Command Center · Reference 01
Windows 11 Quick Reference
Fast lookup for high-value Windows 11 checks: accounts, groups, services, processes, scheduled tasks, firewall, networking, event logs, files, startup, Defender, updates, and remote access.
Use this page to remember the right command and what its output means. Inspect first, preserve useful evidence, then make the smallest justified change.
Quick Reference Rule
Before using a command
Check the scenario before changing Windows
Required accounts, services, remote-access settings, roles, and applications can look unusual. This page favors read-only inspection so you can understand the current state before remediation.
Windows 11
Accounts & Groups
Get-LocalUser
Lists local Windows user accounts.
Caution
Account existence does not prove recent use.
Get-LocalGroupMember -Group "Administrators"
Shows members of the local Administrators group.
Caution
Privilege membership is capability, not proof of privileged action.
whoami
Shows the current user context.
Caution
Use whoami /groups for token/group context.
whoami /groups
Shows groups and security identifiers in the current token.
Caution
Current-token groups are not the same as every local group on the system.
Windows 11
Services
Get-Service
Lists service names, display names, and current state.
Caution
A stopped service is not automatically safe, and a running service is not automatically required.
Get-CimInstance Win32_Service | Select Name,State,StartMode,StartName,PathName
Shows service state, startup mode, account, and executable path.
Caution
Check scenario requirements before disabling anything.
Get-CimInstance Win32_Service -Filter "Name='ExampleService'" | Format-List *
Shows detailed configuration for one service.
Caution
Preserve path, account, state, and start mode before changing it.
Windows 11
Processes
Get-Process
Lists currently running processes.
Caution
Process name alone does not establish legitimacy.
Get-CimInstance Win32_Process | Select ProcessId,ParentProcessId,Name,ExecutablePath,CommandLine
Adds PID, parent PID, executable path, and command line.
Caution
Some fields may require elevation or be unavailable for protected processes.
Get-Process -Id 1234 | Format-List Id,ProcessName,Path,StartTime
Shows details for one PID.
Caution
PIDs are temporary and can be reused.
Windows 11
Scheduled Tasks
Get-ScheduledTask
Lists scheduled tasks and their states.
Caution
Task presence does not prove it has run.
Get-ScheduledTaskInfo -TaskName "ExampleTask"
Shows last and next run information for one task.
Caution
Pair with task action, trigger, and process evidence.
Get-ScheduledTask -TaskName "ExampleTask" | Select-Object -ExpandProperty Actions
Shows the action configured for the task.
Caution
Record executable, arguments, and run-as context before changes.
Windows 11
Firewall
Get-NetFirewallProfile
Shows Defender Firewall profile state.
Caution
Profile state does not show every individual allow/block rule.
Get-NetFirewallRule -Enabled True
Lists enabled firewall rules.
Caution
An allow rule does not prove a service is currently listening.
Get-NetFirewallRule -DisplayName "Example Rule" | Get-NetFirewallPortFilter
Shows protocol and port filters for a selected rule.
Caution
Check direction, profile, program, and address scope too.
Windows 11
Networking
ipconfig /all
Shows IP addresses, gateways, DNS servers, DHCP state, and adapter details.
Caution
Check all adapters, including virtual or disconnected ones.
Get-NetTCPConnection
Shows TCP endpoints, connection states, and owning PIDs.
Caution
Map OwningProcess to an executable before making conclusions.
Get-NetTCPConnection -State Listen
Shows listening TCP sockets.
Caution
Listening does not guarantee remote reachability because firewall rules also matter.
netstat -ano
Classic socket and PID view available on most Windows systems.
Caution
Use PID mapping to identify the owning process.
route print
Shows IPv4/IPv6 routing tables.
Caution
Use only when troubleshooting reachability or unexpected routes.
Windows 11
Event Logs
Get-WinEvent -LogName Security -MaxEvents 50
Shows recent Security log events.
Caution
Interpret event IDs with account, logon type, and time context.
Get-WinEvent -LogName System -MaxEvents 50
Shows recent System events such as service and boot activity.
Caution
One event rarely explains the entire cause.
Get-WinEvent -LogName Application -MaxEvents 50
Shows recent application events.
Caution
Application logs vary widely by installed software.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddHours(-2)}Filters Security events to recent successful/failed logons.
Caution
Use the requested time window rather than searching everything blindly.
Windows 11
Files & Hashes
Get-Item "C:\Path\To\File" | Format-List Name,FullName,Length,CreationTime,LastWriteTime,Attributes
Shows useful file metadata.
Caution
CreationTime and LastWriteTime describe different events.
Get-FileHash "C:\Path\To\File" -Algorithm SHA256
Calculates a SHA-256 file hash.
Caution
A hash identifies content; it does not by itself tell you whether the file is safe.
Get-Acl "C:\Path\To\File"
Shows ownership and access control information.
Caution
Permissions must be interpreted with user/group context.
Get-Item "C:\Path\To\File" -Stream *
Lists NTFS alternate data streams where supported.
Caution
An alternate stream is not automatically malicious.
Windows 11
Startup Locations
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Shows current-user Run startup entries.
Caution
Review only; do not delete entries until requirements and source are understood.
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Shows machine-wide Run startup entries.
Caution
Check executable path, publisher/source, and required software context.
Get-CimInstance Win32_StartupCommand
Provides a broad startup-command inventory.
Caution
It is useful but not exhaustive.
Windows 11
Windows Update & Defender
Get-MpComputerStatus
Shows Microsoft Defender status and protection state.
Caution
A healthy status does not prove every file or process is benign.
Get-MpThreatDetection
Shows Defender threat-detection records where available.
Caution
Detection history is one evidence source, not a complete timeline.
Get-HotFix | Sort-Object InstalledOn -Descending
Lists installed hotfixes and update history visible to this command.
Caution
Not every modern update appears exactly the same way in Get-HotFix.
Windows 11
Remote Access
Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections
Shows whether Remote Desktop connections are denied by this setting.
Caution
Firewall and service state also affect RDP reachability.
Get-Service TermService
Shows Remote Desktop Services state.
Caution
Do not disable required remote access without checking the scenario.
Get-NetTCPConnection -LocalPort 3389 -ErrorAction SilentlyContinue
Checks whether TCP 3389 has an active/listening endpoint.
Caution
Port number alone does not prove which service owns it; map the PID.
Event IDs
High-value Windows event awareness
Logon types
Interpret Event 4624 correctly
Useful paths
Common Windows locations worth recognizing
C:\Users\<user>\DownloadsCommon user download location.
C:\Users\<user>\AppData\LocalPer-user local application data, cache, and sometimes executables.
C:\Users\<user>\AppData\RoamingPer-user roaming application data and settings.
C:\ProgramDataShared application data and service-related files.
C:\Windows\TempSystem temporary storage.
%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartupCurrent-user Startup folder.
%ProgramData%\Microsoft\Windows\Start Menu\Programs\StartUpMachine-wide Startup folder.
Decision check
Ask these before changing anything important
Is this item required by the scenario?
What account owns or runs it?
What is the full executable or file path?
Is there a service, task, startup entry, or parent process that explains it?
Is there matching log or network evidence?
Do I need to preserve a hash, PID, command line, event ID, or timestamp before changing it?
What is the smallest justified defensive change?
How will I verify that the system still works afterward?
Common mistakes
Windows mistakes that waste time or destroy evidence
Disabling an unfamiliar service before checking whether it is required.
Treating Administrator membership as proof that the account performed a privileged action.
Deleting a scheduled task before recording its action, trigger, and run-as account.
Killing a process before recording path, command line, parent PID, hash, and network state.
Assuming a listening port means the host is remotely reachable.
Assuming a Defender no-detection result proves a file is safe.
Trusting filenames or extensions without checking the actual file and path context.
Making several changes at once and losing track of which change fixed or broke something.