Suggestions for new commands and switches

    General discussion

  • An unprioritized list of new commands and command switches that are my wish list for Windows 8 (and next release of WinPE).
    Please make comments and/or additions.



    1. REG
    1.1  reg copy KeyName1 KeyName2 /v ValueName  (copy individual values)
    1.2  reg copy KeyName1 KeyName2 /sec[:only] [/s]  (copy permissions)
    1.3  reg export FullKey /fo reg|text  (export to reg format or text format with timestamps)
    OR   reg dump FullKey /fo reg|text
    1.4  reg 'command' /log:file.log [/tee]  (save output to logfile and optionally display @console also)
    AND  reg 'command' /log+:append.log [/tee]
    1.5  reg hiveinfo FullKey  (get info about hive or regkey)
    OR   reg query FullKey /info
    Note: Includes (hivefile, timestamp, size, class, real key (if redirected), # of subkeys, # of values, security (SDDL))
    1.6  reg query FullKey /v ValueName /info
    Note: Includes (type, valueLength, dataLength, namedValue)
    1.7  reg delete FullKey /va /s  (delete the contents of a key)
    Note: The purpose is to maintain the key with existing permissions.
    1.8  reg dump  (Lists loaded hives from HKLM\System\CurrentControlSet\Control\hivelist)
    1.9  reg query /runonce [/cu | /lm]
    OR   reg dump /runonce [/cu | /lm]  (dumps contents of RunOnce[Ex] keys - CurrentUser, LocalMachine, or both)
    Note: Return Codes: 0 = no values, 1 = values exist, 2 = values exist but AutoLogon account is not a member of Administrators group.
    Note: Important for deployment scenarios to determine if reboot is required (also see #38)
    1.10 reg delete /runonce [/cu | /lm]  (Deletes all values in RunOnce keys)
    Ex:  reg query /runonce || reg delete /runonce


    2. SET
    2.1  set /a 80-bit_number  (x87 precision)
    2.2  set /a "string"  (return length of string)
    Note: If string is purely numeric, return a negative number
    Ex:  set /a "Intel"
    Ex:  set /a "8086"
    Ex:  set /a "%nothing%"
    2.3  'command' | set /p variable  (read from stdin)
    2.4  set /a 0.12 × 0.12 (= 0.0144. Floating point support. h/t jumper)
    2.5  set /a /n/  (absolute value. decimal only. /08/ = decimal 8)


    3. SETX
    3.1  setx var value /v [/u | /m]  (add variable to volatile environment and optionally to user or machine env.)
    3.2  setx var /f filename.ini /b SectionName /n KeyName [/d ","] [/t Token#]  (set var according to inifile key value)
    3.3  setx /v | /u | /m  (display only (all) volatile, user or machine environment variables)


    4. MORE
    4.1  more /a  (auto-scroll)
    Ex:  more /a < test:stream
    Ex:  more /a /e +n  (~tail)
    Ex:  more /a /e -n  (~head)
    4.2  [Page Up]  ("less")


    5.1  iexplore URL /info  (get site/page info including if known phishing site or invalid/expired certificate)


    6. WUSEARCH (New command. Searches Windows Update and returns filtered list of update names and/or URLs)
    6.1  wusearch [/os:WinVerId] [/minsev:L|M|I|C] [/postsp:#] [/platform:%proc_arch%] /type:*,sp,sec,upd,ur,cu,drv,defs,lp,tool [/out:<names|URLs|both>]

    Note: WinVerId ex: 8_x64 (http://msdn.microsoft.com/en-us/library/ff547089(VS.85).aspx)
    Note: URL output is suitable as input to Bitsadmin.exe.


    7. DEFRAG (package for WinPE/RE)
    7.1  defrag Ltr: /w
    /w = indicates Windows installation  (honours %offwindir%\Prefetch\layout.ini)


    8. FINDSTR
    8.1  Unicode support


    9.1  bitsadmin /setTimeStamping ...  (download only if > datetime)

    Note: Based on an equivalent Wget switch.


    10. DEVCON
    10.1  devcon devicetree [higher|lower] <[=class] [<id>...]>  (display devices in tree format)
    10.2  devcon find[all] <[=class] [<id>...]> HW|SW  (display hardware/software only)
    10.3  devcon location <[=class] [<id>...]>  (displays device location details)

        PCI devs: PCIBusNumber, PCIDeviceNumber, PCIFunctionNumber
        Disks   : Path, Target, LUN ID, Location Path
        Other   : string


    11. ROBOCOPY
    11.1  robocopy /con:@log|sumups[:#]  (display summary updates per # seconds and create prefered logging details)
    Note: The @log option is the default and probably redundant.
    11.2  robocopy source dest /ID  (Include the following directories)

    11.3  robocopy source dest /create:hardlink  (Create hardlinks (instead of zero byte files) when using the /create switch)
    Note: Based on the ScanState /hardlink switch. http://technet.microsoft.com/en-us/library/dd560753(WS.10).aspx


    12. Inbox these commands (please)
    12.1  Devcon
    12.2  Filever
    12.3  Sleep
    12.4  Subinacl
    12.5  Err
    12.6  FCIV


    13. SLEEP
    13.1  sleep while|until "\\<Computer>\<Object>(<Instance>)\<Counter>'condition'"
    Ex:   sleep until "\logicalDisk(%SystemDrive%)\%% Idle Time>99"

    Note: Usage scenario - delay restart until system is quiet


    14. FOR
    14.1  for /f "attrib=+|-a[,...] ..." %I in (file-set) do  (define file attributes in for /f loop)
    14.2  for /r <path> /lev:#  (recurse # levels from <path>. h/t jumper)
    14.3  for /f "tokens=* bol=<char>" %I in (file-set) do  (process lines beginning with <char>. h/t jumper)
    14.4  for /f "delims=[RegEx] ..." %I in (file-set) do  (Delimiters based on regular expression (compatible with findstr). h/t jumper)


    15. NET USER
    15.1  net user init[ialize] <username> [password] [/y]  (initialize a user profile as if new user had logged on and immediately logged off)
    Note: See related discussion @ http://forum.sysinternals.com/is-a-single-default-user-optimal_topic24703.html


    16. BOOTSECT
    16.1 bootsect </>DOS8 | GRUB | Grub4Dos | FD16 | NT52 | NT60  <Ltr:>  (Write non-Windows volume boot records)
    16.2 bootsect /file:bootsect.img <Ltr:>  (instead use existing image file, backed-up using dd.exe or similar)

    Note: usage scenario - Windows Setup overwrites non-Windows MBR code. Restore boot capability of non-Windows OS using bootsect and bcdedit.


    17. EXPLORER
    17.1  explorer /e,<path> [/s] /set FolderView=list|details|small|medium|large|thumbs|...  (set folder view on folder or tree)
    17.2  explorer /refresh  (refresh desktop. equivalent to pressing F5)
    Note: Based on this 3rd-party tool http://helgeklein.com/blog/2007/11/free-tool-refresh-the-desktop-programmatically/

    17.3  explorer /e,<path> [/s] /set autoSort=Yes|No
    17.4  explorer /e,<path> [/s] /set autoArrange=Yes|No
    Note: Points 3,4 due to discussion @ http://social.msdn.microsoft.com/Forums/en-US/windowsdeveloperpreviewgeneral/thread/27314d0a-9c70-4b79-93e7-23fe60e7e374

    17.5  explorer /noTaskbar [/icons:<medium | large>]  (disables the taskbar)
    Note: For simple environments that run only one or two main applications. Kiosks, cafes, etc.


    18. START
    18.1  start /si[:winwait] <program.exe> [params]  (single instancing option. optionally wait for window to become active)
    Note: Activates existing instance if <program.exe> is already running image name, else starts new instance. 'Winwait' waits until window is active, but times-out after 10 seconds.
    Note: Return codes: GEQ 0 if new instance, -1 if existing instance and window is non-active, -2 if existing instance is active window.
    18.2  start /elevate  (provokes UAC prompt)
    18.3  start /noconsole  (starts console window hidden)
    Note: Start is an "internal" command, so this switch doesn't make much sense  - you have to open a console window before you can run the 'start' command - a sort of catch-22 if you want a hidden console. Consequently, this switch only makes sense for an "external" command: startx.exe /noconsole ...


    19. COLOR
    19.1  color BF /n  (change color for new lines only)


    20. ECHOX (new command)
    20.1  echox /im | /pid:xxxx[\*] "Hello world [Enter]"  (SendKeys to non-console windows)
    Note: \* = SendKeys to topmost child window and return + errorlevel in not exist.
    Note: complements #18.1

    20.2  echox /f filename.ini /b SectionName [/n KeyName] /v[:#] "Value"  (write value to inifile)
    Note: # = Token
    Note: complements #3.2


    21. SHUTDOWN
    21.1  shutdown /updsys  (shutdown and install WU updates)
    21.2  shutdown /updsys /r  (shutdown and install updates, then restart)
    21.3  shutdown /updsys /r /h (shutdown and install updates, restart, then hibernate)
    21.4  shutdown /online:<away|sleep|wake>  (set 'online' power state)
    Ex:   shutdown /updsys /r /online:sleep


    22. ECHO
    21.1  echo /noeol <string>  (echo without CR/LF)


    23.1  net session /lock  (lock workstation)
    23.2  net session </disableInput|/enableInput>  (block|enable console input)
    23.3  net session <logonId | account | group | *> /info  (display session info)


    24. APPAUDIT (new command)
    24.1  appaudit [/c:#] [/nc] <path>\appMain.exe [params]  (start an app and immediately close it)
    # = number of open-close cycles
    nc= Don't use file system cache (so results aren't biased)
    Note: Return code: Format = 0xFRTLRTEL
        FRT=First Run Time (FR.T seconds)
        LRT=Last Run Time (LR.T seconds)

    24.2  appaudit /clr [<path>\appMain.exe [params]]  (clear Prefetch data & Superfetch cache - per app or system-wide)

    Note: For deployment testing scenarios or prefetch re/building


    25. MCSTATE (new command)
    25.1  mcstate -b|-r -f mediactr.export  (backup and restore Media Center state)


    26. DATE and TIME
    26.1  date /t /fo:intl  (display date and time
    26.2  time /t /fo:iso    in ISO8601 format)
    26.3  date /t /fo:"timezone name"
    26.4  date /t /fo:<culture>  (ex: en-US)
    26.5  time /t /fo:gmt+|-HH:MM


    27. PROMPT
    27.1  $R  (return to prompt time)
    Note: Purpose is to time command duration - from [Enter] to redisplay of cursor
    C:\Windows\system32>prompt $P$L$R$G
    C:\Windows\system32<00:00.00>dir /s %windir% [Enter]
    27.2  $X  ("full screen prompt" - tree view with navigation)
    Note: Like tree command but dynamically updates console after keystrokes Up,Down,Shift-Left,Shift-Right,Page_Up,Page_Down,Home,End.
    Note: When a command is executed, an implicit 'cls' occurs. After command is executed, cursor displays on new line - an implicit 'pause > nul'. Press any key to return to prompt.
    C:\Windows\system32>prompt $X$_$P$G
    tree  (n-2 screen lines)
    C:\Windows\system32>command [Enter]
    _ [Enter]
    tree  (n-2 screen lines)


    28. NET PROFILE (new command)
    28.1  net profile <username> [/folders:<path>\<username>.folders.txt [format=<reg|CLSID|FOLDERID>] [/u[#]=B|KB|MB|GB|TB|c[,|!]]  (display data about a users profile)
    Note: Includes (createTime, initTime (n/a if never logged-on), path, size, NTUSER.dat size, fileCount, avgFileSize, status, type (local|roaming|mandatory|temporary), etc)

    28.2  net profile  (List profiles under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' with ProfileImagePath, plus Default,ProfilesDirectory,ProgramData,Public)


    29. VERX (new command)
    29.1 http://forum.sysinternals.com/extended-ver-command_topic23137.html


    30.1  PlatformId
    30.2  VerMajor
    30.3  VerMinor
    30.4  BuildNumber
    Ex:   echo %PlatformId%:%VerMajor%.%VerMinor%.%BuildNumber%
    30.5  ProfilesDirectory
    Ex:   D:\Users


    31. BEEP (new command)
    31.1  beep [milliseconds]


    32. CMD
    32.1 cmd /n  (open new console tab)
    Ex:  cmd /n /c defrag /c


    33. DIR
    33.1  dir /i  (ISO date/time format)
    33.2  dir /f  (no footer)
    33.3  dir /h  (no header)
    33.4  dir /u[#]:<B|K|M|G|c>[,]  (file size units)
    Note: # = decimal places. /u = Bytes,KB,MB,GB,clusters. , = thousands separator
    33.5  dir /drvTypes:<F[ixed],R[emovable],N[etwork],O[ptical],A[ll] [path]
    Note: -  Prefix meaning not
    Note: 'dir /f /h <path>' is probably too similar to 'where /T <path>:*' to be worth doing (but see reply below)


    34. WHERE
    34.1  where /s:f|r|n|o|*  (specify fixed, removable, network, optical, or all drives)

    Note: Seperate multiple drive types with comma. -  Prefix meaning not.


    35. DRVSPACE (new command)
    35.1  drvspace Ltr:|Volume{GUID} [/free|/used] [/u[#]=B|KB|MB|GB|TB|c[,|!]]  (Displays drive free and/or used space, determined from $BITMAP)

    Note: # = decimal places. , = thousands separator. ! = don't display units.


    36. DISPLAY (new command)
    36.1  display [Xres Yres [Zres]] [/modes] [/native | /max] [/array:<name>] [/mag:<100|125|150 [/LM]]  (sets or lists displays resolution, refresh rate, DPI)


    37. VOL
    37.1  vol [drive: | label:] [/nv]  (specify volume by driveLetter or driveLabel)

    Ex:   vol UserData:
          Volume with UserData label is drive D
          Volume Serial Number is CA41-89E6
    Ex:   vol UFD_WinPE: /nv
    Ex:   vol F: /nv

    Note: /nv switch means 'non-verbose' - only display Letter:|Label:|[None]
    Note: A single letter before the colon is regarded as a drive - more than one character is regarded as a label.
    Note: By using 'vol label: /nv' in 'for /F' loops, user can script file operations without having to be concerned about changing drive letters (or Volume{GUIDs}) - especially across machines.


    38. MOVE
    38.1  move /dur [drive:][path]filename1[,...] <destination | "">  (implements 'MOVEFILE_DELAY_UNTIL_REBOOT')
    Note: "" = Delete
    38.2  move /dur /t  (lists pending rename/delete values stored in 'HKLM\System\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations[2]')
    Note: Return Codes: 1 = Pending file rename operations exist, 0 = none

    Note: Important for deployment scenarios to determine if reboot is required. (also see #1.9)
    Note: Copies the functionality of Sysinternals MoveFile and PendMoves utilities http://technet.microsoft.com/en-us/sysinternals/bb897556 


    39.  BCDEDIT
    39.1  bcdedit /typemenu  (display the boot menu without rebooting!)
    39.2  bcdedit /displayorder [/toolsdisplayorder] /list

    39.3  bcdedit /tree [/name:<filename>] [/v]  (display inheritance tree and boot entries)
    Note: /v switch includes values
    39.4  bcdedit /tree /fo:<txt | png | svg> /name:<filename> [/v] 


    40. RENAME (REN)
    40.1  rename [drive:][path]filename1 [filename2 [filename3 [...]]] filename.ext  (new filename and extension)
          rename [drive:][path]filename1 [filename2 [filename3 [...]]] newFilename.*  (keep existing extensions)
          rename [drive:][path]filename1 [filename2 [filename3 [...]]] *.newExtension  (keep existing filenames)
    Note: 'filename<1-N> can include wildcards.
    Note: The 'controversy' over auto-sort/arrange in Windows Explorer could partially be resolved by providing an improved rename command that can handle wildcards and multiple source files. http://social.msdn.microsoft.com/Forums/en-US/windowsdeveloperpreviewgeneral/thread/27314d0a-9c70-4b79-93e7-23fe60e7e374


    More to come...


    • Edited by Drewfus Wednesday, January 11, 2012 12:39 AM
    Tuesday, September 27, 2011 11:25 AM

All replies

  • what is the chanse somebody to take this seriosly??


    in addition to start command - start /hidden any.exe  - which will start the process in background .There are a lot third party replacements of start command that support this.

    and to title  - title /get  - which should return the title of the console.
    • Edited by npocmaka__ Friday, September 30, 2011 6:14 PM
    Friday, September 30, 2011 6:07 PM
  • "what is the chanse somebody to take this seriosly??"

    The more people who view and comment in this thread, the more seriously it will be taken.


    start /hidden any.exe - which will start the process in background

    I like this, and i was planning on adding something similar to my list. IMO the best two options of the excellent hstart.exe are the ability to run the console invisible (invisibly?), and the option to trigger the UAC prompt, when an elevated cmd window is required. I'll sugggest these switches;

    start /noconsole

    start /elevate


    title /get - which should return the title of the console

    Why would this be useful?


    • Edited by Drewfus Saturday, October 01, 2011 1:32 AM
    Saturday, October 01, 2011 12:41 AM
  • Oooh... There are cases where this can be useful.Especialy if it's parametrized or dynamically set by user .In case you need such thing try this ->



    Oooh and one more thing. At current windows versions is totaly imposible to disable IPv4 or IPv6 stacks via command line.Really annoying.

    May be something line:


    netsh interface ipv6 disable

    will be useful



    Saturday, October 01, 2011 7:34 PM
  • @tonglee: netsh interface ipv6 disable

    Interesting. I occasionally have to set a default gateway to localhost address to prevent communication outside subnet, but never had to disable TCP/IP. In what scenarios would you use this?


    @ http://blogs.msdn.com/b/b8/archive/2011/08/29/improvements-in-windows-explorer.aspx?PageIndex=2#10213568 commenter Paul Mirams makes following request: "Please allow a feature to export the list of files/folders to a spreadsheet or other external tool. Allow options to include file/folder attributes in the columns by selecting from a list of them"

    This might form a command like;

    dir [/F] [/H] /FO:CSV /A:DHSLRAIE "<path>" 1>folderName.xlsx

    Does redirecting directory listing to CSV format sound like a useful option?


    Sunday, October 02, 2011 1:44 PM
  • 22. ECHO
    21.1  echo /noeol <string>  (echo without CR/LF)

    There are several (hacky?) ways to do this already, off the top of my head you can do:

    echo.|set /p dummy=hello world

    Wednesday, January 25, 2012 12:38 AM