ITInsightHub

Windows Command Line cheat sheet

The table below is the translation table: the left column is what you pound into cmd.exe, the right is the idiomatic PowerShell. Both run on Windows 11 (and Server) out of the box — no modules to install for any row.

Three mechanics make the pairs not identical and worth learning: cmd.exe is a text pipeline, PowerShell is an object pipeline; cmd flags use a slash (/all) while PowerShell parameters use a dash (-All); and almost every cmd.exe utility (ipconfig, netstat, w32tm, sfc, rundll32-style tools) runs fine inside PowerShell as an external program — which is why sometimes the PowerShell column keeps the original command.

Task by task: the translation table

Pairs verified against Microsoft Learn references. cmd commands are internal or System32 utilities; PowerShell columns are cmdlets (or the same utility, when no cmdlet exists).
TaskcmdPowerShell
IP configurationipconfig /allGet-NetIPConfiguration | Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv4DefaultGateway
IPv4 addresses onlyipconfigGet-NetIPAddress -AddressFamily IPv4
Flush DNS cacheipconfig /flushdnsClear-DnsClientCache
ARP tablearp -aGet-NetNeighbor -AddressFamily IPv4
Routing tableroute printGet-NetRoute
Add a static routeroute add 10.20.0.0 mask 255.255.0.0 192.168.1.254New-NetRoute -DestinationPrefix 10.20.0.0/16 -NextHop 192.168.1.254 -InterfaceIndex 12
Process listtasklistGet-Process
Kill by PIDtaskkill /pid 2748 /fStop-Process -Id 2748 -Force
Kill by nametaskkill /im notepad.exe /fStop-Process -Name notepad -Force
All TCP connectionsnetstat -anoGet-NetTCPConnection
Connections on one portnetstat -ano | findstr :3389Get-NetTCPConnection -LocalPort 3389
System file repairsfc /scannowsfc /scannow (no cmdlet exists — run it from PowerShell)
Repair the component storeDISM /Online /Cleanup-Image /RestoreHealthDISM /Online /Cleanup-Image /RestoreHealth (elevated; no cmdlet exists — run it from PowerShell)
Disk / volume statuschkdsk C:Get-Volume | Select-Object DriveLetter, FileSystemLabel, FileSystem, Size, SizeRemaining
Disk free spacedir C:\Get-PSDrive -PSProvider FileSystem | Select-Object Name, @{n="UsedGB";e={[math]::Round($_.Used/1GB,1)}}, @{n="FreeGB";e={[math]::Round($_.Free/1GB,1)}}
Time service statusw32tm /query /statusGet-Service w32time | Select-Object Status, StartType
Immediately resync timew32tm /resyncw32tm /resync (same utility — elevated; no cmdlet covers resync)
Windows editionwinverGet-ComputerInfo -Property OsName, OsVersion, OsBuildNumber
Host namehostname$env:COMPUTERNAME
Trace a pathtracert example.comTest-NetConnection -ComputerName example.com -TraceRoute
Ping with a fixed countping -n 4 example.comTest-Connection -ComputerName example.com -Count 4 | Select-Object Address, ResponseTime
File hash (MD5)certutil -hashfile C:\temp\disk-usage.log MD5Get-FileHash -Path C:\temp\disk-usage.log -Algorithm MD5 | Select-Object Algorithm, Hash
Search text in filesfindstr /s /i /m error C:\logs\*.logGet-ChildItem -Path C:\logs -Filter *.log | Select-String -Pattern error
Who am Iwhoami[System.Security.Principal.WindowsIdentity]::GetCurrent().Name
My token's groupswhoami /groupswhoami /groups (same utility — run it from PowerShell)
Output to clipboardipconfig | clipGet-NetIPConfiguration | Out-String | Set-Clipboard
Read the clipboardpowershell -Command Get-ClipboardGet-Clipboard
Restart nowshutdown /r /t 0Restart-Computer -Force
Shut down nowshutdown /s /t 0Stop-Computer -Force
Event log tailwevtutil qe System /c:20 /rd:true /f:textGet-WinEvent -LogName System -MaxEvents 20
DNS lookupnslookup example.comResolve-DnsName example.com
System informationsysteminfoGet-ComputerInfo
cmd.exe never uses PowerShell objects: its pipeline passes plain text between commands, and its built-ins (dir, copy, del, findstr) are not cmdlets at all. This is why tasklist | SORT works in cmd but something like Get-Process | Where-Object WorkingSet64 only means something in PowerShell — and why PowerShell's natural filters are property comparisons, while cmd's are text grep (... | findstr :3389). Note that wmic is also retired: Microsoft deprecated the WMI command-line utility as of Windows 10 21H1 and does not ship it in some recent builds, another reason the disk-free row above reads dir or PowerShell instead.

Translation rules that cover 90% of the pairs

slash flags vs dash flags
cmd uses /flag (ipconfig /all); PowerShell uses -Flag. Same utility runs unchanged from PowerShell, but its output stays text there
text output -> objects
netstat -ano is text you grep; Get-NetTCPConnection is objects you filter: -LocalPort 3389, -State Listen
System32 utilities
ipconfig, netstat, w32tm, sfc and shutdown are external programs — they run from PowerShell unchanged
cmd help -> PowerShell help
Get-Help Get-NetTCPConnection -Online opens the reference page; Get-Command -Noun Route lists the cmdlets of a family

Reading the pairs

Notes that keep the table honest

FAQ

Is cmd.exe the same as PowerShell?

No. cmd.exe is a text-mode command interpreter from the DOS lineage: its pipeline passes strings and its built-ins (dir, copy, del, findstr, sort) are internal commands. PowerShell is an object-oriented scripting runtime: every result is a typed .NET object, so filtering means comparing properties instead of grepping text. cmd.exe is still on every Windows box — but it is the middle-aged tool, PowerShell is the one still growing.

Can I run PowerShell commands from cmd.exe?

Yes. cmd.exe accepts PowerShell as an external program: powershell -Command "Get-Process" runs Windows PowerShell 5.1, and pwsh -Command "Get-Process" starts PowerShell 7. For interactive work just launch pwsh.exe or powershell.exe from cmd; for routines, call powershell -ExecutionPolicy Bypass -File your-script.ps1 to skip the ExecutionPolicy inconvenience in a tight loop.

Why do netstat -ano and Get-NetTCPConnection show different results?

Because Get-NetTCPConnection is TCP-only: netstat -ano also lists UDP endpoints (and raw sockets), which do not appear at all in the TCP cmdlet. Use Get-NetUDPEndpoint -LocalPort 123 for the UDP half of the picture. netstat output is also static text sorted as-you-like-it; Get-NetTCPConnection lets you filter by state (-State Listen) or owning process (-OwningProcess 18948) before formatting.

Would the cmd equivalents of del /s /q be better done in PowerShell?

For one-off cleanup, del /s /q does the job. The PowerShell form Remove-Item -Path C:\temp\*, -Recurse -Force is the safer edge of the same work: try it with -WhatIf to preview, and use -Verbose to see each removal. The difference matters at scale, where object filters (Where-Object LastWriteTime -lt (Get-Date).AddDays(-30)) pick files by property rather than name pattern.