Windows commands with purpose and boundaries.
Know what a command is for, what it can change, and when it does not belong in the troubleshooting path.
SFC
sfc /scannowScan protected Windows system files and replace incorrect versions when possible.
Medium riskDISM RestoreHealth
DISM.exe /Online /Cleanup-Image /RestoreHealthScan the running Windows image for component-store corruption and perform repair operations.
Low riskDISM ScanHealth
DISM.exe /Online /Cleanup-Image /ScanHealthScan the Windows component image for corruption without running the RestoreHealth repair operation.
Medium riskCHKDSK
chkdsk C: /scanCheck a local file system/volume for errors. Repair switches such as /f or /r change the operation and can require downtime.
Low riskIPCONFIG FlushDNS
ipconfig /flushdnsClear the DNS client resolver cache on Windows.
Low riskIPCONFIG Release / Renew
ipconfig /release
ipconfig /renewRelease the current DHCP lease and request a new IP configuration from the network.
Medium riskNETSH Winsock Reset
netsh winsock resetReset the Winsock catalog used by Windows networking applications.
Medium riskNETSH TCP/IP Reset
netsh int ip resetReset TCP/IP configuration state as part of deeper Windows network repair.
Low riskWSReset
wsreset.exeReset the Microsoft Store cache and reopen Microsoft Store.
Low riskMSINFO32
msinfo32Open Microsoft System Information to inspect hardware, system components, drivers and the software environment for diagnosis.
Low riskPnPUtil — enumerate problem devices
pnputil /enum-devices /problemList Plug and Play devices that currently report a problem code without modifying their drivers.
Low riskPnPUtil — scan devices
pnputil /scan-devicesAsk Plug and Play to scan the system for device hardware changes.
Low riskwinver — Windows version and OS build
winverDisplay the installed Windows version and OS build so update/KB guidance can be matched to the actual system.
Low riskIPCONFIG /all
ipconfig /allDisplay full TCP/IP configuration for all adapters, including addressing information useful for DHCP, gateway and DNS diagnosis.
Low riskNSLOOKUP
nslookup example.comQuery DNS name-resolution information so a hostname failure can be distinguished from general IP connectivity problems.
Low riskPING
ping <targetname>Test IP-level reachability and round-trip responses to a TCP/IP host; comparing a hostname with an IP can also provide name-resolution clues.
Low riskTRACERT
tracert <targetname>Trace the IP path toward a destination using increasing TTL values, providing hop/latency clues without changing network settings.
Low riskReliability Monitor
perfmon /relOpen Reliability Monitor to review a time-oriented history of Windows reliability events and repeated application/system failures.
Low riskWindows Memory Diagnostic
mdschedSchedule the built-in Windows memory test, which restarts the PC and tests system memory before Windows loads normally again.
Low riskWEVTUTIL — query recent Event ID 41 records
wevtutil qe System /q:"*[System[(EventID=41)]]" /c:5 /rd:true /f:textRead recent matching events from the Windows System log without changing or clearing the log.
Low riskGet-Disk
Get-DiskList disks visible to the Windows Storage subsystem so physical disk detection/status can be separated from File Explorer or drive-letter problems.
Low riskGet-Volume
Get-VolumeList Windows volume objects, including drive letter, file system, health status and free/total size where available.
Low riskGet-PhysicalDisk
Get-PhysicalDiskList PhysicalDisk objects visible through Windows Storage providers, including operational and health status fields.
Low riskGet-StorageReliabilityCounter
Get-PhysicalDisk | Get-StorageReliabilityCounterRead reliability counters exposed by supported disks/providers, including fields such as temperature, errors, wear and time in use.
Low riskGet-Service
Get-ServiceList Windows service objects and their current status; specific service names can be queried and required/dependent services can also be inspected.
Low riskSC Query
sc.exe query <ServiceName>Display status and service-control information for a named Windows service or driver service.
Low riskGet-WinEvent — Service Control Manager
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; StartTime=(Get-Date).AddHours(-24)}Read recent Service Control Manager events efficiently from the System log so service-start/dependency/crash timing can be correlated.
Low riskGet-WinEvent — storage timeout/retry events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=129,153,157; StartTime=(Get-Date).AddDays(-7)}Read recent storage reset, I/O retry and surprise-removal events to establish whether a storage-path problem is repeating and when it occurs.
Medium riskSystem Configuration (MSConfig)
msconfigOpen System Configuration, including the service/startup controls Microsoft uses in its clean-boot troubleshooting procedure.
Low riskTask Manager — Analyze wait chain
Task Manager > Details > right-click process > Analyze wait chainDisplay whether a running process is waiting on another process or resource, which can help explain a Not responding state without modifying Windows configuration.
Low riskTask Manager — Create memory dump file
Task Manager > Processes/Details > right-click process > Create memory dump fileCapture a memory dump of one user-mode process so its state can be analyzed or provided to a support vendor without deliberately crashing Windows.
Low riskGet-WinEvent — Application Hang
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1002; StartTime=(Get-Date).AddDays(-7)}Read recent Application Hang Event ID 1002 records to establish which process hung and when before correlating WER, Reliability Monitor or wait-chain evidence.
Low riskPowerShell — list WER report archive
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportArchive" -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name,LastWriteTimeList recent Windows Error Reporting archive directories so report timing can be correlated with an application crash or hang without deleting or changing the reports.
Low riskPowerShell — read CrashControl settings
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' | Select-Object CrashDumpEnabled,DumpFile,MinidumpDir,OverwriteRead the main Windows crash-dump configuration values without changing them, useful when a real bugcheck is not producing the expected dump file.
Low riskmsiexec — install MSI with verbose log
msiexec.exe /i "C:\Path\Application.msi" /L*V "%USERPROFILE%\Desktop\msi-install.log"Run one MSI installation attempt while writing a verbose Windows Installer log that can be correlated with the exact failure code and provided to the software publisher or IT.
Low riskwinget list — identify an installed app
winget list "App name"List matching installed applications, package IDs and versions before attempting an exact repair, upgrade or uninstall operation.
Medium riskwinget repair — repair one exact package
winget repair --id <Package.Id> -eInvoke the registered repair operation for one exact package when that package/installer supports repair.
Medium riskwinget upgrade — update one exact package
winget upgrade --id <Package.Id> -eUpgrade one verified installed package to an available newer version while keeping the operation scoped to that exact package ID.
Low riskGet-AppxLog — read one AppX/MSIX deployment ActivityId
Get-AppxLog -ActivityId <ActivityId>Read the package-deployment log associated with the ActivityId returned by a failed Add-AppxPackage or Remove-AppxPackage operation.
Low riskGet-AppxPackage — inspect one installed package
Get-AppxPackage -Name "<PackageName>"Read the installed AppX/MSIX package identity/version for the current user without modifying the package.