Enterprise Windows Administration Cheatsheet

Usage: Opens Network Connections control panel applet directly to configure IP properties, DNS servers, and network adapters.

Usage: Used to change Computer Hostname, join or unjoin Active Directory Domain, and manage Environment Variables.

Usage: Manages background Windows service startup types (Automatic, Manual, Disabled) and service state execution (Start/Stop/Restart).

Usage: Primary RSAT tool for managing domain users, resetting passwords, unlocking accounts, managing groups, and moving OUs.

Usage: Inspects physical hardware status, updates or rolls back drivers, and diagnoses missing hardware driver code errors.

Usage: Initializes new physical drives, creates/formats partitions (NTFS/ReFS), assigns drive letters, and extends volumes.

Usage: Inspects System, Application, and Security diagnostic event logs generated by Windows OS and services.

Usage: gpedit.msc modifies local machine policy; gpmc.msc manages domain-wide Group Policy Objects linked across OUs.

Usage: Legacy Control Panel applet to uninstall software, repair installations, and view installed updates.

Usage: Consolidated console bundling Task Scheduler, Event Viewer, Shared Folders, Local Users & Groups, Device Manager, and Disk Management.

Command & Usage:

sfc /scannow

Scans protected Windows system files and replaces corrupted binaries using clean cached copies.

Command & Usage:

DISM /Online /Cleanup-Image /RestoreHealth

Repairs the Windows Component Store (WinSxS) image using online Windows Update sources prior to running SFC.

Command & Usage:

ipconfig /all
ipconfig /flushdns
ipconfig /release && ipconfig /renew

Displays detailed adapter settings, clears local DNS resolver cache, and requests a fresh DHCP IP lease.

Command & Usage:

chkdsk C: /f /r

Fixes disk volume file system errors (`/f`) and locates physical bad sectors, recovering readable data (`/r`).

Command & Usage:

netsh winsock reset && netsh int ip reset

Resets the Windows TCP/IP network stack back to clean default settings to resolve corrupted socket connection loops.

Command & Usage:

net user username newpassword /add
net localgroup Administrators username /add

Creates a new local user account and elevates account membership into local Administrators group.

Cmdlet Syntax:

Test-NetConnection -ComputerName "Server01" -Port 445

Evaluates IP routing and tests if target TCP port (e.g. 445 SMB, 3389 RDP, 88 Kerberos) is open across firewalls.

Cmdlet Syntax:

gpupdate /force

Forces an immediate re-evaluation and application of Computer and User Group Policy Objects from Domain Controllers.

Cmdlet Syntax:

Get-ADUser -Identity "username" -Properties *
Unlock-ADAccount -Identity "username"

Queries detailed AD user attributes and immediately unlocks a locked domain user account.

Cmdlet Syntax:

Invoke-Command -ComputerName "Server01", "Server02" -ScriptBlock { Get-Service wuauserv }

Executes PowerShell script blocks on remote target systems over WinRM (Port 5985/5986) simultaneously.

Cmdlet Syntax:

Test-ComputerSecureChannel -Repair

Tests and repairs broken secure channel trust relationship between a domain workstation and the Domain Controller.

Event Context: Logs successful account authentication. Inspect Logon Type (Type 2 = Interactive, Type 3 = Network, Type 10 = RDP).

Event Context: Logs failed login attempts. Key error codes: 0xC000006A (Bad Password), 0xC0000234 (Account Locked).

Event Context: Triggers when an account hits bad password threshold limits. Inspect Caller Computer Name field to locate old cached credentials.

Event Context: Logs creation of new Windows background services. Used to detect software installs, remote execution tools (PsExec), or rootkits.

Event Context: Logged in Application Log when a program crashes (`1000`) or hangs (`1002`). Identifies faulting module DLL paths.