# Windows Command Line cheat sheet: cmd and PowerShell

> cmd.exe vs PowerShell for daily Windows admin: ipconfig, DNS flush, arp, route, tasklist, netstat, w32tm, sfc, chkdsk, shutdown and their cmdlets.

- Page URL: https://itinsighthub.com/windows/command-line/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# Windows Command Line cheat sheet

The table below is the translation table: the left column is what you pound into cmd.exe, the right is the idiomatic PowerShell. Both run on Windows 11 (and Server) out of the box — no modules to install for any row.

Three mechanics make the pairs not identical and worth learning: cmd.exe is a *text* pipeline, PowerShell is an *object* pipeline; cmd flags use a slash (`/all`) while PowerShell parameters use a dash (`-All`); and almost every cmd.exe utility (`ipconfig`, `netstat`, `w32tm`, `sfc`, `rundll32`-style tools) runs fine inside PowerShell as an external program — which is why sometimes the PowerShell column keeps the original command.

Published August 22, 2026

## Task by task: the translation table

*Pairs verified against Microsoft Learn references. cmd commands are internal or System32 utilities; PowerShell columns are cmdlets (or the same utility, when no cmdlet exists).*

| Task | cmd | PowerShell |
| --- | --- | --- |
| IP configuration | ipconfig /all | Get-NetIPConfiguration \| Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv4DefaultGateway |
| IPv4 addresses only | ipconfig | Get-NetIPAddress -AddressFamily IPv4 |
| Flush DNS cache | ipconfig /flushdns | Clear-DnsClientCache |
| ARP table | arp -a | Get-NetNeighbor -AddressFamily IPv4 |
| Routing table | route print | Get-NetRoute |
| Add a static route | route add 10.20.0.0 mask 255.255.0.0 192.168.1.254 | New-NetRoute -DestinationPrefix 10.20.0.0/16 -NextHop 192.168.1.254 -InterfaceIndex 12 |
| Process list | tasklist | Get-Process |
| Kill by PID | taskkill /pid 2748 /f | Stop-Process -Id 2748 -Force |
| Kill by name | taskkill /im notepad.exe /f | Stop-Process -Name notepad -Force |
| All TCP connections | netstat -ano | Get-NetTCPConnection |
| Connections on one port | netstat -ano \| findstr :3389 | Get-NetTCPConnection -LocalPort 3389 |
| System file repair | sfc /scannow | sfc /scannow (no cmdlet exists — run it from PowerShell) |
| Repair the component store | DISM /Online /Cleanup-Image /RestoreHealth | DISM /Online /Cleanup-Image /RestoreHealth (elevated; no cmdlet exists — run it from PowerShell) |
| Disk / volume status | chkdsk C: | Get-Volume \| Select-Object DriveLetter, FileSystemLabel, FileSystem, Size, SizeRemaining |
| Disk free space | dir C:\ | Get-PSDrive -PSProvider FileSystem \| Select-Object Name, @{n="UsedGB";e={[math]::Round($_.Used/1GB,1)}}, @{n="FreeGB";e={[math]::Round($_.Free/1GB,1)}} |
| Time service status | w32tm /query /status | Get-Service w32time \| Select-Object Status, StartType |
| Immediately resync time | w32tm /resync | w32tm /resync (same utility — elevated; no cmdlet covers resync) |
| Windows edition | winver | Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber |
| Host name | hostname | $env:COMPUTERNAME |
| Trace a path | tracert example.com | Test-NetConnection -ComputerName example.com -TraceRoute |
| Ping with a fixed count | ping -n 4 example.com | Test-Connection -ComputerName example.com -Count 4 \| Select-Object Address, ResponseTime |
| File hash (MD5) | certutil -hashfile C:\temp\disk-usage.log MD5 | Get-FileHash -Path C:\temp\disk-usage.log -Algorithm MD5 \| Select-Object Algorithm, Hash |
| Search text in files | findstr /s /i /m error C:\logs\*.log | Get-ChildItem -Path C:\logs -Filter *.log \| Select-String -Pattern error |
| Who am I | whoami | [System.Security.Principal.WindowsIdentity]::GetCurrent().Name |
| My token's groups | whoami /groups | whoami /groups (same utility — run it from PowerShell) |
| Output to clipboard | ipconfig \| clip | Get-NetIPConfiguration \| Out-String \| Set-Clipboard |
| Read the clipboard | powershell -Command Get-Clipboard | Get-Clipboard |
| Restart now | shutdown /r /t 0 | Restart-Computer -Force |
| Shut down now | shutdown /s /t 0 | Stop-Computer -Force |
| Event log tail | wevtutil qe System /c:20 /rd:true /f:text | Get-WinEvent -LogName System -MaxEvents 20 |
| DNS lookup | nslookup example.com | Resolve-DnsName example.com |
| System information | systeminfo | Get-ComputerInfo |

cmd.exe never uses PowerShell objects: its pipeline passes plain text between commands, and its built-ins (dir, copy, del, findstr) are not cmdlets at all. This is why tasklist | SORT works in cmd but something like Get-Process | Where-Object WorkingSet64 only means something in PowerShell — and why PowerShell's natural filters are property comparisons, while cmd's are text grep (... | findstr :3389). Note that wmic is also retired: Microsoft deprecated the WMI command-line utility as of Windows 10 21H1 and does not ship it in some recent builds, another reason the disk-free row above reads dir or PowerShell instead.

Translation rules that cover 90% of the pairs

- **slash flags vs dash flags:** cmd uses /flag (ipconfig /all); PowerShell uses -Flag. Same utility runs unchanged from PowerShell, but its output stays text there
- **text output -> objects:** netstat -ano is text you grep; Get-NetTCPConnection is objects you filter: -LocalPort 3389, -State Listen
- **System32 utilities:** ipconfig, netstat, w32tm, sfc and shutdown are external programs — they run from PowerShell unchanged
- **cmd help -> PowerShell help:** Get-Help Get-NetTCPConnection -Online opens the reference page; Get-Command -Noun Route lists the cmdlets of a family

## Reading the pairs

### Notes that keep the table honest

- `route add` in cmd persists only with `-p`; `New-NetRoute` persists by default and takes `-InterfaceIndex`, which you get from `Get-NetAdapter`. Both need an elevated prompt.
- `w32tm /query /status` prints NTP source and last-sync fields; add `/verbose` for the full state machine. `w32tm /query /configuration` shows where the config came from — useful after a GPO edit.
- `Get-NetTCPConnection` covers TCP only. UDP sees `Get-NetUDPEndpoint`, and `Get-NetTCPConnection -OwningProcess 18948` is how a PID's sockets are seen from PowerShell.
- `sfc /scannow` is still the file-integrity checker; `DISM /Online /Cleanup-Image /RestoreHealth` is the component-store repair that should run before it when a corrupted store is the root cause.
- `DISM /Online /Cleanup-Image /RestoreHealth` repairs the component store automatically and takes several minutes; on a machine without Windows Update access point it at known-good files from a mounted image — `DISM /Online /Cleanup-Image /RestoreHealth /Source:c:\mount\windows /LimitAccess` — the same /Source and /LimitAccess the documentation shows.
- `Stop-Process` and `Stop-Computer` accept `-WhatIf` previewed before the first real run — the same lever that makes `Restart-Computer -WhatIf` the gentlest way to test a reboot pipeline.

## References

- [Windows commands A–Z](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands) — Microsoft's full cmd.exe command reference.
- [PowerShell documentation](https://learn.microsoft.com/en-us/powershell/) — the modern replacement layer for most tasks in this table.

## FAQ

**Is cmd.exe the same as PowerShell?**

No. cmd.exe is a text-mode command interpreter from the DOS lineage: its pipeline passes strings and its built-ins (dir, copy, del, findstr, sort) are internal commands. PowerShell is an object-oriented scripting runtime: every result is a typed .NET object, so filtering means comparing properties instead of grepping text. cmd.exe is still on every Windows box — but it is the middle-aged tool, PowerShell is the one still growing.

**Can I run PowerShell commands from cmd.exe?**

Yes. cmd.exe accepts PowerShell as an external program: powershell -Command "Get-Process" runs Windows PowerShell 5.1, and pwsh -Command "Get-Process" starts PowerShell 7. For interactive work just launch pwsh.exe or powershell.exe from cmd; for routines, call powershell -ExecutionPolicy Bypass -File your-script.ps1 to skip the ExecutionPolicy inconvenience in a tight loop.

**Why do netstat -ano and Get-NetTCPConnection show different results?**

Because Get-NetTCPConnection is TCP-only: netstat -ano also lists UDP endpoints (and raw sockets), which do not appear at all in the TCP cmdlet. Use Get-NetUDPEndpoint -LocalPort 123 for the UDP half of the picture. netstat output is also static text sorted as-you-like-it; Get-NetTCPConnection lets you filter by state (-State Listen) or owning process (-OwningProcess 18948) before formatting.

**Would the cmd equivalents of del /s /q be better done in PowerShell?**

For one-off cleanup, del /s /q does the job. The PowerShell form Remove-Item -Path C:\temp\*, -Recurse -Force is the safer edge of the same work: try it with -WhatIf to preview, and use -Verbose to see each removal. The difference matters at scale, where object filters (Where-Object LastWriteTime -lt (Get-Date).AddDays(-30)) pick files by property rather than name pattern.

## Related tools

- [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — break any CIDR block into network, range, broadcast and usable hosts.
- [IP range to CIDR](https://itinsighthub.com/ip-range-to-cidr/) — turn an arbitrary address range into its minimal covering CIDR blocks.
- [VLSM calculator](https://itinsighthub.com/vlsm-calculator/) — split a block into right-sized subnets by host requirements.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)