The Command Line¶
Most settings can be read and changed faster from a command prompt than from a dialog. More important, reading a value back is the only way to be sure a change took. Dialogs sometimes show what you clicked rather than what applied.
Opening it¶
Right-click Start → Terminal (Admin). On Server 2022, right-click Start → Windows PowerShell (Admin) or Command Prompt (Admin). Say yes to the UAC prompt. The title bar should say Administrator.
Most commands on this site work in either Command Prompt or PowerShell. The ones marked PowerShell only work there.
The commands you'll use constantly¶
| What | Command |
|---|---|
| List accounts | net user |
| One account's details | net user alice |
| List groups | net localgroup |
| Members of a group | net localgroup Administrators |
| Password and lockout policy | net accounts |
| Export all security policy to a file | secedit /export /cfg C:\secpol.txt |
| Audit policy | auditpol /get /category:* |
| Services and their state (PowerShell) | Get-Service |
| Listening ports and the program behind each | netstat -abno |
| Read one registry value | reg query "HKLM\Path\To\Key" /v ValueName |
| Shares (PowerShell) | Get-SmbShare |
| Installed updates (PowerShell) | Get-HotFix |
| Defender settings (PowerShell) | Get-MpPreference |
| Installed programs (PowerShell) | Get-Package |
Reading a value back: the pattern¶
Every lesson on this site ends with a way to verify. The pattern is always the same.
- Change the setting in the dialog.
- Run the command that reads it.
- Confirm the output matches what you set.
Example: password length¶
You set minimum password length to 12 in secpol.msc. To confirm:
net accounts
Minimum password length: 12
If it still says 0, the change didn't apply. Usually that means you clicked OK on the wrong dialog or a Group Policy is overriding it.
The secedit export¶
secedit /export /cfg C:\secpol.txt writes every security policy setting to a text file. Open it in Notepad. Three sections matter:
[System Access]: password and lockout policy[Privilege Rights]: user rights assignment[Registry Values]: security options
You'll use it in the Policies and Rights groups. Delete the file when you're done; it's a map of your security settings.
Saving output¶
Redirect any command to a file so you can compare before and after:
net user > C:\before-users.txt
net localgroup Administrators > C:\before-admins.txt
Do this in the first five minutes. When you're done, run the same commands and compare.