PowerShell and Windows 11 commands

Windows 11 troubleshooting and administration commands, in PowerShell and CMD. Each entry states its risk level: read-only, changes the system, or needs an elevated prompt (administrator).

Filter by category

Commands marked 'Needs admin' must be run in a terminal opened 'as administrator'. Read the description before running a command that changes the system.

Full list

Show all 58 entries

sfc /scannow
sfc /scannow
Checks protected system files and replaces corrupted ones.
```
sfc /scannow
sfc /verifyonly
```

`DISM /RestoreHealth`

DISM /Online /Cleanup-Image /RestoreHealth

Repairs the running Windows image from Windows Update or a source.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess

chkdsk
chkdsk <drive>: [/f] [/r] [/scan]
Checks a volume's file system and fixes errors.
```
chkdsk C: /scan
chkdsk C: /f /r
Repair-Volume -DriveLetter C -Scan
```
systeminfo
systeminfo [/s <computer>]
Shows the Windows version, hardware, memory, installed fixes and domain.
```
systeminfo
systeminfo | findstr /B /C:"Nom de l'hôte" /C:"Nom du système d'exploitation"
```

`Get-ComputerInfo`

Get-ComputerInfo [-Property <list>]

Detailed system information as a PowerShell object.

Get-ComputerInfo -Property WindowsProductName,WindowsVersion,OsBuildNumber,CsTotalPhysicalMemory
(Get-ComputerInfo).OsLastBootUpTime

winver / Get-CimInstance Win32_OperatingSystem
Get-CimInstance Win32_OperatingSystem | Select Caption,Version,BuildNumber
Windows version and build.
```
winver
Get-CimInstance Win32_OperatingSystem | Select Caption,Version,BuildNumber,LastBootUpTime
```
hostname / Rename-Computer
Rename-Computer -NewName <name> -Restart
Shows or changes the machine name.
```
hostname
Rename-Computer -NewName PC-COMPTA-01 -Restart
```
Restart-Computer / shutdown
shutdown /r /t 0 | Restart-Computer -Force
Restarts or shuts down the machine, locally or remotely.
```
shutdown /r /t 60 /c "Redémarrage de maintenance"
shutdown /a
Restart-Computer -ComputerName PC01 -Force
```

`Get-HotFix`

Get-HotFix [-Id <KB>]

Lists installed fixes (KB).

Get-HotFix | Sort-Object InstalledOn -Descending | Select -First 10
Get-HotFix -Id KB5034123

`winget upgrade`

winget upgrade [--all] [--id <id>]

Lists or installs updates for applications managed by winget.

winget upgrade
winget upgrade --all --include-unknown --accept-package-agreements --accept-source-agreements
winget upgrade --id Mozilla.Firefox

`winget install`

winget install <name> | --id <id> [-e] [--silent]

Installs an application from the winget sources.

winget search vscode
winget install --id Microsoft.VisualStudioCode -e --silent
winget uninstall --id Microsoft.VisualStudioCode

Get-WindowsUpdateLog
Get-WindowsUpdateLog [-LogPath <file>]
Generates a readable Windows Update log from the ETL traces.
```
Get-WindowsUpdateLog -LogPath $env:USERPROFILE\Desktop\WindowsUpdate.log
```
usoclient / wuauclt
UsoClient StartScan | StartDownload | StartInstall
Triggers update scan or installation from the command line (not officially documented).
```
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
```

`Get-ChildItem`

Get-ChildItem [-Path <path>] [-Recurse] [-Filter <pattern>] [-Force]

Lists files and folders, optionally recursively.

Get-ChildItem C:\Logs -Recurse -Filter *.log | Where-Object Length -gt 100MB
gci -Force -File | Sort-Object LastWriteTime -Descending | Select -First 10

`Get-Item`

Get-Item <path>

Reads a file, folder or registry key (properties, attributes, dates).

Get-Item C:\Windows\System32\notepad.exe | Select Name,Length,LastWriteTime,VersionInfo
Get-Item HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Get-Content
Get-Content <file> [-Tail <n>] [-Wait]
Reads a text file, including continuous follow (like tail -f).
```
Get-Content C:\Logs\app.log -Tail 50 -Wait
Get-Content liste.txt | Select-String 'erreur'
```

`Select-String`

Select-String -Pattern <regex> -Path <files>

Searches for a pattern in files or a stream (PowerShell grep).

Select-String -Path C:\Logs\*.log -Pattern 'ERROR|FATAL' -CaseSensitive
Get-ChildItem -Recurse *.ps1 | Select-String 'Invoke-Expression'

`robocopy`

robocopy <source> <destination> [files] [options]

Robust folder copy (resume, multithread, mirror, permissions).

robocopy D:\Donnees E:\Sauvegarde /E /COPY:DAT /R:2 /W:5 /MT:16 /LOG:C:\Temp\robocopy.log
robocopy D:\Donnees E:\Sauvegarde /MIR /XD .git /L

Copy-Item / Move-Item / Remove-Item
Copy-Item <source> <destination> [-Recurse]
Copies, moves or deletes files and folders.
```
Copy-Item C:\Src\* D:\Dest -Recurse
Remove-Item C:\Temp\vieux -Recurse -Force -WhatIf
```
icacls
icacls <path> [/grant|/deny|/remove|/reset] [/T]
Shows or changes the NTFS permissions of a file or folder.
```
icacls D:\Partage
icacls D:\Partage /grant "DOMAINE\Groupe":(OI)(CI)M /T
icacls D:\Partage /reset /T
```

`Get-Acl`

Get-Acl <chemin>

Reads the permissions of a file, folder or registry key.

(Get-Acl D:\Partage).Access | Select IdentityReference,FileSystemRights,AccessControlType

`Get-Process`

Get-Process [-Name <name>] [-Id <pid>]

Lists running processes (memory, CPU, path).

Get-Process | Sort-Object WS -Descending | Select -First 10 Name,Id,@{n='MémoireMo';e={[int]($_.WS/1MB)}}
Get-Process -Name chrome | Stop-Process -WhatIf

Stop-Process / taskkill
Stop-Process -Name <name> -Force | taskkill /IM <exe> /F
Terminates a process.
```
Stop-Process -Id 1234 -Force
taskkill /IM notepad.exe /F
taskkill /PID 1234 /T /F
```
tasklist
tasklist [/svc] [/fi "<filter>"]
Lists processes with, optionally, the services they host.
```
tasklist /svc
tasklist /fi "imagename eq svchost.exe" /svc
tasklist /fi "memusage gt 500000"
```

`Get-Service`

Get-Service [-Name <name>]

Lists services and their state.

Get-Service | Where-Object { $_.Status -eq 'Running' -and $_.StartType -eq 'Automatic' }
Get-Service wuauserv,bits | Format-Table Name,Status,StartType

Restart-Service / Set-Service
Restart-Service <name> | Set-Service <name> -StartupType Disabled
Restarts a service or changes its startup type.
```
Restart-Service Spooler -Force
Set-Service -Name wuauserv -StartupType Manual
net stop spooler && net start spooler
```
Get-CimInstance Win32_Process
Get-CimInstance Win32_Process | Select Name,ProcessId,CommandLine
Processes with full command line and parent.
```
Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" | Select ProcessId,ParentProcessId,CommandLine
```
ipconfig
ipconfig [/all] [/release] [/renew] [/flushdns] [/displaydns]
Shows the IP configuration and manages the DNS cache and DHCP lease.
```
ipconfig /all
ipconfig /flushdns
ipconfig /release && ipconfig /renew
```

`Test-NetConnection`

Test-NetConnection <host> [-Port <port>] [-TraceRoute]

Tests connectivity (ping, TCP port, route).

Test-NetConnection google.com -Port 443
Test-NetConnection 10.0.0.1 -TraceRoute
tnc smtp.office365.com -Port 587 -InformationLevel Quiet

`Get-NetAdapter`

Get-NetAdapter [-Name <name>]

Lists network adapters, their state, speed and MAC address.

Get-NetAdapter | Select Name,Status,LinkSpeed,MacAddress
Restart-NetAdapter -Name 'Ethernet'
Disable-NetAdapter -Name 'Wi-Fi' -Confirm:$false

Get-NetIPAddress / Get-NetIPConfiguration
Get-NetIPConfiguration [-Detailed]
IP addresses, gateway and DNS of each interface.
```
Get-NetIPConfiguration
Get-NetIPAddress -AddressFamily IPv4 | Select InterfaceAlias,IPAddress,PrefixLength
```
Resolve-DnsName
Resolve-DnsName <name> [-Type <type>] [-Server <dns>]
Queries DNS (A, MX, TXT, CNAME…) without nslookup.
```
Resolve-DnsName contoso.com -Type MX
Resolve-DnsName contoso.com -Type TXT -Server 1.1.1.1
```

`Get-NetTCPConnection`

Get-NetTCPConnection [-State Listen] [-LocalPort <port>]

TCP connections and listening ports, with the owning process.

Get-NetTCPConnection -State Listen | Select LocalAddress,LocalPort,OwningProcess
Get-Process -Id (Get-NetTCPConnection -LocalPort 443).OwningProcess

`netsh`

netsh <context> <command>

Network configuration tool (Wi-Fi, firewall, proxy, stack reset).

netsh wlan show profiles
netsh wlan show profile name="MonWifi" key=clear
netsh winsock reset
netsh int ip reset
netsh advfirewall show allprofiles

ping / tracert / pathping
ping <host> [-n <count>] [-t] | tracert <host> | pathping <host>
Tests reachability and the network path to a host.
```
ping -n 4 8.8.8.8
ping -t 192.168.1.1
tracert -d contoso.com
pathping -q 10 contoso.com
```

`Get-Disk / Get-Volume`

Get-Disk | Get-Partition | Get-Volume

Physical disks, partitions and volumes (size, free space, health).

Get-Disk | Select Number,FriendlyName,Size,HealthStatus,PartitionStyle
Get-Volume | Select DriveLetter,FileSystemLabel,FileSystem,@{n='LibreGo';e={[math]::Round($_.SizeRemaining/1GB,1)}}

`Get-PhysicalDisk`

Get-PhysicalDisk | Get-StorageReliabilityCounter

Disk health state and reliability counters (simplified SMART).

Get-PhysicalDisk | Select FriendlyName,MediaType,HealthStatus,OperationalStatus
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select Temperature,Wear,ReadErrorsTotal

`cleanmgr / Storage Sense`

cleanmgr /sageset:1 ; cleanmgr /sagerun:1

Disk cleanup driven by a saved profile.

cleanmgr /sageset:1
cleanmgr /sagerun:1
Get-ChildItem $env:TEMP -Recurse -Force | Remove-Item -Recurse -Force -WhatIf

diskpart
diskpart > list disk | select disk <n> | clean | create partition primary
Advanced management of disks and partitions in interactive mode.
```
diskpart
list disk
select disk 1
list partition
```

`Get-LocalUser`

Get-LocalUser [-Name <name>]

Lists local accounts and their state.

Get-LocalUser | Select Name,Enabled,LastLogon,PasswordLastSet
Disable-LocalUser -Name 'invite'
New-LocalUser -Name 'support' -NoPassword

`Add-LocalGroupMember`

Add-LocalGroupMember -Group <group> -Member <account>

Adds an account to a local group (for example Administrators).

Get-LocalGroupMember Administrateurs
Add-LocalGroupMember -Group 'Administrateurs' -Member 'DOMAINE\jdupont'
net localgroup Administrateurs jdupont /add

whoami
whoami [/groups] [/priv] [/all]
Shows the current user, their groups and privileges.
```
whoami
whoami /groups
whoami /priv
```
net user
net user [<account> [<password>] [/add] [/domain]]
Manages local user accounts (or domain accounts with /domain).
```
net user
net user jdupont
net user jdupont /domain
net accounts
```
manage-bde
manage-bde -status | -protectors -get <drive>: | -on <drive>:
BitLocker state and management on the command line.
```
manage-bde -status
manage-bde -protectors -get C:
manage-bde -on C: -RecoveryPassword
```

`Get-BitLockerVolume`

Get-BitLockerVolume [-MountPoint <drive>]

BitLocker encryption state and protectors of each volume.

Get-BitLockerVolume | Select MountPoint,VolumeStatus,ProtectionStatus,EncryptionPercentage
(Get-BitLockerVolume -MountPoint C:).KeyProtector | Where KeyProtectorType -eq RecoveryPassword
BackupToAAD-BitLockerKeyProtector -MountPoint C: -KeyProtectorId '{GUID}'

`Get-MpComputerStatus / Start-MpScan`

Get-MpComputerStatus ; Start-MpScan -ScanType QuickScan

Microsoft Defender Antivirus state and starting a scan.

Get-MpComputerStatus | Select AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated
Update-MpSignature
Start-MpScan -ScanType FullScan

gpupdate
gpupdate [/force] [/target:computer|user]
Applies group policies immediately.
```
gpupdate /force
gpupdate /target:computer /force
```
gpresult
gpresult /r | /h <file.html> [/scope computer|user]
Shows the group policies actually applied to the machine and the user.
```
gpresult /r
gpresult /h C:\Temp\gpo.html /f
gpresult /scope computer /v
```

`Get-NetFirewallRule`

Get-NetFirewallRule [-DisplayName <name>] | New-NetFirewallRule

Lists or creates Windows Defender Firewall rules.

Get-NetFirewallRule -Enabled True -Direction Inbound | Select DisplayName,Action,Profile
New-NetFirewallRule -DisplayName 'Autoriser TCP 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow

Get-ExecutionPolicy / Set-ExecutionPolicy
Get-ExecutionPolicy -List
The PowerShell script execution policy.
```
Get-ExecutionPolicy -List
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
```

`Get-WinEvent`

Get-WinEvent -LogName <log> [-MaxEvents <n>] [-FilterHashtable @{...}]

Reads Windows event logs, with efficient filtering.

Get-WinEvent -LogName System -MaxEvents 20 | Select TimeCreated,Id,LevelDisplayName,Message
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)}
Get-WinEvent -ListLog * | Where RecordCount -gt 0 | Sort RecordCount -Descending | Select -First 10 LogName,RecordCount

`wevtutil`

wevtutil qe <log> /c:<n> /rd:true /f:text

Queries, exports or clears an event log.

wevtutil qe System /c:10 /rd:true /f:text
wevtutil epl Security C:\Temp\security.evtx
wevtutil cl Application

Get-EventLog
Get-EventLog -LogName System -Newest <n>
Old reading of the classic logs (Windows PowerShell 5.1 only).
```
Get-EventLog -LogName Application -EntryType Error -Newest 20
```
Get-CimInstance Win32_ReliabilityRecords
Get-CimInstance Win32_ReliabilityRecords | Select -First 20
Reliability history (crashes, installation failures) as in Reliability Monitor.
```
Get-CimInstance Win32_ReliabilityRecords | Where SourceName -eq 'Application Error' | Select TimeGenerated,ProductName,Message -First 10
```
Reset-ComputerMachinePassword / Test-ComputerSecureChannel
Test-ComputerSecureChannel -Repair -Credential <compte>
Checks and repairs the trust relationship between the machine and the domain.
```
Test-ComputerSecureChannel -Verbose
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
```
dsregcmd /status
dsregcmd /status
State of the Entra ID / hybrid join and of the authentication token (PRT).
```
dsregcmd /status
dsregcmd /status | findstr /i "AzureAdJoined DomainJoined AzureAdPrt"
```
Reset Windows Update (services and cache)
net stop wuauserv, bits ; rename SoftwareDistribution ; net start
Classic procedure when Windows Update stays stuck.
```
net stop wuauserv && net stop bits
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start bits && net start wuauserv
```
powercfg /batteryreport
powercfg /batteryreport | /energy | /requests
Battery report, energy diagnostics, and what prevents sleep.
```
powercfg /batteryreport /output C:\Temp\batterie.html
powercfg /energy
powercfg /requests
powercfg /a
```

Articles

Windows 10 End of Support: Planning the Move to Windows 11

Results

Full list

sfc /scannow

DISM /RestoreHealth

chkdsk

systeminfo

Get-ComputerInfo

winver / Get-CimInstance Win32_OperatingSystem

hostname / Rename-Computer

Restart-Computer / shutdown

Get-HotFix

winget upgrade

winget install

Get-WindowsUpdateLog

usoclient / wuauclt

Get-ChildItem

Get-Item

Get-Content

Select-String

robocopy

Copy-Item / Move-Item / Remove-Item

icacls

Get-Acl

Get-Process

Stop-Process / taskkill

tasklist

Get-Service

Restart-Service / Set-Service

Get-CimInstance Win32_Process

ipconfig

Test-NetConnection

Get-NetAdapter

Get-NetIPAddress / Get-NetIPConfiguration

Resolve-DnsName

Get-NetTCPConnection

netsh

ping / tracert / pathping

Get-Disk / Get-Volume

Get-PhysicalDisk

cleanmgr / Storage Sense

diskpart

Get-LocalUser

Add-LocalGroupMember

whoami

net user

manage-bde

Get-BitLockerVolume

Get-MpComputerStatus / Start-MpScan

gpupdate

gpresult

Get-NetFirewallRule

Get-ExecutionPolicy / Set-ExecutionPolicy

Get-WinEvent

wevtutil

Get-EventLog

Get-CimInstance Win32_ReliabilityRecords

Reset-ComputerMachinePassword / Test-ComputerSecureChannel

dsregcmd /status

Reset Windows Update (services and cache)

powercfg /batteryreport

Going further

Articles

More cheatsheets

Related projects

`sfc /scannow`

`DISM /RestoreHealth`

`chkdsk`

`systeminfo`

`Get-ComputerInfo`

`winver / Get-CimInstance Win32_OperatingSystem`

`hostname / Rename-Computer`

`Restart-Computer / shutdown`

`Get-HotFix`

`winget upgrade`

`winget install`

`Get-WindowsUpdateLog`

`usoclient / wuauclt`

`Get-ChildItem`

`Get-Item`

`Get-Content`

`Select-String`

`robocopy`

`Copy-Item / Move-Item / Remove-Item`

`icacls`

`Get-Acl`

`Get-Process`

`Stop-Process / taskkill`

`tasklist`

`Get-Service`

`Restart-Service / Set-Service`

`Get-CimInstance Win32_Process`

`ipconfig`

`Test-NetConnection`

`Get-NetAdapter`

`Get-NetIPAddress / Get-NetIPConfiguration`

`Resolve-DnsName`

`Get-NetTCPConnection`

`netsh`

`ping / tracert / pathping`

`Get-Disk / Get-Volume`

`Get-PhysicalDisk`

`cleanmgr / Storage Sense`

`diskpart`

`Get-LocalUser`

`Add-LocalGroupMember`

`whoami`

`net user`

`manage-bde`

`Get-BitLockerVolume`

`Get-MpComputerStatus / Start-MpScan`

`gpupdate`

`gpresult`

`Get-NetFirewallRule`

`Get-ExecutionPolicy / Set-ExecutionPolicy`

`Get-WinEvent`

`wevtutil`

`Get-EventLog`

`Get-CimInstance Win32_ReliabilityRecords`

`Reset-ComputerMachinePassword / Test-ComputerSecureChannel`

`dsregcmd /status`

`Reset Windows Update (services and cache)`

`powercfg /batteryreport`