2.1.5. Use the appropriate Microsoft command-line tools. (Obj. 1.5)

💡 First Principle: The command line offers powerful, direct control for efficient troubleshooting and administration that is often faster than using the GUI.

The command-line interface (CLI) is an essential tool for any serious IT technician. While the GUI is great for visual tasks, the CLI provides a faster, more direct, and often more powerful way to interact with the operating system, especially for networking and system file tasks. Windows provides two main CLI environments: the traditional Command Prompt (cmd.exe) and the more modern and powerful PowerShell. For the A+ exam, you must be familiar with a core set of commands that are used for everyday diagnostics and repair. Remember, for many of these commands to work correctly, you must run the CLI "As Administrator" by right-clicking it and selecting that option.

Figure: The Windows Command Prompt - a powerful interface for network diagnostics and system repair

• Networking:
  • ipconfig: The most fundamental networking command. Use it to quickly view the IP address, subnet mask, and default gateway. Use ipconfig /all to see detailed information, including MAC addresses and DNS server addresses. ipconfig /release and /renew are used to get a new IP address from a DHCP server. ipconfig /flushdns clears the local DNS cache, which can resolve browsing issues.
  • ping: Tests basic connectivity to another device (e.g., ping 8.8.8.8 or ping www.google.com). It sends a small packet and waits for a reply. If you get a reply, you know there is a network path between you and the destination.
  • tracert: Traces the "hops" (routers) a packet takes to reach a destination. Useful for diagnosing where a network connection is failing along the path.
  • netstat: Displays active network connections, listening ports, and network statistics. netstat -an is useful for seeing all connections and the ports they are using.
  • route print: Displays the local routing table - which network destinations go out which interface and via which gateway (netstat -r shows the same table). arp -a shows IP-to-MAC mappings instead.
  • nslookup: Queries DNS directly to test name resolution. If ping by IP address works but nslookup cannot resolve the name, the fault is DNS, not connectivity.
  • pathping: Combines ping and tracert, measuring packet loss at each hop (it takes much longer).
  • net use: Maps or disconnects network shares, e.g., net use X: \\Server1\Share (add /persistent:yes to reconnect at every sign-in).
• System & Disk:
  • sfc (System File Checker): A critical repair tool. sfc /scannow scans all protected Windows system files and replaces any that are corrupt or missing with a cached copy.
  • chkdsk (Check Disk): Scans a disk's file system for logical errors. chkdsk /f attempts to fix any errors it finds. chkdsk /r locates bad sectors on the disk and attempts to recover readable information (this implies /f).
  • diskpart: A powerful CLI tool for advanced disk and partition management, allowing you to do everything Disk Management can do, but from the command line.
  • gpupdate /force: In a corporate domain environment, this command forces the client to immediately contact the domain controller and re-apply any Group Policy settings.
  • gpresult /r: Shows which Group Policies are currently being applied to the user and computer, which is invaluable for troubleshooting policy-related issues.
  • format: Formats a volume from the command line, e.g., format E: /FS:NTFS /V:Data (/FS: sets the filesystem, /V: the volume label, /Q makes it a quick format).
  • Inside diskpart, you list disk and select disk N, then clean removes all partition and volume information from that disk, before create partition primary, format fs=ntfs quick, and assign letter=E.
  • DISM /Online /Cleanup-Image /RestoreHealth: Repairs the Windows component store (using Windows Update) that sfc takes its replacement files from. If sfc reports that it cannot fix some files, run DISM first, then sfc /scannow again. (/CheckHealth and /ScanHealth only report corruption.)
  • bootrec (run from the Windows Recovery Environment's Command Prompt when Windows won't boot): /fixmbr writes a new master boot record without overwriting the partition table, /fixboot writes a new boot sector, and /rebuildbcd then scans for Windows installations and rebuilds the Boot Configuration Data (BCD) store. /fixmbr applies only to legacy BIOS/MBR disks.
• Navigation & File Management: cd changes directory and dir lists its contents; md (mkdir) makes a new directory and rmdir removes one; robocopy (Robust File Copy) copies whole directory trees reliably (/E includes empty subfolders, /COPYALL preserves NTFS permissions and ownership, /MIR mirrors), superseding the older xcopy and copy.
• Informational: hostname shows the computer name; whoami shows the signed-in user (e.g., CORP\jsmith); net user lists or manages user accounts; winver opens the About Windows box with the exact version and build; tasklist lists running processes from the CLI (taskkill ends one); query user /server:PC-101 lists the sessions signed in on a remote PC; and any command followed by /? shows its help.

Technician's Diagnostic Path: Scenario: A user calls and says they suddenly can't access the company intranet site or any network shares, but they believe their internet is working because they can get to Google.

1. Initial Test (ping by name): Open a command prompt. The first step is to test name resolution. Type ping intranet.corp.local (replacing with the actual intranet server name). If this fails, it suggests a DNS problem.
2. Isolate the Issue (ping by IP): Ask a colleague for the IP address of the intranet server (e.g., 10.10.5.20). Now, ping 10.10.5.20. If this ping succeeds while the ping by name failed, you have confirmed the issue is with DNS. The user has connectivity to the internal network but cannot resolve internal names.
3. Gather More Data (ipconfig /all): Run ipconfig /all. Examine the output for the "DNS Servers" line. You might find that the user's machine is pointing to a public DNS server (like 8.8.8.8) instead of the required internal corporate DNS server. This would explain why they can reach external sites (Google) but not internal ones.
4. Implement the Fix: Based on this finding, go into the user's network adapter's IPv4 properties and manually set the correct internal DNS server address.
5. Verify (ipconfig /flushdns and ping): Run ipconfig /flushdns to clear out any bad cached entries. Then, ping intranet.corp.local again. It should now succeed, and the user should be able to access all internal resources.

Reflection Question: You are troubleshooting a "no internet" issue. You use ipconfig and see the user has an IP address of 169.254.10.20. What does this tell you, and what is your next troubleshooting step?