CMD commands are the built-in Windows commands you type into Command Prompt, cmd.exe, to work with files, the network, the system, disks and user accounts.
About thirty of them cover almost everything an administrator does there: cd, dir, copy, robocopy and del for files, ipconfig, ping, tracert and nslookup for the network, systeminfo, tasklist, sfc and shutdown for the system, chkdsk and diskpart for disks, net user for accounts. Some need an elevated prompt, and format, diskpart and del /s can destroy data. For new scripts, Microsoft recommends PowerShell.
- Type any command followed by /? to see its switches, or help for a list
- sfc, diskpart, manage-bde and account changes need an elevated prompt
- format, diskpart clean, del /s, rmdir /s and robocopy /MIR can erase data
- ipconfig, ping, tracert, nslookup and netstat cover most network faults
- WMIC is deprecated; its jobs moved to PowerShell
On this page
Getting startedHow to use Command Prompt
Command Prompt is the window that runs cmd.exe, the Command shell Microsoft built into Windows before PowerShell. Microsoft's Windows Commands reference describes a set of Win32 console commands built into all supported versions of Windows and Windows Server, and those are what people mean by Windows cmd commands.
Opening it. Select Start, type cmd, and select Command Prompt. Pressing Windows key+R, typing cmd and pressing Enter does the same. On Windows 11 it opens in Windows Terminal, which can also host PowerShell tabs.
Opening it elevated. Right-click Command Prompt in the Start results and select Run as administrator, then accept the User Account Control prompt. The title bar then starts with Administrator. On Windows 11 version 24H2 and later, Microsoft's Sudo for Windows can run a single command elevated once it is enabled in Settings.
Reading the syntax. A command is a name followed by switches and arguments: ipconfig /all, copy report.docx D:\backup. Type any command followed by /? for its switches, or help for the list of built-in commands. Tab completes file names and the up arrow recalls the last command.
Redirecting output. > writes the output of a command to a file, >> appends to it, and | passes it to another command, such as ipconfig /all | findstr IPv4. For example, ipconfig /all > network.txt saves the full output to a text file.
The rest of this page is a cmd commands list grouped by job: files, network, system, disks and accounts. The Windows command line commands that need an elevated prompt, and the ones that can destroy data, are marked.
FilesFile and directory commands
These are the basic cmd commands everyone meets first, and the syntax is the same on every Windows computer.
cd changes the current directory. cd .. moves up one level, and cd /d D:\data changes drive and folder together.
dir lists the files and subdirectories in the current directory. dir /s searches every subdirectory too, which is the quick way to find a file by name, for example dir /s budget.xlsx.
mkdir or md creates a directory, including any missing directories in the path, for example mkdir C:\reports\archive.
copy, move and ren copy, move and rename files, for example copy notes.txt D:\backup or ren notes.txt old-notes.txt. ren cannot move a file to another directory; its own help says so.
robocopy is the robust file copy for anything large. /E copies subdirectories including empty ones, /Z copies in restartable mode, and /COPYALL keeps permissions and ownership. It is the tool for moving a file share.
del deletes files and rmdir removes a directory. type notes.txt prints a text file to the screen, and tree draws the directory structure of a drive.
NetworkCMD network commands
The cmd network commands are the first tools for a network fault, and most run without elevation.
ipconfig shows the address, subnet mask and default gateway. ipconfig /all adds DNS servers, the MAC address and DHCP lease details, /release and /renew request a new DHCP address, and /flushdns purges the DNS resolver cache. The ipconfig guide covers reading the output.
ping tests whether a host answers, and tracert shows each router on the path. pathping combines both and reports loss per hop. The ping and traceroute guide explains the output.
nslookup queries DNS directly, which separates a DNS failure from a connectivity failure.
netstat -ano lists all connections and listening ports with numeric addresses and the owning process ID. Adding -b shows the program name, and its help warns it fails without sufficient permissions.
getmac lists MAC addresses, and net use maps or lists network drives, such as net use Z: \\server\share.
SystemSystem and troubleshooting commands
systeminfo shows the Windows version, install date, uptime, memory and installed hotfixes. hostname and whoami answer which computer and which account you are on.
tasklist lists running processes with their PID, and taskkill ends one: taskkill /PID 1234 /F, or /IM with the program name. /T also ends every child process.
sfc /scannow checks and repairs protected Windows system files. It needs an elevated prompt: run it in a normal window and it replies that you must be an administrator. If it cannot repair everything, the DISM command repairs the component store it draws from.
shutdown /r /t 0 restarts immediately, /s shuts down, and /f closes running applications without warning users.
gpupdate /force reapplies all Group Policy settings, and gpresult /r shows which policies actually applied.
DisksDisk commands, and the ones that destroy data
chkdsk checks a volume. chkdsk C: only reports. /F fixes errors and /R locates bad sectors and recovers readable information. Both need an elevated prompt, and on the drive Windows is running from, chkdsk offers to run at the next restart.
manage-bde -status reports BitLocker encryption on each volume. It needs an elevated prompt.
The following cmd commands can erase data with no undo and no recycle bin.
format erases a volume and creates a new file system. /Q makes it a quick format, which is fast and just as final.
diskpart manages disks and partitions interactively. Its clean command removes the partitions from whatever disk is selected, so always run list disk and select disk and check the size before anything else.
del /s /q deletes matching files in every subfolder without asking. rmdir /s /q removes a whole folder tree without asking.
robocopy /MIR mirrors a folder, which includes /PURGE: files in the destination that are not in the source are deleted. Swap the source and destination by mistake and it empties the source.
AccountsAccount commands
net user lists local accounts. net user alice shows one account, including when its password was last set. net user alice * /add creates one and prompts for the password, which keeps it out of the command history. Adding accounts needs an elevated prompt.
net localgroup administrators lists who holds local admin rights, a useful audit on any PC.
whoami /groups shows the groups of the current account, and runas starts a program as another user.
PowerShellWhen to move from cmd to PowerShell
Microsoft's Windows Commands reference says it recommends PowerShell instead of Windows Commands for the most robust, up-to-date Windows automation. PowerShell runs Windows commands and its own cmdlets, while the Command shell can only run Windows commands.
WMIC is the clearest example. Microsoft's page says it is deprecated as of Windows 10 version 21H1 and superseded by PowerShell for WMI, and it may be missing on current Windows 11 builds.
Stay in cmd for the one-line command prompt commands above, and for old batch files that work. Move to PowerShell for anything that loops, filters output or runs across many computers, because cmdlets return objects instead of text.
PitfallsWhere people go wrong
Running an admin command in a normal window. The error says access denied, and people assume the command is broken. Open the prompt as administrator.
Trusting diskpart's selected disk. Run list disk before clean, every time. A USB drive and a backup disk can be the same size.
Scripting robocopy /MIR from memory. Run it with /L first, which lists what would happen without copying or deleting anything.
Typing a password on the command line. net user name password leaves the password in the history. Use * to be prompted.
Writing new automation in batch files. New scripts belong in PowerShell, where errors, objects and remote computers are handled properly.
ComparisonCommon jobs in cmd and in PowerShell
| Task | cmd command | PowerShell cmdlet |
|---|---|---|
| List files | dir | Get-ChildItem, alias dir |
| Copy files | copy, robocopy | Copy-Item |
| Show IP configuration | ipconfig /all | Get-NetIPConfiguration |
| Test a host | ping | Test-Connection, Test-NetConnection |
| Query DNS | nslookup | Resolve-DnsName |
| List processes | tasklist | Get-Process |
| End a process | taskkill /PID | Stop-Process |
| System details | systeminfo | Get-ComputerInfo |
The cmd column is faster to type for a one-off check. The PowerShell column returns objects you can sort and filter, so Get-Process | Sort-Object CPU does in one line what tasklist output needs text parsing for. PowerShell also accepts dir and copy as aliases.
FAQFrequently asked questions
How do I use Command Prompt?
Select Start, type cmd and select Command Prompt, or press Windows key+R, type cmd and press Enter. Type a command and press Enter. Add /? after any command to see its switches, and type help for a list of the built-in commands.
How do I open Command Prompt as administrator?
Select Start, type cmd, right-click Command Prompt and select Run as administrator, then accept the User Account Control prompt. The window title begins with Administrator. Commands such as sfc, diskpart, chkdsk /f and net user /add need this elevated prompt.
What are the basic cmd commands?
The ones most people need are cd and dir to move around and list files, copy, move, ren and del to manage files, mkdir to create folders, cls to clear the screen, ipconfig and ping for the network, and exit to close the window.
Where can I find a full cmd commands list?
Type help in Command Prompt for the built-in commands with a one-line description each. Microsoft's Windows Commands reference on Microsoft Learn documents every command and its switches, including tools such as ipconfig, ping and netsh that help does not list.
What are the most useful cmd network commands?
ipconfig /all for the address, gateway and DNS servers, ping to test a host, tracert and pathping to see the path, nslookup to test DNS, netstat -ano for connections and ports, and ipconfig /flushdns to clear the DNS cache.
Which cmd commands can delete data?
format erases a volume, diskpart clean removes the partitions from a disk, del /s /q deletes files in all subfolders without asking, rmdir /s /q removes a folder tree, and robocopy /MIR deletes destination files missing from the source. None of them uses the recycle bin.
How do I list files with a cmd command?
Type dir to list the current folder. Add a path to list another folder, dir /s to include subfolders, and a wildcard such as dir *.pdf to show only matching files. The output includes sizes, dates and a total at the end.
How do I check a disk for errors from Command Prompt?
Run chkdsk C: to scan and report. chkdsk C: /f fixes errors and /r also looks for bad sectors, and both need an elevated prompt. On the drive Windows runs from, chkdsk offers to run at the next restart.
How do I end a program from Command Prompt?
Run tasklist to find the process ID, then taskkill /PID followed by the number. Add /F to force it, or use /IM with the program name, such as taskkill /IM notepad.exe /F. /T also ends the program's child processes.
Is Command Prompt the same as PowerShell?
No. Command Prompt runs cmd.exe and Windows commands. PowerShell runs those commands and its own cmdlets, which return objects rather than text. Microsoft recommends PowerShell for Windows automation, while cmd remains useful for quick checks and older batch files.
Are Windows command line commands the same on Windows 10 and 11?
Almost entirely. The core commands have not changed for years. Differences are at the edges: Windows 11 opens Command Prompt in Windows Terminal, version 24H2 added sudo, and WMIC is deprecated and may be missing on current builds.
What does the /? switch do?
It prints the built-in help for a command: what it does, its syntax and every switch with a short description. It works for nearly every Windows command, and it is the quickest way to check a switch before running something that changes data.
Keep readingRelated concepts
Read next · Diagnostics ipconfig and ip, and What the Output Is Telling You What ipconfig tells you, which switches matter, and the same jobs on Linux. Open this next13 min- Diagnostics · 11 min Ping and Traceroute How ping and traceroute work, and how to read their output without guessing.
- Windows administration · 11 min The DISM Command, and What Each Repair Switch Actually Does How DISM repairs the Windows image when sfc /scannow cannot finish the job.
- Operations · 8 min PowerShell vs Bash, and Why the Platform Decides for You Why PowerShell returns objects where cmd and Bash return text, and which shell to learn.