30 Essential Windows CMD Commands for Cybersecurity and Networking

30 Essential Windows CMD Commands for Cybersecurity and Networking

If you work in IT, networking, system administration, or cybersecurity, the Windows Command Prompt (CMD) is one of the most useful tools you can have in your toolkit.

You don’t always need expensive security software or third-party utilities to perform basic network troubleshooting and security investigations. Windows includes many built-in commands that can help you understand your network, inspect active connections, identify running processes, investigate persistence mechanisms, and troubleshoot connectivity problems.

In this guide, we’ll explore 30 essential CMD commands that every aspiring cybersecurity and networking professional should know.

Important: Some commands reveal sensitive information or modify system configuration. Use them only on computers and networks you own or are authorized to administer. In particular, the final firewall command changes a security control and should only be used in a controlled troubleshooting scenario.

1. NETSH WLAN SHOW PROFILES

This command displays the wireless network profiles saved on the Windows computer.

netsh wlan show profiles

It can show SSIDs for Wi-Fi networks the computer has previously connected to.

Why it’s useful

Network administrators can use it to identify saved wireless profiles when troubleshooting Wi-Fi connectivity or auditing a workstation.

2. NETSH WLAN SHOW PROFILE ... KEY=CLEAR

If you are authorized to administer the computer and need to recover a saved Wi-Fi password, you can inspect a specific wireless profile.

netsh wlan show profile name="MT LINK" key=clear

Look for the Key Content field in the output.

Replace MT LINK with the actual wireless profile name.

Security lesson

Saved Wi-Fi credentials should be treated as sensitive information. Don’t use this command to retrieve passwords from systems or networks you aren’t authorized to access.

3. IPCONFIG /ALL

One of the most important Windows networking commands:

ipconfig /all

It provides detailed information about network adapters, including:

• IPv4 and IPv6 addresses
• MAC addresses
• Default gateway
• DNS servers
• DHCP configuration
• DHCP lease information
• Adapter status

Why it’s useful

When troubleshooting “no internet,” DNS, DHCP, or IP-address problems, ipconfig /all should usually be one of your first commands.

4. NETSTAT -ANO

netstat -ano

This displays active network connections and listening ports.

The -o option adds the Process ID (PID) associated with each connection.

Cybersecurity use

You can use the PID to investigate which process is responsible for an unexpected network connection.

For example:

tasklist /fi "PID eq 1234"

This can help connect a suspicious network connection to the application generating it.

An unfamiliar connection is not automatically malware. Always investigate before drawing conclusions.

5. NETSTAT -R

netstat -r

This displays the computer’s local routing table.

The routing table determines where network traffic is sent.

Why it’s useful

It can help you understand:

• Default routes
• Network interfaces
• Local networks
• Gateway configuration
• How Windows decides where packets should go

6. NSLOOKUP

For example:

nslookup google.com

nslookup queries DNS servers to resolve domain names into IP addresses.

It can also be used to investigate DNS records such as mail-server records.

Cybersecurity use

DNS investigation is an important part of network troubleshooting and security analysis.

If a domain doesn’t resolve correctly, nslookup can help determine whether the problem is related to DNS.

7. ARP -A

arp -a

This displays the local ARP cache.

ARP maps IPv4 addresses to MAC addresses on local networks.

Why it’s useful

It can help you identify devices that the computer has recently communicated with on the local network.

Network administrators can use ARP information during troubleshooting and basic network investigations.

8. GETMAC -V

getmac -v

This displays detailed information about the MAC addresses associated with network adapters.

Why it’s useful

MAC addresses are useful when:

• Identifying network interfaces
• Troubleshooting adapter problems
• Documenting network hardware
• Investigating network configuration

9. TRACERT

tracert google.com

tracert traces the route packets take toward a destination.

It displays the intermediate network hops between your computer and the destination.

Example use

If a website is unreachable, tracert can help determine where communication appears to stop or experience delays.

10. NBTSTAT -R

nbtstat -R

This command purges and reloads the NetBIOS remote name cache.

Why it’s useful

It can help troubleshoot older Windows environments that rely on NetBIOS name resolution.

NetBIOS is less central to modern Windows networking than it once was, but understanding these commands is still valuable for legacy environments.

11. NBTSTAT -S

nbtstat -S

This displays current NetBIOS sessions and their associated remote addresses.

Cybersecurity relevance

It can provide additional information when investigating legacy Windows network communication.

12. NETSTAT -F

netstat -f

This displays fully qualified domain names for foreign addresses where possible.

Instead of seeing only an IP address, Windows may attempt to display the corresponding hostname.

Why it’s useful

This can make network-connection analysis easier because hostnames can sometimes provide more context than raw IP addresses.

13. NET VIEW

net view

This command attempts to display computers and shared resources visible on the network.

Networking use

It can be useful in Windows environments for discovering available network computers and resources, although modern network discovery and security configurations may limit the results.

14. NET SHARE

net share

This displays the shared resources hosted by the local Windows computer.

Cybersecurity use

It can help administrators identify unnecessary network shares that could expose files or resources to other users.

15. IPCONFIG /DISPLAYDNS

ipconfig /displaydns

This displays the local DNS resolver cache.

The cache can contain recently resolved domain names and other DNS information.

Why it’s useful

During troubleshooting or incident investigation, the DNS cache can provide clues about domains that the computer recently attempted to resolve.

However, it should not be treated as a complete browsing history.

16. IPCONFIG /FLUSHDNS

ipconfig /flushdns

This clears the local DNS resolver cache.

When to use it

It can help resolve problems caused by outdated or incorrect DNS information.

For example, if a website’s IP address has changed but your computer is still using an old cached record, flushing the DNS cache may help.

17. WMIC STARTUP

wmic startup get caption,command

This displays programs configured to start automatically with Windows.

Cybersecurity use

Attackers can sometimes establish persistence by configuring malicious programs to launch automatically.

Therefore, reviewing startup entries can be useful during malware investigations.

Note: WMIC is deprecated in modern Windows versions. On newer systems, PowerShell and other built-in management tools are generally preferred.

18. QWINSTA

qwinsta

This displays information about terminal services and remote desktop sessions.

Why it’s useful

Administrators can use it to identify active sessions and investigate unexpected remote connections.

If you discover an unfamiliar session, investigate the account, source, and activity before taking action.

19. TASKLIST /FI

tasklist /fi "status eq running"

This filters the process list and displays running processes.

You can also simply use:

tasklist

Cybersecurity use

Process enumeration is an important part of incident response.

You can investigate:

• Unknown processes
• Suspicious applications
• Resource-intensive programs
• Processes associated with suspicious network connections

20. WMIC PROCESS

wmic process get name,executablepath

This displays running process names and their executable paths.

Why the executable path matters

Two processes can have similar names while being located in completely different directories.

For example, malware may attempt to use a legitimate-looking process name while running from an unusual location.

Again, WMIC is deprecated on current Windows releases, so modern PowerShell alternatives are preferable where available.

21. DRIVERQUERY -V

driverquery -v

This displays detailed information about installed device drivers.

Cybersecurity relevance

Drivers operate close to the Windows kernel and therefore deserve attention during deeper system investigations.

Unexpected or suspicious drivers may warrant further investigation.

However, the presence of an unfamiliar driver alone does not prove that a rootkit or malware is present.

22. ROUTE PRINT

route print

This displays the IPv4 and IPv6 routing tables and interface information.

Why it’s useful

route print is particularly useful when diagnosing:

• Multiple network interfaces
• VPN routing
• Incorrect gateways
• Static routes
• IPv4/IPv6 routing problems

23. NBTSTAT -N

nbtstat -n

This displays local NetBIOS names registered by the computer.

Why it’s useful

It can provide information about the computer’s NetBIOS identity and local network configuration in environments where NetBIOS is enabled.

24. NBTSTAT -C

nbtstat -c

This displays the NetBIOS name cache.

The cache contains information about recently resolved NetBIOS names.

Networking use

This can help administrators investigate legacy Windows network-name resolution.

25. NETSH WLAN SHOW INTERFACES

netsh wlan show interfaces

This provides detailed information about the current Wi-Fi connection.

You can see information such as:

• SSID
• Connection state
• Radio type
• Authentication
• Signal strength
• Channel
• Receive/transmit rates

Why it’s useful

It’s an excellent command for diagnosing wireless connectivity and signal-quality problems.

26. NETSH ADVFIREWALL SHOW ALLPROFILES

netsh advfirewall show allprofiles

This displays Windows Firewall configuration for the available network profiles.

You can inspect profiles such as:

• Domain
• Private
• Public

Cybersecurity use

This is useful for verifying whether Windows Firewall is enabled and reviewing its configuration.

27. WHOAMI

whoami

This displays the currently logged-in user.

For example, it can show the account and domain associated with the current session.

Why it’s useful

When working on multiple systems or remote sessions, whoami quickly confirms which identity you’re currently using.

28. WHOAMI /PRIV

whoami /priv

This displays the security privileges assigned to the current user token.

Cybersecurity relevance

It can help administrators and security professionals determine what privileged operations the current session may be permitted to perform.

This is particularly useful when auditing permissions and investigating privilege-related security issues.

29. NETSH ADVFIREWALL SET ALLPROFILES STATE OFF

netsh advfirewall set allprofiles state off

This command disables Windows Firewall across all network profiles.

⚠️ Use with extreme caution

Although this command can be useful in a controlled troubleshooting environment, you generally should not disable the Windows Firewall simply to solve a connectivity problem.

Turning off the firewall removes an important host-based security control and can expose the computer to unwanted network traffic.

If you must temporarily disable it during authorized troubleshooting, document the change and re-enable it immediately afterward:

netsh advfirewall set allprofiles state on

A better troubleshooting approach is usually to identify and modify the specific firewall rule causing the problem rather than disabling the entire firewall.

30. Putting the Commands Together

The real power of these commands comes from combining them during an investigation.

Imagine that you suspect a Windows computer has unusual network activity.

You could begin with:

ipconfig /all

to understand the system’s network configuration.

Then:

netstat -ano

to identify active connections and their PIDs.

Next:

tasklist

to determine which processes are running.

You could then investigate a suspicious PID and examine its executable path using process information.

You might also check:

ipconfig /displaydns

for recently resolved DNS entries and:

arp -a

for local network neighbors.

Finally, you could inspect:

whoami
whoami /priv

to understand the privileges of the current session.

This demonstrates an important cybersecurity principle:

Don’t rely on a single command to determine whether a system is compromised. Correlate multiple sources of evidence.

CMD Is More Than a Troubleshooting Tool

Learning these commands is not about memorizing a list of commands just for an examination.

The bigger goal is understanding what the operating system is telling you.

For cybersecurity professionals, commands such as netstat, tasklist, ipconfig, arp, route, whoami, and driverquery can provide valuable visibility into the system.

For network engineers, commands such as ipconfig, tracert, nslookup, arp, route, and netsh wlan are powerful troubleshooting tools.

And for IT support professionals, these commands can dramatically reduce the time required to diagnose common Windows and networking problems.

Final Thoughts

The Windows Command Prompt remains a valuable tool for anyone pursuing a career in IT support, networking, system administration, cybersecurity, or incident response.

You don’t need to start with hundreds of commands.

Start by mastering these 30.

Understand what each command does, learn how to interpret its output, and, most importantly, practice them in a safe lab environment.

As your skills improve, move beyond simply running commands. Learn to correlate evidence, identify anomalies, understand normal system behavior, and determine when something genuinely requires further investigation.

That’s where CMD stops being just a command-line interface and becomes a practical cybersecurity investigation tool.

Which of these commands do you use most often? Let me know in the comments.