Keep the reference online

Support Twan’s WinFix.

If this reference saved you time, an optional tip helps cover hosting, source review, link checks, and continued maintenance.

Tips are optional and are not tax-deductible charitable contributions. Buy Me a Coffee processes payments on its own site. Twan’s WinFix does not receive or store complete payment-card details.

Buy Me a CoffeeOptional support does not influence editorial conclusions or download placement.

Technician operations reference

Find the relevant Windows reference for the ticket at hand.

Client and Server commands, PowerShell, Registry repair, Microsoft 365 troubleshooting, known issues, and trusted downloads—organized for working technicians.

Search CMD, PowerShell, Server, Registry, and Microsoft 365

76 references shownSource-reviewed Sep 10, 2026

Official sources prioritized Risky actions labeled One-click command copy

Technician coverage

One field reference across the Microsoft stack.

Windows Client

Windows 10 and 11 repair, networking, drivers, deployment, update health, and security.

Windows Server

Server 2016–2025 roles, Active Directory, Group Policy, storage, services, and replication.

PowerShell & Registry

Automation-ready cmdlets plus controlled Registry changes with backup and rollback steps.

Microsoft 365

Identity, activation, Outlook, Teams, Entra registration, licensing, and supported diagnostics.

Command library

Search, filter, copy, run.

Microsoft command reference ↗

Commands are technician references, not guaranteed fixes. Confirm the affected Windows version, understand every switch, preserve backups and recovery material, and test in an appropriate environment before running an elevated, restart-causing, permission-changing, disk, boot, Registry, or service command.

ipconfig /allNetwork

Show full IP, DNS, DHCP, and adapter configuration.

C:\>ipconfig /all

ipconfig /flushdnsNetworkAdmin

Clear the local DNS resolver cache.

C:\>ipconfig /flushdns

pingNetwork

Test whether a host is reachable and measure response time.

C:\>ping 8.8.8.8

tracertNetwork

Trace the network path to a destination.

C:\>tracert microsoft.com

pathpingNetwork

Combine route tracing with packet-loss and latency analysis.

C:\>pathping microsoft.com

nslookupNetwork

Query DNS servers and inspect DNS records.

C:\>nslookup microsoft.com

netstat -anoNetworkAdmin

List active connections, listening ports, and process IDs.

C:\>netstat -ano

getmacNetwork

Display MAC addresses for installed network adapters.

C:\>getmac /v

arp -aNetwork

Display the local ARP cache.

C:\>arp -a

route printNetwork

Display the IPv4 and IPv6 routing tables.

C:\>route print

sfc /scannowRepairAdmin

Scan and repair protected Windows system files.

C:\>sfc /scannow

DISM /Online /Cleanup-Image /RestoreHealthRepairAdmin

Repair the local Windows component store.

C:\>DISM /Online /Cleanup-Image /RestoreHealth

chkdskDiskAdmin

Check a volume for file-system errors.

C:\>chkdsk C: /scan

diskpartDiskAdminCaution

Open the disk and partition administration console.

C:\>diskpart

fsutilDiskAdminCaution

Run advanced file-system and volume operations.

C:\>fsutil fsinfo drives

robocopyFiles

Reliably copy or mirror files and directory trees.

C:\>robocopy C:\Source D:\Backup /E /R:2 /W:2

xcopyFiles

Copy files and directory trees using legacy-compatible switches.

C:\>xcopy C:\Source D:\Backup /E /I

takeownSecurityAdminCaution

Take ownership of a file or directory.

C:\>takeown /F C:\Path /R /D Y

icaclsSecurityAdminCaution

View or modify file and folder permissions.

C:\>icacls C:\Path

cipherSecurityCaution

View or change EFS encryption and securely overwrite free space.

C:\>cipher /c C:\Path\file.txt

whoami /allSecurity

Show the current identity, groups, privileges, and SID.

C:\>whoami /all

systeminfoSystem

Display operating system, hotfix, memory, and hardware details.

C:\>systeminfo

driverquerySystem

List installed drivers and their properties.

C:\>driverquery /v

tasklistProcesses

List running processes.

C:\>tasklist /svc

taskkillProcessesCaution

Stop a process by name or process ID.

C:\>taskkill /IM notepad.exe /F

sc queryServicesAdmin

Query Windows services and driver services.

C:\>sc query type= service state= all

schtasks /querySystem

List scheduled tasks and their status.

C:\>schtasks /query /fo LIST /v

gpresultPolicy

Show the Resultant Set of Policy applied to a user or computer.

C:\>gpresult /r

gpupdate /forcePolicyAdmin

Refresh computer and user Group Policy settings.

C:\>gpupdate /force

wevtutilLogsAdminCaution

Query, export, clear, and configure Windows event logs.

C:\>wevtutil el

findstrFiles

Search files or command output using text or regular expressions.

C:\>findstr /S /I error *.log

whereFiles

Locate executables or files using the current path or a pattern.

C:\>where powershell.exe

dirFiles

List files and folders in a directory.

C:\>dir C:\Windows /a /o:n

treeFiles

Display a directory structure as a text tree.

C:\>tree C:\Projects /F

assocFiles

Show or change file-extension associations.

C:\>assoc .txt

ftypeFiles

Show or change commands associated with registered file types.

C:\>ftype txtfile

setxSystemCaution

Persist an environment variable for future sessions.

C:\>setx TOOL_PATH C:\Tools

shutdownSystemCaution

Shut down, restart, or sign out a local or remote computer.

C:\>shutdown /r /t 60

bcdeditBootAdminCaution

View or modify boot configuration data.

C:\>bcdedit /enum

manage-bdeSecurityAdminCaution

Inspect and administer BitLocker Drive Encryption.

C:\>manage-bde -status

pnputilDriversAdminCaution

Add, remove, export, and enumerate driver packages.

C:\>pnputil /enum-drivers

powercfgSystemAdmin

Inspect power plans, battery reports, and sleep capabilities.

C:\>powercfg /batteryreport

net userAccountsAdminCaution

View and administer local user accounts.

C:\>net user

query userAccounts

Show interactive user sessions on a computer.

C:\>query user

klistSecurity

Display or purge Kerberos tickets.

C:\>klist

certutilSecurityCaution

Inspect certificates, hashes, and certification services data.

C:\>certutil -hashfile installer.exe SHA256

wingetSoftware

Search, install, upgrade, and remove packages with Windows Package Manager.

C:\>winget upgrade --all

Get-NetIPConfigurationPowerShell

Show network adapter, address, gateway, and DNS configuration in PowerShell.

C:\>Get-NetIPConfiguration -Detailed

Test-NetConnectionPowerShell

Test reachability, TCP ports, routes, and name resolution from PowerShell.

C:\>Test-NetConnection server01 -Port 443

Get-WinEventPowerShellAdmin

Query modern Windows event logs with efficient filters.

C:\>Get-WinEvent -LogName System -MaxEvents 50

Get-ServicePowerShell

List and filter Windows services from PowerShell.

C:\>Get-Service | Where-Object Status -eq 'Stopped'

Get-ComputerInfoPowerShell

Collect operating system, firmware, hardware, and update information.

C:\>Get-ComputerInfo

Test-ComputerSecureChannelPowerShellAdminCaution

Test or repair a workstation's trust relationship with its domain.

C:\>Test-ComputerSecureChannel -Verbose

Get-WindowsFeatureServerAdmin

List installed and available Windows Server roles and features.

C:\>Get-WindowsFeature | Where-Object Installed

Install-WindowsFeatureServerAdminCaution

Install Windows Server roles, role services, or features.

C:\>Install-WindowsFeature Web-Server -IncludeManagementTools

dcdiagServerAdmin

Run domain-controller health and Active Directory diagnostic tests.

C:\>dcdiag /v /c /e

repadminServerAdminCaution

Diagnose and administer Active Directory replication.

C:\>repadmin /replsummary

reg queryRegistry

Read Registry keys and values locally or remotely.

C:\>reg query HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion /v ProductName

reg exportRegistryAdmin

Back up a Registry key to a .reg file before making changes.

C:\>reg export HKLM\SOFTWARE\Vendor C:\Backup\Vendor.reg /y

reg addRegistryAdminCaution

Create or modify a Registry key or value.

C:\>reg add HKLM\SOFTWARE\Vendor /v Setting /t REG_DWORD /d 1 /f

dsregcmd /statusMicrosoft 365

Inspect Microsoft Entra join, device registration, SSO, and tenant state.

C:\>dsregcmd /status

GetHelpCmd.exeMicrosoft 365AdminCaution

Run supported Microsoft 365 troubleshooting scenarios from an elevated terminal.

C:\>GetHelpCmd.exe -S ResetOfficeActivation -AcceptEula -CloseOffice

DISM /ScanHealthRepairAdmin

Scan the Windows component store and report whether corruption is repairable.

C:\>DISM /Online /Cleanup-Image /ScanHealth

DISM /CheckHealthRepairAdmin

Report whether the Windows component store is already flagged as corrupted.

C:\>DISM /Online /Cleanup-Image /CheckHealth

repadmin /showrepl CSVServerAdmin

Export forest-wide Active Directory replication status for filtering and review.

C:\>repadmin /showrepl * /csv > showrepl.csv

repadmin to Out-GridViewPowerShellAdmin

Display forest-wide replication status in an interactive PowerShell grid.

C:\>repadmin /showrepl * /csv | ConvertFrom-Csv | Out-GridView

dcdiag /test:CheckSecurityErrorServerAdmin

Check domain-controller security conditions that commonly cause replication access-denied errors.

C:\>dcdiag /test:CheckSecurityError

manage-bde protectorsSecurityAdmin

List BitLocker protectors and protector IDs for the operating-system volume.

C:\>manage-bde -protectors -get C:

BCDBoot UEFI templateBootAdminCaution

Recreate UEFI boot files after verifying the Windows and EFI partition letters in WinRE or WinPE.

C:\>bcdboot C:\Windows /s S: /f UEFI

Reset Office activationMicrosoft 365AdminCaution

Run Microsoft's supported command-line Office activation reset scenario.

C:\>GetHelpCmd.exe -S ResetOfficeActivation -AcceptEula -CloseOffice

Get-WindowsUpdateLogPowerShellAdmin

Merge Windows Update ETL traces into a readable WindowsUpdate.log.

C:\>Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log

Get-MpComputerStatusSecurity

Inspect Microsoft Defender Antivirus mode, engine, signature, and protection status.

C:\>Get-MpComputerStatus | Select AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated

pktmonNetworkAdminCaution

Capture packets and identify local drop reasons with the in-box Packet Monitor.

C:\>pktmon start --capture --pkt-size 0 --file-name C:\Temp\pktmon.etl

w32tm /queryServerAdmin

Inspect Windows Time service status, source, stratum, and synchronization details.

C:\>w32tm /query /status /verbose

winget repairSoftwareCaution

Invoke an installed application’s registered repair operation through Windows Package Manager.

C:\>winget repair --id <PackageId> --exact

dcdiag /test:DNSServerAdmin

Test AD-integrated DNS basics, forwarders, delegation, updates, and record registration.

C:\>dcdiag /test:DNS /e /v

No command found

Try a broader term or choose All categories.

Diagnostic playbooks

Start with a lower-risk documented path.

Confirm scope, preserve rollback, change one variable, and record the result.

System files are corrupt

Low risk

Crashes, missing components, or Windows features failing

Run DISM /Online /Cleanup-Image /RestoreHealth as administrator
Run sfc /scannow
Restart and retest

DNS works intermittently

Low risk

Sites fail by name but network connectivity remains

Run ipconfig /flushdns
Run ipconfig /registerdns
Verify the configured DNS servers with ipconfig /all

Windows Update is failing

Medium risk

Update errors, stalled downloads, or repeated rollback

Check the official Windows release-health page
Run the built-in Windows Update troubleshooter
Repair the component store before resetting update services

A file is locked by an unknown process

Medium risk

Rename, move, or delete reports that the file is in use

Use Microsoft Process Explorer or Handle
Identify the owning process
Close the application or stop the process only after validating impact

Domain trust relationship failed

Medium risk

A workstation reports that its trust relationship with the domain failed

Confirm DNS points to an Active Directory DNS server
Run Test-ComputerSecureChannel -Verbose
Use the -Repair option with approved domain credentials only after validating the computer account

Office activation or sign-in loop

Medium risk

Microsoft 365 Apps repeatedly request sign-in or report activation problems

Check service health and license assignment
Capture dsregcmd /status and confirm Entra registration state
Use Microsoft's supported Get Help activation-reset scenario if identity and licensing are correct

Registry change is required

High risk

A verified vendor or Microsoft fix requires modifying a Registry value

Confirm the exact Windows build and Registry path
Export the affected key before changing it
Record the old value, apply the minimum change, and define a rollback test

Server role state is unclear

Medium risk

A role, feature, or management tool is missing or partially installed

Run Get-WindowsFeature and capture the current state
Confirm prerequisites and source availability
Install only the required feature and include management tools when needed

Copy-ready repairs

Supported commands, with context.

Read the impact note first. Every entry links to Microsoft documentation.

Microsoft documented

Repair Windows image and system files

Use when protected files or Windows components appear damaged.

DISM.exe /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Run in this order from an elevated terminal, then restart and retest.

Microsoft procedure ↗

Microsoft documented

Reset the TCP/IP and DNS client stack

Use after documenting the current adapter, VPN, proxy, and static-IP settings.

netsh winsock reset

netsh int ip reset

ipconfig /release

ipconfig /renew

ipconfig /flushdns

Restart afterward. Network security, VPN, or proxy software may need repair if it stops working.

Microsoft procedure ↗

Microsoft documented

Clear a stuck print queue

Use when jobs remain stuck after normal cancellation and a spooler restart.

net stop spooler

del /Q /F %systemroot%\System32\spool\PRINTERS\*

net start spooler

This removes every queued print job on the computer. Run elevated only after confirming that impact.

Microsoft procedure ↗

Microsoft documented

Capture recent System errors

Create a focused diagnostic view before changing drivers or services.

Get-WinEvent -FilterHashtable @{LogName='System';
                  Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} |
                  Select-Object TimeCreated,Id,ProviderName,Message |
                  Format-List

PowerShell diagnostic only; it does not modify the machine.

Microsoft procedure ↗

Microsoft documented

Repair Windows Update errors 0x800f081f or 0x800f0831

Use when CBS reports missing repair content or component-store corruption.

DISM /Online /Cleanup-Image /ScanHealth

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Run elevated and restart. If DISM cannot find source files, use repair media that matches the installed version, edition, language, and servicing level.

Microsoft procedure ↗

Microsoft documented

Triage an unexpected BitLocker recovery prompt

Match the recovery-key ID and identify the firmware, TPM, boot, docking, or partition change that triggered recovery.

manage-bde -status

manage-bde -protectors -get C:

Do not clear the TPM or alter partitions while the drive is locked. Twan's WinFix does not provide encryption-bypass instructions.

Microsoft procedure ↗

Microsoft documented

Collect forest-wide AD replication health

Start with read-only status collection before forcing synchronization or changing topology.

repadmin /replsummary

repadmin /showrepl * /csv > showrepl.csv

Correlate DNS, Kerberos, time, RPC, network, and event-log health before changing replication topology.

Microsoft procedure ↗

Microsoft documented

Diagnose AD replication error 8453

Use when replication reports that access was denied.

dcdiag /test:CheckSecurityError

repadmin /showrepl * /csv > showrepl.csv

Validate permissions, UAC token state, time, DNS, and authentication before forcing replication.

Microsoft procedure ↗

Microsoft documented

Diagnose Microsoft 365 automatic sign-in failure

Inspect device registration and WAM state before clearing identity data.

dsregcmd /status

Check Entra registration, tenant identity, Primary Refresh Token state, and service health before resetting credentials or profiles.

Microsoft procedure ↗

Microsoft documented

Reset Microsoft 365 Apps activation

Run Microsoft's supported activation reset after identity and licensing checks pass.

GetHelpCmd.exe -S ResetOfficeActivation -AcceptEula
                  -CloseOffice

Close Office applications first. The reset removes cached activation state and requires the user to activate again.

Microsoft procedure ↗

Release 3 documented repair paths

New Microsoft-documented troubleshooting paths.

Reviewed September 10, 2026. Confirm the affected version and read the impact note before making changes.

Microsoft documented

Repair Windows 11 by reinstalling the current version

Use when persistent Windows Update or component problems remain after normal repair steps.

Open Settings > System > Recovery, then select Reinstall now under Fix problems using Windows Update.

Keep the PC powered and online. A restart is required. Apps, files, and settings are preserved, but the option may be unavailable on managed devices.

Microsoft procedure ↗

Microsoft documented

Repair the Microsoft 365 WAM broker package

Use for the documented automatic-authentication failure, Outlook Need Password prompt, or WAM error -2147024809 after running Microsoft's sign-in troubleshooter.

if (-not (Get-AppxPackage Microsoft.AAD.BrokerPlugin)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.AAD.BrokerPlugin

if (-not (Get-AppxPackage Microsoft.Windows.CloudExperienceHost)) { Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown } Get-AppxPackage Microsoft.Windows.CloudExperienceHost

Run elevated, close Microsoft 365 apps first, and use only the command matching the account type. Do not broadly delete credentials or user profiles.

Microsoft procedure ↗

Microsoft documented

Reset OneDrive when synchronization is stuck

Use when OneDrive remains on Processing changes or stops synchronizing.

%localappdata%\Microsoft\OneDrive\OneDrive.exe /reset

The reset does not delete cloud data, but it disconnects sync relationships and triggers a full resync. Restart OneDrive manually and reselect folders if needed.

Microsoft procedure ↗

Microsoft documented

Diagnose SMB access failures after 24H2

Use for access denied, error 5, 0x80070035, or guest-access blocks after moving to Windows 11 24H2 or Server 2025.

net use

Get-SmbConnection

Get-SmbClientConfiguration | Select-Object RequireSecuritySignature,EnableInsecureGuestLogons

These are diagnostic commands. Prefer valid credentials, SMB signing support, and a Kerberos-capable FQDN. Do not disable signing or enable insecure guest logons as a routine fix.

Microsoft procedure ↗

Microsoft documented

Build a readable Windows Update log

Decode ETL traces before resetting services or deleting update caches.

Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log

Run elevated. Add -ForceFlush only when necessary because it temporarily stops Update Orchestrator and Windows Update services.

Microsoft procedure ↗

Microsoft documented

Check Microsoft Defender health without changing policy

Confirm the active/passive mode, real-time protection, engine, and signature age.

Get-MpComputerStatus | Select AMRunningMode,AntivirusEnabled,RealTimeProtectionEnabled,AntivirusSignatureLastUpdated

Read-only diagnostic. A passive result can be expected when another security product or Defender for Endpoint configuration is authoritative.

Microsoft procedure ↗

Microsoft documented

Capture local packet drops with Pktmon

Collect an in-box packet trace and convert it to PCAPNG for deeper analysis.

pktmon filter remove

pktmon start --capture --pkt-size 0 --file-name C:\Temp\pktmon.etl

pktmon stop

pktmon etl2pcap C:\Temp\pktmon.etl --out C:\Temp\pktmon.pcapng

Packet captures can contain credentials, tokens, hostnames, and user traffic. Scope filters narrowly, stop promptly, and protect the output.

Microsoft procedure ↗

Microsoft documented

Repair a registered application with WinGet

Use the package’s configured repair operation before uninstalling or reinstalling it.

winget list --id <PackageId> --exact

winget repair --id <PackageId> --exact

Confirm the exact package ID first. The underlying installer controls whether repair is available and whether elevation or a restart is required.

Microsoft procedure ↗

Compatibility watch

Verified conflicts and known Windows issues.

Status reflects published guidance reviewed September 10, 2026. Re-check the source before field work.

Resolved or mitigated Still investigating Primary-source evidence

inpoutx64 / RGB utilities