The Command Line¶
Most settings can be read and changed faster from a command prompt than from a dialog. More important, reading a value back is the only way to be sure a change took. Dialogs sometimes show what you clicked rather than what applied.
Opening it¶
Right-click Start → Terminal (Admin). On Server 2022, right-click Start → Windows PowerShell (Admin) or Command Prompt (Admin). Say yes to the UAC prompt. The title bar should say Administrator.
Most commands on this site work in either Command Prompt or PowerShell. The ones marked PowerShell only work there.
The commands you'll use constantly¶
| What | Command |
|---|---|
| List accounts | net user |
| One account's details | net user alice |
| List groups | net localgroup |
| Members of a group | net localgroup Administrators |
| Password and lockout policy | net accounts |
| Export all security policy to a file | secedit /export /cfg C:\secpol.txt |
| Audit policy | auditpol /get /category:* |
| Services and their state (PowerShell) | Get-Service |
| Listening ports and the program behind each | netstat -abno |
| Read one registry value | reg query "HKLM\Path\To\Key" /v ValueName |
| Shares (PowerShell) | Get-SmbShare |
| Installed updates (PowerShell) | Get-HotFix |
| Defender settings (PowerShell) | Get-MpPreference |
| Installed programs (PowerShell) | Get-Package |
Reading a value back: the pattern¶
Every lesson on this site ends with a way to verify. The pattern is always the same.
- Change the setting in the dialog.
- Run the command that reads it.
- Confirm the output matches what you set.
Example: password length¶
You set minimum password length to 12 in secpol.msc. To confirm:
net accounts
Minimum password length: 12
If it still says 0, the change didn't apply. Usually that means you clicked OK on the wrong dialog or a Group Policy is overriding it.
Writing a registry value¶
Most policy settings on this site end up as a registry value, and reg add sets one directly. Learn the shape once and you can set any of them without a dialog:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnumerateLocalUsers /t REG_DWORD /d 0 /f
| Part | Meaning |
|---|---|
"HKLM\...\System" |
The key, in quotes because paths can contain spaces. HKLM is the machine, HKCU the current user. |
/v EnumerateLocalUsers |
The value name inside that key |
/t REG_DWORD |
The type: REG_DWORD for numbers, REG_SZ for text, REG_MULTI_SZ for a list |
/d 0 |
The data |
/f |
Overwrite without asking |
Then read it back: reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnumerateLocalUsers. Expected output:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
EnumerateLocalUsers REG_DWORD 0x0
Pages on this site show one reg add as a worked example and put the rest in a table. That's on purpose: typing each one is how the paths become familiar, and reading each back is how you catch a typo. Once you know the shape, a text file of reg add lines you wrote yourself is a script, and running it with cmd /c is automation you understand.
A policy set through gpedit.msc writes the same value; a value set through reg add shows up in gpedit.msc on the next refresh (gpupdate /force). Either road is fine. Group Policy wins if the two disagree.
The secedit export¶
secedit /export /cfg C:\secpol.txt writes every security policy setting to a text file. Open it in Notepad. Three sections matter:
[System Access]: password and lockout policy[Privilege Rights]: user rights assignment[Registry Values]: security options
You'll use it in the Policies and Rights groups. Delete the file when you're done; it's a map of your security settings.
Saving output¶
Redirect any command to a file so you can compare before and after:
net user > C:\before-users.txt
net localgroup Administrators > C:\before-admins.txt
Do this in the first five minutes. When you're done, run the same commands and compare.
Try it¶
- Run each command in the table once on a practice image and read the output until you can say what every column means.
- Set one registry value with
reg add, read it back withreg query, then find the same value inregedit.
Build it¶
A snapshot.bat that runs net user, net localgroup Administrators, net accounts, netstat -abno, and Get-Service and writes each to a text file. Run it first thing on every image; it's the baseline everything else compares against.