Windows 11 Tools, Commands and Programs

Introduction

An overview of Windows 11 Tools, Commands and Programs.

Commands can be run from Win+R (Run), the Start menu search, Command Prompt, PowerShell or Windows Terminal. Some tools need an elevated (administrator) terminal. Availability depends on the edition: Home lacks gpedit.msc, secpol.msc and lusrmgr.msc.

Management consoles (MMC snap-ins)

Type these in Windows Key + R (Run) or the Start menu search.

Command	Description
`services.msc`	Start, stop and configure Windows services
`devmgmt.msc`	Device Manager: hardware and drivers
`diskmgmt.msc`	Disk Management: partitions, volumes, drive letters
`compmgmt.msc`	Computer Management: several snap-ins in one console
`eventvwr.msc`	Event Viewer: system, application and security logs
`taskschd.msc`	Task Scheduler
`lusrmgr.msc`	Local Users and Groups (not available on Home edition)
`gpedit.msc`	Local Group Policy Editor (Pro, Enterprise, Education only)
`secpol.msc`	Local Security Policy (not available on Home edition)
`perfmon.msc`	Performance Monitor: counters and data collector sets
`wf.msc`	Windows Defender Firewall with Advanced Security
`certmgr.msc`	Certificates for the current user
`certlm.msc`	Certificates for the local computer
`fsmgmt.msc`	Shared Folders: shares, sessions and open files
`printmanagement.msc`	Print Management (Pro and higher)
`tpm.msc`	TPM Management
`WmiMgmt.msc`	WMI Control
`comexp.msc`	Component Services (COM+ and DCOM)
`rsop.msc`	Resultant Set of Policy
`virtmgmt.msc`	Hyper-V Manager (when Hyper-V is enabled)
`dsa.msc`	Active Directory Users and Computers (requires RSAT)
`mmc`	Blank Microsoft Management Console for adding your own snap-ins

System and diagnostic tools (GUI)

Graphical tools you can launch from Win+R, Start or a terminal.

Command	Description
`taskmgr`	Task Manager (also Ctrl+Shift+Esc)
`regedit`	Registry Editor
`msconfig`	System Configuration: boot options and startup services
`msinfo32`	System Information: hardware, drivers and environment summary
`dxdiag`	DirectX Diagnostic Tool: graphics, sound and display info
`winver`	Shows the Windows version and build number
`resmon`	Resource Monitor: live CPU, disk, network and memory use per process
`perfmon /rel`	Reliability Monitor: crash and update history timeline
`cleanmgr`	Disk Cleanup
`dfrgui`	Optimize Drives (defrag and TRIM)
`mdsched`	Windows Memory Diagnostic (runs at next reboot)
`sysdm.cpl`	System Properties: computer name, remote access, performance
`SystemPropertiesAdvanced`	Opens the Advanced tab of System Properties directly (environment variables)
`control`	Classic Control Panel
`netplwiz`	Advanced user accounts, including automatic sign-in settings
`optionalfeatures`	Turn Windows features on or off (Hyper-V, WSL, .NET, Sandbox)
`verifier`	Driver Verifier Manager
`sigverif`	File Signature Verification
`mrt`	Microsoft Malicious Software Removal Tool
`rstrui`	System Restore
`systemreset`	Reset this PC
`recoverydrive`	Create a recovery drive
`sdclt`	Backup and Restore (Windows 7)
`slui`	Windows activation (slui 3 opens the product key dialog)
`odbcad32`	ODBC Data Source Administrator
`iexpress`	IExpress Wizard: build self-extracting installers
`WindowsSandbox`	Windows Sandbox (Pro and Enterprise, when enabled)
`dccw`	Display Color Calibration
`cttune`	ClearType Text Tuner
`DisplaySwitch`	Projection mode switcher (same as Win+P)

Control Panel applets (.cpl)

Classic Control Panel pages that still open directly.

Command	Description
`appwiz.cpl`	Programs and Features (uninstall programs)
`ncpa.cpl`	Network Connections: adapter settings
`inetcpl.cpl`	Internet Properties: proxy, certificates, security zones
`main.cpl`	Mouse properties
`mmsys.cpl`	Sound: playback and recording devices
`powercfg.cpl`	Power Options
`intl.cpl`	Region and formats
`timedate.cpl`	Date and Time
`firewall.cpl`	Windows Defender Firewall (basic settings)
`joy.cpl`	Game Controllers
`wscui.cpl`	Security and Maintenance

Everyday apps and terminals

Built-in programs you can start by name.

Command	Description
`explorer`	File Explorer
`cmd`	Command Prompt
`powershell`	Windows PowerShell 5.1
`pwsh`	PowerShell 7 (only if installed separately)
`wt`	Windows Terminal
`notepad`	Notepad
`mspaint`	Paint
`calc`	Calculator
`snippingtool`	Snipping Tool
`charmap`	Character Map
`osk`	On-Screen Keyboard
`magnify`	Magnifier
`narrator`	Narrator screen reader
`mstsc`	Remote Desktop Connection client
`msra`	Windows Remote Assistance
`quickassist`	Quick Assist
`fsquirt`	Bluetooth File Transfer wizard

Networking commands

Run these in Command Prompt or PowerShell. Several need an elevated (admin) terminal for full output.

Command	Description
`ipconfig`	IP configuration. Useful switches: /all, /release, /renew, /flushdns, /displaydns
`ping`	ICMP echo test. -t runs continuously, -n sets the count
`tracert`	Shows the hops to a destination
`pathping`	Combines ping and tracert with packet loss statistics
`netstat`	Connections and listening ports. -ano shows PIDs, -b shows the executable
`nslookup`	DNS query tool
`arp`	ARP cache. arp -a lists entries
`route`	View or change the routing table (route print)
`netsh`	Network shell: netsh wlan, netsh interface, netsh advfirewall, netsh winsock reset
`nbtstat`	NetBIOS over TCP/IP statistics
`getmac`	Lists MAC addresses
`hostname`	Prints the computer name
`net`	net use, net user, net share, net view, net start, net stop
`curl`	HTTP and HTTPS client (built in)
`ssh`	OpenSSH client (built in)
`scp / sftp`	OpenSSH file transfer clients
`ssh-keygen`	Generates SSH key pairs
`telnet`	Telnet client (enable via Windows Features)
`ftp`	Legacy FTP client
`tftp`	TFTP client (enable via Windows Features)
`nltest`	Domain trust and secure channel tests
`w32tm`	Windows Time service configuration and diagnostics
`certutil`	Certificate tool. Also hashes files: certutil -hashfile file SHA256
`bitsadmin`	Manage BITS transfer jobs (deprecated)
`pktmon`	Built-in packet capture and monitoring
`dsregcmd /status`	Shows Entra ID (Azure AD) and hybrid join status

System information, processes and services

Command-line (Command-Prompt) tools for inspecting and managing the system.

Command	Description
`tasklist`	Lists running processes. /svc shows services, /v is verbose
`taskkill`	Ends a process: /PID, /IM, /F to force
`systeminfo`	OS, hotfixes, hardware and uptime summary
`whoami`	Current user. /groups and /priv show more
`ver`	Prints the Windows version
`driverquery`	Lists installed drivers
`pnputil`	Manage the driver store and devices
`sc`	Service Control: query, start, stop, config, delete
`schtasks`	Create and manage scheduled tasks
`wevtutil`	Query and export event logs
`eventcreate`	Write a custom event log entry
`typeperf`	Write performance counter values to the console
`logman`	Manage performance data collector sets
`openfiles`	Lists open files (needs the /local flag enabled)
`query`	query user, query session, query process
`qwinsta`	Lists remote desktop sessions
`msg`	Sends a message to a user or session
`tzutil`	View or set the time zone
`msiexec`	Windows Installer: install, repair or uninstall MSI packages
`wmic`	Deprecated and disabled by default in recent builds. Use Get-CimInstance instead
`slmgr`	Software licensing: slmgr /xpr shows the activation expiry
`winget`	Windows Package Manager: install, upgrade and remove apps
`wsl`	Windows Subsystem for Linux management
`sudo`	Run an elevated command from a normal terminal (Windows 11 24H2 and later, enable in Settings, For developers)

Disk, file system, backup and recovery

Maintenance and repair commands (Command Prompt). Run from an elevated terminal.

Command	Description
`sfc /scannow`	System File Checker: repairs protected system files
`dism`	Image servicing. DISM /Online /Cleanup-Image /RestoreHealth repairs the component store
`chkdsk`	Checks a disk for errors (/f fixes, /r recovers bad sectors)
`diskpart`	Scriptable disk and partition management
`defrag`	Defragment or optimize drives from the command line
`fsutil`	File system utility (volume info, sparse files, quotas)
`vssadmin`	Volume Shadow Copy administration
`wbadmin`	Backup and restore from the command line
`manage-bde`	BitLocker management
`bcdedit`	Edit boot configuration data
`reagentc`	Configure the Windows Recovery Environment
`mountvol`	Manage volume mount points
`format`	Format a volume
`convert`	Convert FAT32 to NTFS
`label / vol`	Set or show a volume label
`cipher`	NTFS encryption. cipher /w:C: wipes free space
`compact`	NTFS compression
`takeown`	Take ownership of files
`icacls`	View and change file permissions
`attrib`	View and change file attributes
`subst`	Map a folder to a drive letter
`fltmc`	List file system filter drivers

File handling and text utilities

Classic command interpreter commands and helpers (Command Prompt)

Command	Description
`dir, cd, copy, move, del, ren, md, rd, type`	Core file and folder commands built into cmd
`robocopy`	Robust file copy with mirroring, retries and logging
`xcopy`	Older recursive copy tool
`tar`	Create and extract tar and zip archives (built in)
`expand / makecab`	Extract and create CAB archives
`clip`	Pipe output to the clipboard
`where`	Locates executables on the PATH
`findstr`	Search text with regular expressions
`find`	Search for a text string
`more`	Page through output
`sort`	Sort lines of text
`tree`	Draw a folder tree
`fc`	Compare two files
`comp`	Compare files byte by byte
`forfiles`	Run a command on each file matching a mask
`doskey`	Command history and macros
`set`	View or set environment variables for the current session
`setx`	Set persistent environment variables
`assoc / ftype`	View or change file associations
`timeout`	Wait for a number of seconds
`choice`	Prompt for a key press in scripts
`waitfor`	Wait for or send a signal
`mode`	Configure console or device settings
`chcp`	Show or change the console code page
`cscript / wscript`	Windows Script Host (VBScript and JScript)
`rundll32`	Call a function exported by a DLL
`regsvr32`	Register or unregister DLLs

Security, users and policy

Account, credential and policy commands.

Command	Description
`reg`	Query and edit the registry from the command line
`runas`	Run a program as another user
`cmdkey`	Manage stored credentials
`gpresult`	Shows applied group policy (gpresult /r)
`gpupdate`	Refreshes group policy (gpupdate /force)
`secedit`	Analyze and apply security templates
`auditpol`	View and set audit policy
`shutdown`	shutdown /s, /r, /t, /a to abort, /fw reboot to firmware
`logoff`	Log off the current session
`net user`	Create, modify and list local user accounts
`net localgroup`	Manage local groups
`windowsdefender:`	Opens the Windows Security app
`MpCmdRun.exe`	Defender command-line scanner (C:\Program Files\Windows Defender)

PowerShell cmdlets

Run in PowerShell or Windows Terminal. Use Get-Help cmdletname -Examples for usage.

Command	Description
`Get-Process / Stop-Process`	List and end processes
`Get-Service / Restart-Service`	List and control services
`Get-WinEvent`	Query event logs
`Get-ChildItem`	List files (alias dir, ls)
`Get-Content`	Read a file (alias cat, type). -Wait works like tail -f
`Select-String`	Grep-style text search
`Get-Command`	Find commands and their sources
`Get-Help / Update-Help`	Built-in help system
`Get-ComputerInfo`	Detailed system information
`Get-CimInstance`	Query WMI/CIM classes (replacement for wmic)
`Get-HotFix`	Installed updates
`Get-Disk / Get-Volume / Get-PhysicalDisk`	Storage inventory and health
`Get-NetTCPConnection`	Connections and listening ports (netstat equivalent)
`Get-NetIPAddress / Get-NetAdapter`	IP addresses and adapters
`Get-NetFirewallRule`	Firewall rules
`Test-NetConnection`	Ping, traceroute and port test, e.g. -ComputerName host -Port 443
`Resolve-DnsName`	DNS lookups
`Clear-DnsClientCache`	Flush the DNS cache
`Invoke-WebRequest / Invoke-RestMethod`	HTTP requests and API calls
`Get-ScheduledTask`	List scheduled tasks
`Get-LocalUser / Get-LocalGroupMember`	Local accounts and group membership
`Get-Acl / Set-Acl`	File and registry permissions
`Get-AppxPackage`	Installed Store (MSIX) apps
`Get-WindowsOptionalFeature`	List and toggle Windows features
`Get-ExecutionPolicy / Set-ExecutionPolicy`	Script execution policy
`Get-ItemProperty`	Read registry values (e.g. HKLM:\SOFTWARE\…)
`Get-PSDrive`	Drives, registry hives and other providers
`Get-FileHash`	Compute file hashes
`Get-Counter`	Performance counters
`Get-MpComputerStatus / Start-MpScan`	Defender status and scans
`Start-Process`	Launch programs (-Verb RunAs for admin)
`Compress-Archive / Expand-Archive`	Zip and unzip
`Where-Object / Select-Object / Sort-Object / Measure-Object`	Core pipeline filters
`Export-Csv / ConvertTo-Json`	Export data

Run dialog shortcuts: folders and variables

Type these in Win+R or the File Explorer address bar.

Command	Description
`%appdata%`	Roaming application data
`%localappdata%`	Local application data
`%temp%`	Temporary files
`%userprofile%`	Your user profile folder
`%programdata%`	Shared application data
`shell:startup`	Startup folder for the current user
`shell:common startup`	Startup folder for all users
`shell:sendto`	The Send To menu entries
`shell:AppsFolder`	All installed apps, including Store apps
`shell:Fonts`	Installed fonts
`shell:RecycleBinFolder`	Recycle Bin

Settings pages (ms-settings URIs)

Type these in Win+R to jump straight to a Settings page.

Command	Description
`ms-settings:`	Settings home
`ms-settings:windowsupdate`	Windows Update
`ms-settings:network`	Network and internet
`ms-settings:network-wifi`	Wi-Fi
`ms-settings:display`	Display
`ms-settings:bluetooth`	Bluetooth and devices
`ms-settings:about`	About (device specs and Windows version)
`ms-settings:appsfeatures`	Installed apps
`ms-settings:defaultapps`	Default apps
`ms-settings:startupapps`	Startup apps
`ms-settings:storagesense`	Storage
`ms-settings:recovery`	Recovery options
`ms-settings:troubleshoot`	Troubleshooters
`ms-settings:privacy`	Privacy and security
`ms-settings:developers`	For developers
`ms-settings:optionalfeatures`	Optional features