Lesson 4: Windows Command Line and Networking Lab

The Windows command line is not a collection of magic words.

Each command either inspects state, changes state, or does some combination of both.

That distinction matters because the safest useful command is often the one that answers the question without changing the system yet.

This lesson uses supplied output or an approved disposable VM. Do not modify managed school endpoints.

Navigation and file commands have different risk

Basic commands include:

cd      change current directory
dir     list directory contents
md      create directory
rmdir   remove directory

cd and dir primarily inspect or navigate.

md and rmdir modify filesystem state.

The terminal does not make every command harmless.

Use command help before guessing syntax

Many Windows commands expose built-in help with /?.

Example:

robocopy /?

That is a better first move than guessing destructive options from memory.

The durable habit is to verify syntax and behavior before changing state.

robocopy turns paths into an operational decision

robocopy can copy directories and files with options useful for resilient transfer and synchronization-style work.

Before a significant operation, define:

• source;
• destination;
• intended copy behavior;
• whether mirroring or deletion is involved;
• recovery plan.

A powerful copy tool pointed at the wrong path is still pointed at the wrong path.

ipconfig exposes the client's configured network state

Use it to inspect address, subnet mask, gateway, DNS information, and whether the client fell back to APIPA.

It does not prove the gateway responds or DNS works.

Configuration is not end-to-end verification.

ping, tracert, and pathping answer different path questions

ping tests reachability to one target under the conditions of the test.

tracert shows responding routed hops along a path.

pathping combines path discovery with additional loss and latency measurements over time.

A timeout is evidence that the expected reply was not observed.

It is not a root cause.

nslookup asks DNS

If a remote IP works but the required hostname fails, DNS becomes a justified boundary to inspect.

Do not change firewall rules because a name lookup failed while direct IP reachability works.

netstat exposes connection and listener state

netstat can show active connections, listeners, and related network statistics depending on options.

If an approved local service should listen on TCP 8080 but no listener appears, that is useful service-state evidence.

It does not yet explain why the application failed to create the listener.

net use helps with mapped resources

A mapped drive may point somewhere different from the path the user thinks it represents.

Example:

Z: → \\old-fileserver\media

If the current direct path works but Z: does not, the server may be healthy and the mapping stale.

That is a client-side resource-mapping problem.

hostname, whoami, and winver establish context

hostname tells you which computer you are on.

whoami tells you the current security identity.

winver establishes Windows version/build context.

These commands look simple because they are simple.

They also prevent expensive assumptions about the wrong machine, wrong user, or wrong Windows release.

net user crosses from inspection into account management

net user can display user/account information and can also modify account state depending on how it is used.

Account changes affect security and access.

Use fictional or disposable accounts for modification exercises.

gpresult inspects policy; gpupdate changes policy timing

gpresult helps answer:

Which Group Policy settings are being applied here?

gpupdate requests a policy refresh.

If a setting returns after refresh and the policy result identifies the controlling configuration, the authoritative boundary is policy.

Stop repeatedly changing the local setting.

sfc belongs to Windows system-file integrity

System File Checker can inspect and repair protected Windows system files under supported workflows.

It is not a universal command to run whenever Windows behaves strangely.

Use it when system-file integrity is a plausible boundary.

chkdsk belongs to filesystem and disk-state questions

chkdsk checks filesystem or disk-related state depending on options and context.

Some modes can make repairs or require exclusive access or restart.

Protect data and understand the operation before using repair modes.

format and diskpart are deliberately dangerous in the wrong hands

format creates a filesystem on a target volume.

diskpart manages disks, partitions, and volumes.

Wrong target, wrong day.

In this course, these are taught through simulation, supplied state, or explicit disposable lab storage.

Before any destructive operation, verify:

target identity
required data
backup / recovery
intended operation
rollback limitations

There is no prize for memorizing destructive syntax.

Windows client networking is a stack

The command output belongs inside a larger model:

wired / Wi-Fi / WWAN / VPN interface
       ↓
static or dynamic IP + subnet + gateway + DNS
       ↓
public/private profile + Defender Firewall
       ↓
proxy if configured
       ↓
domain or workgroup identity
       ↓
shared resource / printer / file server / mapped drive / app

A valid IP can coexist with a blocked firewall rule.

A healthy file server can coexist with a stale mapped drive.

Normal internet access can coexist with a failed VPN.

Public and private network profiles change expected behavior

A public profile is generally more restrictive because the network is not treated as trusted.

A private profile supports a trusted local-network context.

If file sharing works on one network but not another, profile and firewall state may be relevant.

Do not disable the firewall globally.

Understand the profile and required exception.

Wired, wireless, WWAN, and VPN are different interfaces

Windows can maintain several network paths at once:

• wired Ethernet;
• Wi-Fi;
• WWAN/cellular;
• VPN.

The user may say "the network works" while only one of those paths is healthy.

Identify which interface owns the required route.

Proxy settings can make one application path fail while basic IP works

A configured proxy introduces another dependency between the application and remote service.

If direct network reachability exists but an application is routed through a broken or incorrect proxy, the lower network path can be healthy.

Metered connections can intentionally reduce synchronization or update behavior

A cellular or other connection marked as metered may change update and background-data behavior.

If cloud sync pauses on that connection, the internet may be working exactly as configured.

Configuration can look like failure when the policy is invisible.

File Explorer network paths are still network dependencies

A UNC path such as:

\\fileserver\shared

can depend on DNS, IP reachability, SMB, authentication, permissions, and server/share state.

A mapped drive is just another representation of that dependency.

Work the stations

For each supplied Windows case, record:

question
command or Settings surface
inspection or modification?
raw observation
interpretation
risk if state changes
controlled correction
verification

Include cases for:

• DNS failure;
• mapped drive;
• policy-controlled setting;
• firewall/application path;
• metered WWAN;
• disk/volume state;
• identity context;
• VPN failure;
• proxy misconfiguration.

Before you move on

The best command is not the one that makes the terminal look busiest.

It is the one that answers the current question with the least unnecessary change.

Next we combine editions, deployment, GUI tools, commands, networking, and policy into realistic Windows support tickets.