Lesson 4: Windows Command Line and Networking Lab

Core path: 42 minutes

A command is useful when you know what question it answers and whether it changes system state.

This lab uses supplied output or an instructor-approved disposable VM. Do not modify managed school endpoints.

Navigation and file-management commands

Recognize:

cd       change directory
dir      list directory contents
md       create directory
rmdir    remove directory
robocopy robust file/directory copy

rmdir and robocopy can change data. Use a defined target and backup/recovery plan where appropriate.

Network commands

ipconfig   IP configuration
ping       bounded reachability/response test
netstat    active/listening network connections and statistics
nslookup   DNS query evidence
net use    connect/view network resources such as mapped shares
tracert    routed-hop path evidence
pathping   path plus packet-loss/latency-style measurements over time

A failed ping does not by itself prove the destination is offline.

Disk commands

chkdsk   filesystem/disk checking
format   create a filesystem on a target volume
diskpart disk/partition management

format and diskpart are potentially destructive. In this course they are recognition/simulation tools unless used inside a disposable lab image with explicit instructions.

Informational and OS-management commands

hostname   local computer name
net user   local/domain user information/management depending on context
winver     Windows version/build information
whoami     current security identity
command /? built-in command help
gpupdate   refresh Group Policy
gpresult   report applied Group Policy results
sfc        system-file integrity checking/repair workflow

Windows networking configuration

Technicians must separate the local network model from the commands used to inspect it.

Domain joined vs workgroup

A domain-joined client depends on centralized identity/policy infrastructure. A workgroup uses local/peer-oriented administration.

Common shared resources include:

• printers;
• file servers;
• mapped drives;
• network shares.

Local firewall

Windows Defender Firewall can apply network-profile and application/port restrictions/exceptions.

Do not disable the whole firewall to solve one application problem. Identify the required rule or service path.

Client IP configuration

Recognize and verify:

• IP address;
• subnet mask/prefix;
• default gateway;
• DNS servers;
• static vs dynamic configuration.

Connection types

Windows clients may use:

• wired Ethernet;
• Wi-Fi;
• VPN;
• WWAN/cellular connectivity.

Proxy settings

A proxy can become another dependency between the client/application and remote resources.

Public vs private network profile

Windows network profiles influence discovery, sharing, and firewall behavior. A public profile should generally be more restrictive than a trusted private network profile.

Network paths

File Explorer and applications can access network resources through paths such as:

\\server\share

A reachable server does not guarantee the specific share, permissions, or mapped drive are correct.

Metered connections

A metered connection tells Windows/applications that data use may be limited or costly. This can affect update/synchronization behavior.

Lab stations

Station A: name resolution

Supplied evidence:

ipconfig: valid IP/gateway/DNS
ping 203.0.113.20: reply
nslookup portal.test: timeout

Identify the strongest current boundary.

Station B: mapped drive

Evidence:

• network path \\filesrv\media works directly;
• existing mapped drive points to an old server name.

Use the net use concept to identify the mapping problem rather than blaming the file server.

Station C: policy

Evidence:

• user says a setting keeps changing back;
• gpresult shows an applied policy controlling the setting.

Local manual changes are not the authoritative boundary.

Station D: firewall/application

Evidence:

• one approved application cannot receive expected local traffic;
• other network functions work;
• firewall logs/rules show the relevant application path is blocked.

Design the smallest justified exception instead of disabling protection globally.

Station E: metered WWAN

Evidence:

• laptop uses cellular/WWAN;
• connection is marked metered;
• large cloud synchronization is paused/deferred.

The behavior may be policy/configuration, not broken internet.

Lab record

For five stations document:

command or settings surface:
question answered:
observed evidence:
strongest theory:
state-changing risk:
controlled correction:
verification:

Evidence checkpoint

You should now be able to distinguish inspection commands, modifying commands, Windows networking state, and policy/firewall dependencies.