Command Reference

Windows — network

Command	Read this in the output
ipconfig /all	IPv4, mask, gateway, DHCP server, DNS servers
ipconfig /release	Drop the DHCP lease
ipconfig /renew	Request a new lease
ipconfig /flushdns	Clears the resolver cache
ping <host>	Reply time, TTL, truncated (TTL=128 indicates ICMP unavailable)
tracert <host>	Which hop stops responding
nslookup <name>	Which server answered, and what it said
arp -a	IP → MAC mappings
route print	Default gateway and routing table

Test-NetConnection <host> -Port <n>       # Read TcpTestSucceeded
Test-NetConnection <host> -InformationLevel Detailed
Resolve-DnsName <name>
Resolve-DnsName -Type SRV _ldap._tcp.dc01.corp.local

Windows — ports and processes

Command	Purpose
netstat -ano	Connections, listening ports, owning PID
netstat -ano | findstr :445	One port
netstat -ano | findstr LISTENING	Listening sockets only
netstat -e	Interface errors and discards
tasklist /FI "PID eq 4128"	Which process owns that socket
taskkill /PID 4128 /F	Terminate it

Get-NetTCPConnection -LocalPort 445 |
  Select-Object LocalAddress, State, OwningProcess,
    @{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}}

Windows — Active Directory

Command	Purpose
net user <name>	Locked, disabled, expired?
net user <name> /active:yes	Unlock or enable
net user <name> *	Reset the password
nltest /dsgetdc:corp.local	Can this machine see a DC?
dsquery user -limit 5	Query AD
klist	Cached Kerberos tickets
klist /purge	Clear them
w32tm /resync	Force time sync
gpupdate /force	Re-apply Group Policy
gpresult /r	Which policies applied, and why
whoami /all	Your token: groups, privileges, logon type

Get-ADUser -Identity "ravi" -Properties LockedOut, Enabled, PasswordExpired
Get-ADGroupMember -Identity "IT Support"
Get-ADComputer -Filter * -Properties * | Where-Object {$_.OperatingSystem -like "*Server*"}
Test-ADComputer -ComputerName "SRV01" -Server "dc01.corp.local"

Windows — services and system

Command	Purpose
Get-Service	State and start type
Get-Service | ? Status -ne 'Running'	What is not running
systeminfo	OS version, boot time, patch
Get-PhysicalDisk	Disk health
Get-Volume	Free space
Get-HotFix	Patching state
perfmon /rel	Reliability Monitor
sfc /scannow	Repair protected files
DISM /Online /Cleanup-Image /RestoreHealth	Repair component store

Windows — events

Get-WinEvent -FilterHashtable @{
    LogName = 'System'; Level = 1,2; StartTime = (Get-Date).AddHours(-1)
} | Select-Object TimeCreated, Id, ProviderName, Message

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 10

ID	Source	Means
7	Disk	Bad block
51	Disk	I/O error
55	Ntfs	File system corruption
41	Kernel-Power	Unexpected shutdown
4624 / 4625	Security	Logon success / failure
1058	SCM	Service disabled
7031	SCM	Service crashed

Windows — printers

Command	Purpose
Get-Printer	Queues, ports, status
Get-PrintJob -PrinterName "HP"	The queue, with errors
Get-PrintServer	Print servers
Get-Service Spooler	The critical service
Get-PrinterPort	Port type and host address

Windows — virtualisation

Command	Purpose
Get-VM	All VMs and state
Get-VMSnapshot -VMName X	Check for stale snapshots
Get-VMNetworkAdapter -VMName X	Which vSwitch
Get-VMHost	Host capacity
Get-VMIntegrationService -VMName X	Integration services

Linux equivalents

Purpose	Command
Interfaces	ip a / ip addr
Routing table	ip r / ip route
ARP / neighbours	ip neigh
Sockets	ss -tulpn
Port test	nc -zv <host> <port>
DNS	dig +short <name> / dig -x <ip>
Resolver config	resolvectl status
Service status	systemctl status <unit>
Service logs	journalctl -u <unit> -n 50
Disk space	df -h
Memory	free -h
Load	uptime
Processes	top / htop
Path trace	traceroute <host>
Firewall	ufw status / iptables -L -n

PowerShell essentials

# Pipeline
Get-Service | Where-Object {$_.Status -eq 'Running'} | Measure-Object

# Objects, not strings
Get-Process | Select-Object -First 5 Name, Id, CPU
Get-Service | Select-Object Name, @{n='State'; e={$_.Status}}

# Export for a ticket
Get-ADUser -Filter * | Select-Object Name, Enabled |
  Export-Csv C:\temp\users.csv

# Write a useful log entry
Write-EventLog -LogName Application -Source "Support" `
  -EventId 4000 -EntryType Information -Message "Reset password for ravi"

★Verb-Noun matters

Get, Set, New, Remove, Start, Stop, Restart, Enable, Disable, Test, Enter, Exit, Invoke, Register, Unregister, Wait, Resize, Search, Trace. Interviewers hear "knows the cmdlet conventions" and score it.