For field technicians, IT helpdesk specialists, and Windows fleet administrators, time is the ultimate resource. Instead of downloading questionable third-party software (registry cleaners or sketchy keyfinders), modern Windows systems include a battle-tested built-in CLI arsenal (PowerShell, DISM, powercfg, and netsh) capable of resolving 99% of workstation issues in seconds.
📄
Need a physical laminated cheat sheet for your server rack or desk?
Download the print-ready A4 Emergency Runbook: print spooler triage, AD lockout loops, BitLocker recovery, and BSOD triage.
1. Power Telemetry & Battery Diagnostics (`powercfg`)
Generate Battery Health & Cycle Telemetry
Exports an interactive HTML audit report presenting factory design capacity, full charge capacity, wear history, and lifetime cycle count.
powercfg /batteryreport /output "C:\battery-report.html" && start C:\battery-report.html
Disable Hibernation (Instantly Reclaim 8–32 GB on Drive C:)
Deletes the hidden
hiberfil.sys container, immediately freeing disk space equal to physical RAM capacity (vital for 128/256 GB SSDs).powercfg /hibernate off
Identify What Prevents System Sleep
Audits background processes, active audio stream handles, and network buffers holding execution locks preventing standby.
powercfg /requests
List Hardware Permitted to Wake the Computer
Enumerates hardware devices (NICs, mice, USB controllers) configured to automatically wake the system from standby.
powercfg /devicequery wake_armed
2. Component Store & Storage Reclaim (WinSxS)
Deep WinSxS Component Store Consolidation (/ResetBase)
Purges superseded component versions left behind by Windows Updates. Typically recovers 4–15 GB from the WinSxS directory.
Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase
Purge Corrupted Windows Update Cache
Resolves stuck download states (0x80070002) and purges gigabytes of residual installation payloads.
net stop wuauserv && net stop bits && rd /s /q %windir%\SoftwareDistribution && net start wuauserv && net start bits
Aggressive Temporary Files Purge (User & System)
Deletes unlocked ephemeral runtime files across user profile and system temp directories without interrupting active services.
Remove-Item -Path "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item -Path "C:\Windows\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue
3. System Image Integrity & Component Repair
The Master Repair Pipeline (DISM + SFC)
Repairs the underlying Windows component image from Windows Update, then replaces corrupted protected system binaries.
DISM /Online /Cleanup-Image /RestoreHealth && sfc /scannow
Re-register Start Menu & Core UWP Packages
Reinstalls and re-registers all built-in modern Windows Shell packages when the Start Menu or Settings app becomes unresponsive.
Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
Volume Consistency & Sector Verification (CHKDSK)
Schedules an offline filesystem integrity scan and unreadable bad-cluster recovery during next reboot.
chkdsk C: /f /r
4. Hardware Telemetry & License Retrieval (No Bloatware)
Extract Motherboard-Embedded OEM License Key (UEFI MSDM)
Queries the ACPI MSDM hardware table in UEFI BIOS to retrieve the original 25-character factory activation key.
(Get-CimInstance -Query 'select * from SoftwareLicensingService').OA3xOriginalProductKey
Retrieve BitLocker 48-Digit Recovery Password
Displays active cryptographic protectors and numerical recovery passwords protecting volume C:. Essential before firmware flashing.
manage-bde -protectors -get C:
Physical RAM Inventory (Slots, Speed & Part Numbers)
Identifies occupied SODIMM slots, manufacturer, capacity, and configured clock frequencies without disassembling the chassis.
Get-CimInstance Win32_PhysicalMemory | Select-Object DeviceLocator, Manufacturer, @{N="Capacity (GB)";E={$_.Capacity/1GB}}, Speed, ConfiguredClockSpeed
NVMe SSD Wear Percentage & Operating Temperatures
Directly interrogates the NVMe storage reliability counters for cell wear endurance and active thermal status.
Get-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk)[0] | Select-Object Temperature, Wear, ReadErrorsTotal, WriteErrorsTotal
System Serial Number & Manufacturer Service Tag
Instantly captures chassis serial numbers and warranty service tags for Dell, HP, and Lenovo enterprise devices.
(Get-CimInstance Win32_Bios).SerialNumber
5. Wi-Fi Troubleshooting & Network Resets
Generate Comprehensive WLAN Connectivity Report
Generates an interactive HTML dashboard charting every Wi-Fi disconnect, RSSI signal fluctuation, and driver error over the last 3 days.
netsh wlan show wlanreport && explorer "C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html"
Extract Saved Wi-Fi Password in Plaintext
Inspects the local WPA2/WPA3 profile and displays the security key content in plaintext.
netsh wlan show profile name="NetworkSSID" key=clear
Complete Network Stack Reset (Triage Protocol)
Resets the Winsock catalog, reinits TCP/IP protocol parameters, and clears cached resolver entries.
netsh winsock reset && netsh int ip reset && ipconfig /flushdns
6. Triage: True Uptime, Crash Dumps & Driver Backup
Verify True Kernel Uptime (Bypass Fast Startup Trap)
Calculates actual elapsed time since genuine kernel initialization, exposing false restarts caused by Windows Fast Startup hibernation.
(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime
Audit Recent Blue Screen of Death (BSOD) Events
Queries the System Event Log for recent BugCheck stop errors and associated memory dump locations.
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 5 | Format-List TimeCreated, Message
Bulk Upgrade All Installed Applications (Winget)
Batch upgrades all installed user and system software packages to their latest verified repository releases.
winget upgrade --all --include-unknown
Export All Third-Party Installed Drivers
Extracts all active OEM hardware device drivers into standard INF folders before performing a clean Windows reinstallation.
dism /online /export-driver /destination:C:\DriversBackup
7. Printers, Active Directory Domain & Corporate Helpdesk
💡 Helpdesk Triage: Resolving AD Account Lockout Loops
When a user's domain account locks out immediately after being unlocked by IT, the root cause is almost always a background secondary device (a mobile phone with a cached expired password trying to sync Exchange/ActiveSync or Wi-Fi 802.1X, or a stale mapped SMB share sending bad NTLM handshakes).
- For End Users: Wait 15–30 mins (GPO lockout threshold window). For urgent offline tasks, disconnect Ethernet and turn off Wi-Fi — you can log in locally using cached credentials (CachedLogonsCount).
- For Administrators: Unlock the account via
Unlock-ADAccountand inspect the Caller Computer Name attribute in Event ID 4740 in Section 8 below.
Emergency Print Spooler Reset & Queue Flush
Stops the Windows Print Spooler service, force-deletes all corrupt/locked print job files (*.spl and *.shd) from disk, and restarts the service cleanly.
net stop spooler && del /Q /F /S "%systemroot%\System32\Spool\Printers\*.*" && net start spooler
Printer Offline Fix: Migrate from WSD to Static TCP/IP Port
Eliminates the common issue where network printers intermittently enter "Offline" status due to WSD protocol timeouts. Creates a Standard TCP/IP port and attaches the printer immediately.
Add-PrinterPort -Name "IP_192.168.1.200" -PrinterHostAddress "192.168.1.200" ; Set-Printer -Name "Office-Printer" -PortName "IP_192.168.1.200"
Advanced Print Server Properties & Driver Removal
Directly opens the Print Server Drivers dialog (bypassing freezing Windows Settings and Control Panel applets) to permanently remove corrupted driver packages.
printui.exe /s /t2
Enable Print Driver Isolation (splwow64 Sandbox)
Prevents buggy vendor printer drivers from crashing the entire system spooler service by isolating the driver in a dedicated sandbox process (Shared or Isolated).
Set-PrinterDriver -Name "Driver_Name" -Isolation Shared
Purge Print Queue for a Specific Printer (PowerShell)
Flushes all stuck print jobs from a single targeted printer without stopping the Spooler service or interrupting other active office printers.
Get-PrintJob -PrinterName "Office-Printer" | Remove-PrintJob
Fix Shared Print Server Connection Error (Code 0x0000011b)
Resolves shared network printer connection failures caused by PrintNightmare RPC authentication level hardening updates on Windows Server and client machines.
reg add "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 0 /f && net stop spooler && net start spooler
Repair Broken Active Directory Domain Trust (Secure Channel)
Fixes "The trust relationship between this workstation and the primary domain failed" in seconds without unjoining the domain or rebooting.
Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
Force Reset Domain Computer Machine Password
Alternative immediate method to restore broken domain trust with the Domain Controller directly from the local PowerShell console.
Reset-ComputerMachinePassword
Purge Kerberos Ticket Cache (New AD Group Rights without Logoff)
Refreshes Active Directory security group membership and share permissions immediately without requiring user logoff or reboot.
klist purge
Instant Retrieval of Windows LAPS Local Admin Password
Retrieves the current automatically-rotated local administrator password managed by modern Windows LAPS directly via PowerShell.
Get-LapsPassword -Identity $env:COMPUTERNAME
Force GPO Policy Refresh & Generate Full HTML Diagnostic Report
Forces GPO download from the domain controller and outputs a clean, comprehensive HTML report documenting applied policies and errors.
gpupdate /force && gpresult /h "$env:TEMP\gpreport.html" && start "$env:TEMP\gpreport.html"
Force Time Synchronization with Domain Controller (NTP)
Resolves Kerberos authentication and domain login failures caused by local workstation clock drift exceeding the maximum tolerance window.
w32tm /config /syncfromflags:domhier /update && w32tm /resync /force
Disconnect All Stale & Locked Network Shares (SMB)
Flushes all hung or unreachable mapped network drive connections (Z:, Y:, etc.) in a single batch operation before re-mapping.
net use * /delete /y
Restart SMB Client (Workstation Service) Without Reboot
Revives hung network file share connections after laptop sleep states without interrupting other running local applications or restarting Windows.
Restart-Service -Name "lanmanworkstation" -Force
Audit & Purge Stale Windows Credentials (cmdkey)
Lists cached domain and web credentials. Essential for pruning outdated saved passwords locking out Outlook, M365, or network shares.
cmdkey /list
Emergency Outlook Startup (Safe Mode, Reset NavPane & Views)
Crucial troubleshooting switch when Outlook hangs on loading profile or COM add-ins — boots in safe mode and resets corrupted folder views.
outlook.exe /safe
Hard Reset Microsoft Teams Cache (New & Classic Teams)
Terminates hung Teams background processes and purges corrupted local cache to resolve black screen and authentication handshake loops.
taskkill /F /IM ms-teams.exe /IM teams.exe ; Remove-Item -Path "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\*" -Recurse -Force -ErrorAction SilentlyContinue
Inspect Entra ID / Azure AD Hybrid Join Status (dsregcmd)
Primary Service Desk diagnostic tool for modern authentication, SSO failures, TPM Error 1001, and Workplace Join state validation.
dsregcmd /status
Detect Corrupted User Profile (.bak Registry Keys)
Locates corrupted user SID entries in the Windows registry that trigger the dreaded "You've been signed in with a temporary profile" notification.
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s | findstr /i "\.bak"
Reset Local User Password & Unlock Account (net user)
Instantly assigns a new password to a local user account and removes lockout flags. Note: On domain-joined PCs, specify dot prefix to log in locally:
.\Username.net user "Username" "NewPassword123!" /active:yes
Unlock Domain User Account (Unlock-ADAccount)
Instantly removes account lockout restrictions in Active Directory via PowerShell (or cmd:
net user username /active:yes /domain).Unlock-ADAccount -Identity "target_username"
Inspect Bad Password Count & Lockout Status in Domain
Queries the Domain Controller for bad password attempt counters, lockout state, and password expiration timestamp for targeted accounts.
net user "target_username" /domain
Force Password Change at Next User Logon
Mandates that the user must immediately update their temporary password to a confidential credential upon authenticating to the machine.
net user "Username" /logonpasswordchg:yes
Bypass Work/School Account & Autopilot Lockout (OOBE)
Execute in console (Shift+F10) during Windows setup to unlock the hidden "I don't have internet" option and establish a pure local account.
oobe\bypassnro
Force Windows Update Scan, Download & Install (UsoClient)
Initiates immediate background scan, download, and installation of pending quality and security patches without opening the Settings GUI.
UsoClient.exe StartScan && UsoClient.exe StartDownload && UsoClient.exe StartInstall
Check if Workstation Has a Pending Reboot Post-Updates
Validates Windows Update registry indicators signaling that critical component updates or drivers require a restart to finalize installation.
Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"
Enable Remote Desktop (RDP) & Open Firewall in One Command
Toggles the RDP service on in the registry and automatically enables inbound port 3389 exception rules in Windows Defender Firewall.
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0 ; Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Query Active & Disconnected RDP Sessions (qwinsta)
Displays session identifiers (IDs) for all active, hung, or disconnected local console and remote desktop user connections.
qwinsta
Force Disconnect Locked or Hung RDP Session (rwinsta)
Terminates a frozen or abandoned remote session by targeted numeric session ID without rebooting the host machine.
rwinsta <Session_ID>
Instant Launch Microsoft Quick Assist
Immediately opens the built-in Microsoft cloud-brokered screen sharing client for live interactive user support sessions.
start ms-quick-assist:
Repair Windows Installer Service Engine (msiserver)
Unregisters and re-registers the MSI installer engine in the registry, resolving error 1618 ("Another installation is in progress").
msiexec /unregister && msiexec /regserver
Restart Windows Explorer Shell (Frozen Taskbar Recovery)
Forcefully terminates and relaunches the desktop shell, system tray, and taskbar without logging out the active user session.
taskkill /f /im explorer.exe && start explorer.exe
8. Cybersecurity, Incident Triage, Event Logs & BitLocker
BitLocker: Comprehensive Volume Encryption Inspection (manage-bde)
Outputs full volume encryption percentage, cipher algorithm (XTS-AES), TPM protector status, and lock state across all drives.
manage-bde -status
BitLocker: Enable OS Drive C: with TPM Protector (XTS-AES 256)
Initializes enterprise-grade encryption on the OS volume utilizing XTS-AES 256 cipher paired directly to hardware TPM integrity validation.
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
BitLocker: Instant 48-Digit Recovery Password Extraction
Instantly queries the numeric 48-digit volume recovery key directly from PowerShell without requiring Azure AD or Intune portal access.
(Get-BitLockerVolume -MountPoint C:).KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} | Select-Object -ExpandProperty RecoveryPassword
BitLocker: Suspend Protection for 1 Reboot (Before BIOS/UEFI Flash)
Suspends TPM PCR measurements for exactly one reboot cycle, preventing recovery password lockouts post-firmware updates.
Suspend-BitLocker -MountPoint "C:" -RebootCount 1
BitLocker: Emergency Volume Unlock via CLI Recovery Password
Unlocks a locked internal or external BitLocker volume via terminal prompt using the 48-digit numeric recovery string.
manage-bde -unlock D: -RecoveryPassword "XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX"
BitLocker: Force Recovery Key Escrow to Active Directory
Uploads and securely escrows the volume's numerical recovery protector password into the computer object in Active Directory.
manage-bde -protectors -adbackup C: -id ((Get-BitLockerVolume -MountPoint C:).KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'}).KeyProtectorId
Audit Local Administrators Group (Backdoor & Escalation Check)
Rapid enumeration of all local and domain accounts holding administrative privileges on the endpoint — step zero during compromise triage.
Get-LocalGroupMember -Group "Administrators"
Detect Non-Microsoft Scheduled Tasks (Persistence Hunting)
Filters enabled Windows Task Scheduler jobs created by third parties or attackers attempting to maintain persistence across reboots.
Get-ScheduledTask | Where-Object {$_.State -ne 'Disabled' -and $_.Author -notmatch 'Microsoft|Windows'} | Select-Object TaskName, TaskPath, State
Inspect Registry Autostart Run & RunOnce Keys
Audits executables registered to launch automatically upon user interactive logon across HKLM and HKCU registry hives.
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
Detect Active Outbound Connections to External IPs (C2 Beaconing)
Identifies established outbound TCP sessions bypassing RFC1918 private LAN subnets along with corresponding process IDs (PIDs).
Get-NetTCPConnection -State Established | Where-Object RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|127\.|::1)' | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
Event Log: Identify Machine Triggering Account Lockout (Event ID 4740)
Queries the Domain Controller for lockout events and parses the Caller Computer Name field to identify the misconfigured mobile device or PC.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -MaxEvents 5 | Select-Object TimeCreated, @{N='Account';E={$_.Properties[0].Value}}, @{N='Caller_Device';E={$_.Properties[1].Value}}
Event Log: Detect Failed Logons / Brute-Force Spray (Event ID 4625)
Extracts recent rejected logon attempts from the Security log showing target username and remote workstation source IP address.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4625} -MaxEvents 20 | Format-Table TimeCreated, Id, Message -Wrap
Event Log: Track Successful Remote Desktop Sessions (Event ID 4624 Type 10)
Filters successful RDP authentications (LogonType 10), detailing the authenticated username, timestamp, and remote client IP.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624} -MaxEvents 100 | Where-Object {$_.Properties[8].Value -eq 10} | Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='Source_IP';E={$_.Properties[18].Value}}
Event Log: Detect Security Audit Log Clearing (Event ID 1102 & 104)
Critical forensic alert: tracks exact timestamps when an adversary or administrative script intentionally cleared the Security event log.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=1102} -ErrorAction SilentlyContinue
Event Log: Track New Account Creation Events (Event ID 4720)
Tracks account creation activities in the local SAM or Active Directory database alongside the security principal responsible.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4720} -MaxEvents 10 -ErrorAction SilentlyContinue