Defrag – Defragments the target drive. Do not use on third party filesystems ie XFS,
JFS, EXT2, ReiserFS as it will corrupt the data on those drives

Del – Deletes specified files

Dir – Lists the contents of current directory

Diskcomp -- Compares the contents of two floppy disks

Diskcopy – Copies contents of floppy disks

DiskPart -- DiskPart.exe is a text-mode command interpreter that enables you to manage

objects (disks, partitions, or volumes) by using scripts or direct input from a command
prompt

Doskey -- Calls Doskey.exe, which recalls Windows XP commands, edits command

lines, and creates macros.

Driverquery – Lists all active drivers on a specified system, may also be used remotely
via Terminal Services.

Echo -- Turns the command-echoing feature on or off

Endlocal -- Ends localization of environment changes in a batch file, restoring

environment variables to their values before the matching setlocal command

7
.
Eventcreate -- Enables an administrator to create a custom event in a specified event log
Eventquery -- Lists the events and event properties from one or more event logs.

Evntcmd -- Displays and configures event triggers on local or remote machines.

Exit – Exits console session

Expand – Expands files compressed files that were created using the compress command

Fc -- Compares two files and displays the differences between them.

Find -- Searches for a specific string of text in a file or files

Findstr -- Searches for patterns of text in files using regular expressions.

Finger -- Displays information about a user or users on a specified remote computer

(typically a computer running UNIX/Linux) that is running the Finger service or daemon.
The remote computer specifies the format and output of the user information display.
Used without parameters, finger displays help.

Flattemp -- Enables or disables flat temporary folders.

For -- Runs a specified command for each file in a set of files.

Format – Formats the target drive

Fsutil -- a command-line utility that you can use to perform many FAT and NTFS file
system related tasks, such as managing reparse points, managing sparse files,
dismounting a volume, or extending a volume. Because fsutil is quite powerful, it should
only be used by advanced users who have a thorough knowledge of Windows XP.
WARNING – Using this command can completely destroy a Windows XP/Server 2003
Installation, use with extreme care.

Ftp – Allows a user to interact with an FTP server

Ftype -- Displays or modifies file types used in file name extension associations

Getmac – Returns the media access control (MAC) address and list of network protocols
associated with each address for all network cards in each computer, either locally or
across a network.

8
Goto -- Within a batch program, directs Windows XP to a line identified by a label.
When the label is found, it processes the commands that begin on the next line.
Gpresult -- Displays Group Policy settings and Resultant Set of Policy (RSOP) for a user
or a computer.

Gpupdate -- Refreshes local and Active Directory-based Group Policy settings, including
security settings. This command supersedes the now obsolete /refreshpolicy option for
the secedit command.

Graftabl -- Enables the ability to display an extended character set in graphics mode.

Help – Provides online information about system commands (that is, non-network
commands).

Helpctr -- Starts Help and Support Center

Hostname -- Displays the host name portion of the full computer name of the computer.

If -- Performs conditional processing in batch programs

Ipconfig – Shows and allows modification of IP addresses assigned to local and remote
nodes.

Ipseccmd -- Configures Internet Protocol Security (IPSec) policies in a directory service

or in a local or remote registry.

Ipxroute -- Displays and modifies information about the routing tables used by the IPX
protocol.

Irftp -- Sends files over an infrared link. Used without parameters or used with /s, irftp
opens the Wireless Link dialog box, where you can select the files that you want to send
without using the command line.

Label -- Creates, changes, or deletes the name of a disk

Lodctr -- Registers new Performance counter names and Explain text for a service or
device driver, and saves and restores counter settings and Explain text.

Logman -- Manages and schedules performance counter and event trace log collections
on local and remote systems.

9
Lpq -- Displays the status of a print queue on a computer running Line Printer Daemon
(LPD). Used without parameters, lpq displays command-line help for the lpq command.

Lpr -- Sends a file to a computer running Line Printer Daemon (LPD) in preparation for
printing.

Macfile -- Use the macfile commands at the command prompt to manage File Server for
Macintosh servers, volumes, directories, and files, for use with the AppleShare protocol.

Mkdir (md) – Creates a directory

Mmc – Launches the Microsoft Management Console, and advanced configuration utility
in Windows NT 4/2000/XP systems

Mode -- Displays system status, changes system settings, or reconfigures ports or devices

More -- Displays one screen of output at a time.

Mountvol -- Creates, deletes, or lists a volume mount point. Mountvol is a way to link
volumes without requiring a drive letter. Usually UNIX/Linux/Macintosh volumes

Move -- Moves one or more files from one directory to the specified directory.

Msiexec -- Provides the means to install, modify, and perform operations on Windows
Installer from the command line.

Msinfo32 -- Displays a comprehensive view of your hardware, system components, and

software environment.

Nbtstat -- Displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name
tables for both the local computer and remote computers, and the NetBIOS name cache.

Netstat -- Displays active TCP connections, ports on which the computer is listening,
Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP
protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6
protocols).

Nslookup -- Displays information that you can use to diagnose Domain Name System
(DNS) infrastructure. Before using this tool, you should be familiar with how DNS
works. The Nslookup command-line tool is available only if you have installed the
TCP/IP protocol.

10
Ntbackup -- Perform backup operations at a command prompt or from a batch file using
the ntbackup command followed by various switches

Ntcmdprompt -- Runs the command interpreter Cmd.exe, rather than Command.com,

after running a TSR or after starting the command prompt from within an MS-DOS
application.

Ntsd -- is included as a courtesy to software developers. Only system developers should

use this command. For more information, see the help switch with NTSD.

Openfiles -- Queries or displays open files. Also queries, displays, or disconnects files
opened by network users.

Pagefileconfig – Configuration command for the paging file. WARNING – Using this
command can completely destroy a Windows XP/Server 2003 Installation, use with
extreme care.

Path -- Sets the command path in the PATH environment variable,

Pathping -- Provides information about network latency and network loss at intermediate
hops between a source and destination. Pathping sends multiple Echo Request messages
to each router between a source and destination over a period of time and then computes
results based on the packets returned from each router.

Pause -- Suspends processing of a batch program and displays a message prompting the
user to press any key to continue.

Pbadmin -- Administers phone books. Used without parameters

Pentnt -- Detects floating point division error (if present) in the Pentium chip, disables
floating point hardware, and turns on floating point emulation.

Ping -- Verifies IP-level connectivity to another TCP/IP computer by sending Internet

Control Message Protocol (ICMP) Echo Request messages.

Popd -- Changes the current directory to the directory stored by the pushd command.

Print -- Sends a text file to a printer

11
Prncnfg -- Configures or displays configuration information about a printer.
Prndrvr -- Adds, deletes, and lists printer drivers.

Prnjobs -- Pauses, resumes, cancels, and lists print jobs.

Prnmngr -- Adds, deletes, and lists printers or printer connections, in addition to setting
and displaying the default printer.

Prnport -- Creates, deletes, and lists standard TCP/IP printer ports, in addition to
displaying and changing port configuration.

Prnqctl -- Prints a test page, pauses or resumes a printer, and clears a printer queue.

Prompt -- Changes the Cmd.exe prompt to the default settings

Pushd -- Stores the name of the current directory for use by the popd command before
changing the current directory to the specified directory.

Query – For use with a Terminal Server

Rasdial -- You can automate the connection process for any Microsoft client by using a
simple batch file and the rasdial command.

Rcp -- Copies files between a Windows XP computer and a system running rshd, the
remote shell service (daemon)

Recover – Allows a user to recover a corrupted or deleted file by listing the directory and
name where the file was last located. Also can be used to recover files from a bad or
defective disk.

Reg -- Adds, changes, and displays registry subkey information and values in registry
entries.

Regsvr32 -- This command-line tool registers .dll files as command components in the
registry.

Relog -- Extracts performance counters from performance counter logs into other
formats, such as text-TSV (for tab-delimited text), text-CSV (for comma-delimited text),
binary-BIN, or SQL.

Rem -- Allows a user to add remarks to a batch file

12
Rename -- Changes the name of a file or a set of files.

Replace -- Replaces files in the destination directory with files in the source directory that
have the same name.

Reset session -- Enables you to reset (delete) a session from the terminal server.

Rexec -- Runs commands on remote computers running the Rexec service (daemon).

Rmdir – Removes a directory

Route -- Displays and modifies the entries in the local IP routing table.

Rsh -- Runs commands on remote computers running the RSH service or daemon.

Rsm -- Manages media resources using Removable Storage. Using the rsm command,
you can run batch scripts for applications that do not currently support the Removable
Storage API.

Runas – Allows a user to run tools or commands as a different user, usually as the
administrator. Must have and Admins log-on and password.

Sc -- Communicates with the Service Controller and installed services.

Schtasks – Allows a user to schedule a task.

Secedit -- Configures and analyzes system security by comparing your current

configuration to at least one template.

Set -- Displays, sets, or removes environment variables.

Setlocal -- Starts localization of environment variables in a batch file.

Shift -- Changes the position of batch parameters in a batch file.

Sort -- Reads input, sorts data, and writes the results to the screen, to a file, or to another
device

Start -- Starts a separate Command Prompt window to run a specified program or

command.

Subst -- Associates a path with a drive letter.

13
Systeminfo – Displays detailed configuration information about a computer and its
operating system, including operating system configuration, security information, product
ID, and hardware properties, such as RAM, disk space, and network cards.

Sfc – System File Checker, Scans and verifies the versions of all protected system files
after you restart your computer.

Taskkill -- Allows a user to kill a task using the PID number, user must have permissions
to a task in order to kill it.

Tasklist -- Displays a list of applications and services with their Process ID (PID) for all
tasks running on either a local or a remote computer.

Tcmsetup -- Sets up or disables the TAPI client.

Telnet – allows users to communicate with a remote computer that is using the Telnet
protocol

Tftp -- Transfers files to and from a remote computer, typically a computer running
UNIX, that is running the Trivial File Transfer Protocol (TFTP) service or daemon.

Time – Displays current time

Title -- Creates a title for the command prompt window.

Tracerpt -- Processes event trace logs or real-time data from instrumented event trace
providers and allows you to generate trace analysis reports and CSV (comma-delimited)
files for the events generated.

Tracert -- Determines the path taken to a destination by sending Internet Control Message
Protocol (ICMP) Echo Request messages to the destination with incrementally increasing
Time to Live (TTL) field values.

Tree – Graphically displays the directory structure of a path or of the disk in a drive.

Type -- Displays the contents of a text file. Use the type command to view a text file
without modifying it.

Typeperf -- Writes performance counter data to the command window, or to a supported

log file format. To stop Typeperf, press CTRL+C.

14
U

Unlodctr -- Removes Performance counter names and Explain text for a service or device
driver from the system registry

Ver -- Displays the Windows XP version number

Verify -- Windows XP does not use this command. It is accepted only for compatibility
with MS-DOS files.

Vol -- Displays the disk volume label and serial number, if they exist. A serial number is
displayed for a disk formatted with MS-DOS version 4.0 or later.

Vssadmin -- Displays current volume shadow copy backups and all installed shadow
copy writers and providers in the command window.

W32tm -- A tool used to diagnose problems occurring with Windows Time

Winnt -- Performs an installation of or upgrade to Windows XP. If you have hardware

that is compatible with Windows XP, you can run winnt at a Windows 3.x or MS-DOS
command prompt.

Winnt32 -- Performs an installation of or upgrade to Windows XP. You can run winnt32
at the command prompt on a computer running Windows 3.x, Windows 95, Windows 98,
Windows Millennium Edition, Windows NT 3.x\4.x, Windows 2000, or Windows XP.

Xcopy -- Copies files and directories, including subdirectories.

15
New Command Line tools in Windows XP/Server 2003
These are the new tools beyond the basic DOS commands that were added to Windows
XP

bootcfg -- Configures, queries, or changes Boot.ini file settings.

defrag -- Locates and consolidates fragmented boot files, data files, and folders on local
volumes.

diskpart -- Manages disks, partitions, or volumes.

driverquery -- Queries for a list of drivers and driver properties.

eventcreate -- Enables an administrator to create a custom event in a specified event log.

eventquery -- Lists the events and event properties from one or more event logs.

eventtriggers -- Displays and configures event triggers on local or remote machines.

fsutil -- Manages reparse points, managing sparse files, dismounting a volume, or

extending a volume.

getmac -- Obtains the media access control (MAC) address and list of network protocols

helpctr -- Starts Help and Support Center.

ipseccmd -- Configures Internet Protocol Security (IPSec) policies in the directory

service, or in a local or remote registry. Ipseccmd is a command-line version of the IP
Security Policies Microsoft Management Console (MMC) snap-in.

logman -- Manages and schedules performance counter and event trace log collections on
local and remote systems.

openfiles -- Queries, displays, or disconnects open files.

pagefileconfig -- Displays and configures the paging file Virtual Memory settings of a
system.

perfmon -- Enables you to open a Performance console configured with settings files
from Windows NT 4.0 version of Performance Monitor.

prncnfg -- Configures or displays configuration information about a printer.

prndrvr -- Adds, deletes, and lists printer drivers from local or remote print servers.

16
prnjobs -- Pauses, resumes, cancels, and lists print jobs.

prnmngr -- Adds, deletes, and lists printers or printer connections, in addition to setting
and displaying the default printer.
prnport -- Creates, deletes, and lists standard TCP/IP printer ports, in addition to
displaying and changing port configuration.

prnqctl -- Prints a test page, pauses or resumes a printer, and clears a printer queue.

relog Extracts performance counters from performance counter logs into other formats,
such as text-TSV (for tab-delimited text), text-CSV (for comma-delimited text), binary-
BIN, or SQL.

sc -- Retrieves and sets information about services. Tests and debugs service programs.

schtasks -- Schedules commands and programs to run periodically or at a specific time.

Adds and removes tasks from the schedule, starts and stops tasks on demand, and
displays and changes scheduled tasks.

shutdown -- Shuts down or restarts a local or remote computer.

systeminfo -- Queries the system for basic system configuration information.

taskkill -- Ends one or more tasks or processes.

tasklist -- Displays a list of applications, services, and the Process ID (PID) currently
running on either a local or a remote computer.

tracerpt -- Processes event trace logs or real-time data from instrumented event trace
providers and allows you to generate trace analysis reports and CSV (comma-delimited)
files for the events generated.

typeperf -- Writes performance counter data to the command window or to a supported

log file format.

WMIC -- Eases the use of Windows Management Insturmentation (WMI) and systems
managed through WMI.

17