1.0 Operating Systems

Command-line tools are powerful, but Windows controls what each user can do based on their privilege level.

Before a technician runs commands, changes settings, repairs system files, manages disks, or modifies protected folders, they must understand whether the current session is running with standard user permissions or elevated administrator permissions. Objective 1.5 focuses on Microsoft command-line tools, but those tools do not all run with the same level of access. Some commands are safe for everyday users, while others require administrative approval because they can affect the operating system, security settings, storage, network configuration, or other users.

Privileges are Windows access rights that determine what a user, process, script, or command can do. A standard user can perform routine tasks such as opening applications, browsing folders they have permission to access, running many user-level commands, and completing daily productivity work. An administrator has broader authority and can change protected system areas, install or remove software, manage services, modify network settings, run repair commands, change local accounts, and work with disks or security settings.

Standard Access: Everyday User Work

Standard access is the default, safest level for normal work. A standard user can open and run most applications, browse permitted folders, use many diagnostic commands, and complete day-to-day tasks without touching protected system areas. This follows the principle of least privilege: use only the access needed to complete the task, nothing more.

Least privilege matters because malware, mistakes, and accidental commands are limited by the permissions of the current session. If a user is browsing the web, reading email, or running regular applications with administrator-level access, anything that compromises that session may inherit more power than it should have. For support work, start with standard access when you only need to observe, collect information, or run non-invasive commands.

Examples of commands that often work without elevation include dir, cd, hostname, whoami, ipconfig, ping, tracert, pathping, nslookup, and many uses of netstat. These commands help collect information, navigate folders, confirm the current user, or test connectivity without making major system changes.

Elevated Access: Administrator-Level Control

Elevated access means the command shell, terminal, tool, or process is running with administrator privileges. In Windows, this commonly happens when you right-click Command Prompt, PowerShell, Windows Terminal, or another tool and choose Run as administrator. You can also open an elevated command prompt by typing cmd and pressing Ctrl + Shift + Enter.

Elevation is required when the task affects protected parts of Windows. Examples include changing system files, writing to protected directories, modifying services, applying system-wide settings, repairing Windows components, managing disks, changing firewall settings, creating system folders, or running commands that need administrator rights. If a command fails with an access denied message, privilege level is one of the first things to check.

Examples of commands that commonly require elevation include sfc /scannow, many chkdsk repair operations, diskpart, format, some net use changes, gpupdate in certain contexts, service-management commands, and commands that modify protected system locations. These commands are useful, but they can also alter the system in ways that affect boot, storage, data, network access, or security.

User Account Control And Admin Group Membership

Being signed in with an administrator account does not mean every command automatically runs elevated. Windows uses User Account Control, or UAC, to separate normal use from administrator-level actions. An administrator may still need to approve elevation before a tool receives full administrative permissions.

The image highlights a key exam idea: the user must belong to the Administrators group or have administrator credentials available before elevation can be approved. If a standard user attempts to run a protected command, Windows may prompt for administrator credentials. If those credentials are not available, the command should not be forced or bypassed. The correct technician response is to follow the organization's access policy.

How To Decide Whether To Elevate

Do not elevate just because you can. Elevate when the task actually requires system-level control. If you are only checking the current IP configuration, viewing the hostname, listing files, or testing DNS, standard access is usually enough. If you are repairing Windows files, formatting storage, changing protected settings, or applying system-wide configuration, elevated access may be required.

• Use standard access for observation, navigation, basic diagnostics, and user-level work.
• Elevate when needed for system repair, disk changes, protected configuration, service control, and administrative tasks.
• Confirm the role before assuming the user has permission to run the command.
• Watch for access denied messages, UAC prompts, and commands that fail because the shell is not elevated.
• Document elevated work because privileged changes can affect the whole system.

Security Mindset For Command-Line Work

Privilege control protects the system from unnecessary risk. Running every command as administrator can turn a simple typo into a serious outage. A mistaken format, diskpart, delete, permission, or system-repair command can damage data or change the system far beyond the original problem. That is why professional technicians verify the command, understand the target, back up important data, and make sure the access level matches the task.

When you see a command-line scenario on the exam, ask three questions: What is the command supposed to do? Does it only collect information, or does it change the system? Does the user have the correct privilege level to perform that action? Those questions help you choose the right tool and avoid unsafe recommendations.

Bottom line: Privileges decide how much power a command has. Standard access is right for routine work and many diagnostics; elevated access is reserved for administrator tasks that truly require it.

Before you can copy files, run tools, inspect folders, or repair a system from the command line, you must know where you are and how to move.

Command-line navigation is the foundation for nearly every Microsoft command-line task in Objective 1.5. A command prompt is not just a place to type tools; it is also a location inside the file system. The prompt usually shows the current drive and folder, such as C:\Users\Joe>. When you run a command, Windows often uses that current location as the starting point unless you provide a full path.

This matters because many support mistakes come from running the right command in the wrong folder, targeting the wrong file, or misunderstanding whether a path points to the current directory, a subfolder, a parent folder, or another drive. Navigation commands help you orient yourself before you make changes.

Use dir To List Contents

The dir command displays the files and subfolders in the current directory. Think of it as asking, "What is here?" It helps you confirm filenames, folder names, file extensions, dates, sizes, and whether a target exists before running another command.

For example, if the prompt shows C:\Users\Joe> and you type dir, Windows lists the contents of C:\Users\Joe. Folders are commonly marked with <DIR>, while files show size and other details. This is useful before using commands such as cd, type, copy, robocopy, del, or any command that needs an exact file or folder name.

• Use dir when you need to see what files and folders exist in the current location.
• Use dir foldername to view the contents of a specific folder without moving into it.
• Use quotes around paths or folder names that contain spaces, such as dir "C:\Users\Joe\My Documents".
• Read the output carefully so you can distinguish files from folders before choosing the next command.

Use cd Or chdir To Change Location

The cd command, short for change directory, moves the command prompt to a different folder. chdir is the longer form of the same command. If dir answers "what is here," then cd answers "go there."

For example, typing cd Work\Reports from C:\ changes the prompt to C:\Work\Reports>, assuming that folder exists. You can move into a subfolder, move to a folder by full path, or change to a folder on another drive depending on the syntax you use.

Windows paths use the backslash character, \, to separate folders. A full path such as C:\Users\Joe\Documents starts at a drive root and tells Windows exactly where to go. A relative path such as Work\Reports starts from your current location. Understanding the difference prevents you from ending up in the wrong directory.

• cd foldername: move into a subfolder of the current directory.
• cd \: move to the root of the current drive.
• cd C:\Users\Joe: move to an exact location on the current drive context.
• cd /d D:\Projects: change both the drive and directory when moving to another drive.
• chdir: alternate form of cd; know both names for exam recognition.

Use .. To Move To The Parent Folder

Two dots, .., represent the parent directory, which is one level above the current folder. If you are in C:\Work\Reports> and type cd .., the prompt moves up to C:\Work>. This is one of the quickest ways to back out of a folder without typing the full path again.

You can also chain parent-folder moves. For example, cd ..\.. moves up two levels. This is useful when navigating deeply nested folders during troubleshooting, log collection, file recovery, or command-line repairs.

Know Current, Parent, Relative, And Absolute Paths

Command-line navigation becomes much easier when you understand path relationships. The current directory is where your prompt is now. A child directory is a folder inside the current directory. The parent directory is one level above the current directory. A relative path starts from where you are. An absolute path starts from the drive root and gives the full location.

Why Navigation Matters For Support

Many troubleshooting commands depend on path accuracy. If a user cannot find a file, you may use dir to confirm it exists. If you need to run a tool from a specific directory, you may use cd to move there. If you are preparing to copy a folder, you should confirm the source and destination before running the command. If you are working in recovery tools, you may need navigation commands because graphical tools are not available.

Navigation also helps you avoid accidental damage. A command such as delete, format, copy, or robocopy can have very different effects depending on the target path. Before running any command that changes files, verify your current location, confirm the target with dir, and use full paths when precision matters.

Common Exam And Real-World Clues

• Need to see files in the current folder: use dir.
• Need to move to another folder: use cd or chdir.
• Need to move up one level: use cd ...
• Need to go to the root of the current drive: use cd \.
• Need to move to a folder on another drive: use cd /d with the drive path.
• Path contains spaces: wrap the path in quotation marks.
• Command affects files: confirm the current directory and target before pressing Enter.

Bottom line: Navigation commands keep you oriented. Know where you are, know where the target is, and confirm the path before you run commands that matter.

Network command-line tools help you move from "the internet is broken" to a specific, testable clue.

Network troubleshooting works best when you test in layers. A user may say they cannot reach a website, a file share, a printer, or a server, but the real failure could be the local adapter, IP configuration, default gateway, DNS, routing, firewall filtering, name resolution, a remote host, or a service listening on the wrong port. The command line gives you fast evidence before you change settings.

For Objective 1.5, know what each command proves. Some commands show your local configuration. Some test whether a host responds. Some trace the path between systems. Some show active connections. Others query DNS or manage Windows network resources. The exam often gives you a scenario clue and expects you to choose the command that matches the question being asked.

Start With ipconfig

ipconfig is usually the first command to run when a Windows system has a network problem. It shows the IP address, subnet mask, default gateway, DNS-related settings, and adapter information. If the computer has no IP address, an unexpected address, an Automatic Private IP Addressing address, the wrong gateway, or missing DNS servers, connectivity may fail before you ever reach the internet.

Use ipconfig when you need to answer basic questions: What IP address does this device have? Is it on the expected subnet? Does it have a default gateway? Which DNS servers is it using? Which adapter is active? For deeper information, ipconfig /all gives more detail, including MAC address, DHCP status, lease information, and DNS configuration.

• Local IP check: confirms whether the device has a usable network configuration.
• Default gateway check: confirms the route out of the local network.
• DNS check: confirms where the device sends name-resolution queries.
• DHCP clues: shows whether the address was assigned automatically and when the lease was obtained.

Use ping To Test Reachability

ping sends ICMP Echo Request messages and measures whether a host responds. It is a quick way to ask, "Can I reach this target, and how long does the round trip take?" If you can ping the local loopback address, local TCP/IP is functioning. If you can ping the default gateway, the local network path is working. If you can ping an external IP address but not a website name, DNS may be the issue.

Ping is useful, but it is not perfect. Some firewalls and devices block ICMP, so a failed ping does not always prove a host is down. A technician should interpret ping results alongside other evidence such as DNS lookup, route tracing, browser behavior, application errors, and firewall policy.

Use netstat To View Connections And Ports

netstat displays network statistics, active connections, listening ports, and related connection information. It is helpful when you need to see whether a system is communicating, which remote systems it is connected to, or whether a service appears to be listening.

Common options matter. netstat -a shows all active connections and listening ports. netstat -b attempts to show which executable is associated with each connection and may require administrative privileges. netstat -n shows numeric addresses and port numbers instead of resolving names, which can make output faster and clearer during troubleshooting.

• netstat -a: show active connections and listening ports.
• netstat -b: show the program associated with a connection when permitted.
• netstat -n: show addresses and ports numerically instead of resolving names.
• Scenario clue: "Which connections or listening ports exist?" points toward netstat.

Use nslookup To Test DNS

nslookup queries DNS servers and returns name-resolution information. Use it when the IP network appears to work but names do not resolve correctly. For example, if a user can ping an external IP address but cannot reach a website by name, DNS should be investigated.

Nslookup can retrieve hostnames, IP addresses, and DNS record information. It can also help identify whether the system is using the expected DNS server. This makes it useful when troubleshooting wrong DNS records, stale records, internal vs. external name resolution, or a system pointing to the wrong DNS server.

Use net For Windows Network Resources

The net command family is a classic Windows command set for network resources, users, sessions, shares, and mapped drives. In Objective 1.5, it is especially important for shared resources and account-oriented network tasks.

For example, net view can show network resources. net use can show, create, or remove mapped network drives and connections to shared folders. A command such as net use X: \\server\share maps a drive letter to a network share. net user can display or manage user account information, depending on permissions and context.

Because some net commands affect users, shares, or mapped resources, privilege level matters. Read the command carefully before running it, especially when removing mappings or making account changes.

Use tracert To Trace The Path

tracert traces the route packets take to a destination. It shows each hop along the path, which helps determine whether traffic leaves the local network, reaches an upstream router, or fails somewhere along the route. In Windows, tracert uses ICMP and Time To Live behavior to identify hops.

Each hop represents a router or device along the route. TTL values help reveal the hop count, not time in seconds. If the trace stops at the first hop, the issue may be local gateway or routing. If it stops outside the organization, the issue may be upstream. If some hops show timeouts, remember that firewalls or routers may deprioritize or block ICMP responses even while traffic still passes.

Use pathping To Combine Route And Performance Clues

pathping combines route discovery with performance statistics. It first identifies the path to the destination, then pings each hop to measure latency and packet loss. This makes it useful when the problem is not simply "can I reach it?" but "where along the path does performance degrade?"

Pathping takes longer than ping or tracert, but it provides richer data. Use it when intermittent loss, latency, or route quality matters. It is especially useful when documenting a network problem for escalation because it provides both path and performance evidence.

A Practical Troubleshooting Order

1. Confirm local configuration: run ipconfig or ipconfig /all.
2. Test the local stack: ping loopback or the local address if needed.
3. Test the gateway: ping the default gateway to confirm local network reachability.
4. Test beyond the network: ping an external IP address to separate routing from DNS.
5. Test DNS: use nslookup or name-based testing.
6. Trace the route: use tracert to see where packets travel.
7. Measure route quality: use pathping when latency or packet loss is suspected.
8. Review connections: use netstat for active connections and listening ports.
9. Check shared resources: use net view or net use for Windows shares and mappings.

Exam Clues To Remember

• IP address, subnet mask, gateway, DNS, DHCP: think ipconfig.
• Reachability and round-trip time: think ping.
• Active connections, listening ports, network statistics: think netstat.
• DNS records, hostnames, name-to-IP answers: think nslookup.
• Shares, mapped drives, Windows network users/resources: think net.
• Every hop to a destination: think tracert.
• Route plus latency and packet loss: think pathping.

Bottom line: Network commands give you visibility. Use each command to answer a specific question, then let the evidence guide the next test.

Disk and file commands can fix problems, prepare storage, and move data, but they can also destroy data when used carelessly.

Objective 1.5 expects you to recognize common Microsoft command-line tools and choose the correct command for the job. Disk and file commands are especially important because they sit close to user data. A technician may need to check a drive for errors, prepare a volume, manage partitions, or copy files to a backup location. Before running any of those commands, confirm the drive letter, path, target device, and backup status.

The image highlights the core idea: every command has a purpose. chkdsk checks and repairs file system problems. format prepares a volume for use and erases existing data. diskpart manages disks and partitions with powerful subcommands. copy duplicates files, and switches such as /v and /y change how the command behaves. These tools are useful, but the right command on the wrong drive can become a bad day very quickly.

Drive Letters And Paths

Windows identifies volumes with drive letters followed by a colon. The main system drive is usually C:, but that is not guaranteed in every environment. Recovery environments, external drives, installation media, mapped drives, and multi-drive systems may assign letters differently. Always verify the target before running a disk command.

A path tells Windows exactly where to find a file or folder. The drive letter identifies the volume, and backslashes separate folders. For example, C:\Users\brotocoljoe points to a folder named brotocoljoe inside Users on the C: drive. If a path contains spaces, put it in quotation marks so the command interpreter treats the path as one target.

• C: refers to the C drive.
• D:\Backup refers to a Backup folder on the D drive.
• C:\Users\brotocoljoe shows a drive letter plus folder path.
• Quotes matter: use quotes around paths such as "C:\Users\Joe\My Documents".
• Verify first: use navigation and listing commands before changing or deleting anything.

Use chkdsk To Check A Drive

chkdsk, short for Check Disk, scans a volume for file system errors and disk-related problems. It can be used as a read-only check, or with switches that attempt repairs. The two switches shown in the graphic are especially important: /f and /r.

chkdsk /f fixes logical file system errors. These are problems with the way data structures are recorded, such as directory entries, file indexes, or allocation information. If Windows is currently using the volume, it may not be able to lock the drive immediately. In that case, Windows may ask whether to schedule the check at the next restart.

chkdsk /r locates bad sectors and attempts to recover readable information. This option includes the work of /f, but it takes longer because it performs a deeper surface-level check. Use it when the scenario mentions suspected bad areas, read problems, disk health concerns, or recurring file access failures.

• chkdsk: checks a volume and reports status.
• chkdsk /f: fixes logical file system errors.
• chkdsk /r: finds bad sectors and recovers readable data; includes /f.
• Locked volume: if the drive is in use, schedule the check at startup.
• Safety: back up important files before repair operations whenever possible.

Use format Only When You Intend To Erase

format prepares a volume so Windows can use it. Formatting creates a file system structure, but it also erases existing data from the target volume. This is why format questions are often safety questions. If the scenario says the drive must be prepared for use, format may be appropriate. If the scenario says the user needs files preserved, formatting is usually the wrong first step.

For example, format C: targets the C: drive, which is commonly the system drive. That is a high-risk command. A technician must confirm the target drive, the purpose, the backup, and the recovery plan before formatting. Never assume a drive letter is correct without checking.

Use diskpart For Advanced Disk Management

diskpart launches the DiskPart command shell, a powerful text-based disk management tool. It can list disks, select disks, create or delete partitions, clean partition information, assign letters, and manage volumes. Because it can change or remove partitions and data, DiskPart requires careful command sequencing.

DiskPart uses an interactive prompt, commonly shown as DISKPART>. A typical sequence might include list disk, select disk 0, and another command that affects the selected disk. The most important phrase is selected disk. DiskPart commands act on the object you selected, so selecting the wrong disk can lead to data loss.

• diskpart: opens the DiskPart shell.
• list disk: shows available disks.
• select disk 0: chooses a disk as the active target.
• clean: removes partition information from the selected disk and can make data inaccessible.
• exit: leaves the DiskPart shell.

Use DiskPart when graphical disk tools are unavailable or when a scenario specifically calls for command-line disk management. Before using it, identify the disk by size, status, and context. If there is any uncertainty, stop and verify before proceeding.

Use copy To Move Or Duplicate Files

copy duplicates files from one location to another. It is useful for quick file movement, collecting logs, backing up a single file, or placing a file in a needed folder. The command generally follows a source-to-destination pattern, such as copy source.txt D:\Backup\.

Switches change behavior. The image highlights /v and /y. The /v switch verifies that files were written correctly. The /y switch suppresses overwrite confirmation prompts by automatically answering yes. That can speed up known-safe workflows, but it can also overwrite files without warning if used carelessly.

• copy source.txt D:\Backup\: copies source.txt to the Backup folder on D:.
• /v: verifies files are written correctly.
• /y: suppresses overwrite prompts by answering yes automatically.
• Use full paths when source or destination ambiguity could cause a mistake.
• Confirm destination before using overwrite-related switches.

Choosing The Right Disk Or File Command

The command you choose should match the symptom. If the problem is file system errors, think chkdsk. If the task is preparing a drive and erasing existing contents is acceptable, think format. If the task is partition-level management, think diskpart. If the task is duplicating a file, think copy. If the question mentions a drive letter, path, or folder structure, slow down and verify the exact target.

Exam Clues To Remember

• Logical file system repair: use chkdsk /f.
• Bad sectors or recovery of readable information: use chkdsk /r.
• Prepare a drive and erase existing data: use format.
• Manage disks and partitions from the command line: use diskpart.
• Duplicate a file: use copy.
• Verify copied file writes: use /v.
• Suppress overwrite prompts: use /y, but only when appropriate.
• Drive letter clue: confirm the target before running a destructive command.

Bottom line: Disk and file commands are everyday tools with real consequences. Know the target, protect the data, and use the command that matches the task.

Disk and file commands are not just commands to memorize. They are decisions about where data lives, what needs to be protected, and what kind of change is safe.

By this point in Objective 1.5, you have seen navigation commands, network troubleshooting commands, and the main disk/file utilities. Module 05 pulls those ideas into a technician workflow. The image repeats the most important disk and file tools because they are high-value exam targets and high-risk real-world tools: drive letters and paths, chkdsk, format, diskpart, and copy.

The safest technician does not jump straight to the most powerful command. They identify the target, confirm the data, choose the least destructive command that fits the symptom, and verify the result. A command prompt can be fast and precise, but it does exactly what you tell it to do. That means the technician must be even more precise.

Step 1: Identify The Correct Drive Letter

Every Windows partition or mounted volume receives a drive letter when Windows exposes it as a usable volume. The system drive is usually C:, but technicians should not assume this is always true. Recovery environments, bootable USB drives, external disks, card readers, mapped network drives, and multi-boot systems can shift drive letters.

Before running a command that checks, formats, partitions, copies, or repairs data, confirm the drive letter. If the wrong drive is selected, the command might affect the wrong volume. This is especially important with format, diskpart, and overwrite operations.

• Use the drive letter plus colon to refer to a volume, such as C: or D:.
• Add folder paths when you need a specific location, such as D:\Backup.
• Use backslashes to separate folders in Windows paths.
• Check before changing when the command could repair, erase, partition, or overwrite data.

Step 2: Decide Whether The Drive Needs Checking Or Repair

If a user reports file system errors, missing files, repeated prompts to scan a drive, corruption messages, or trouble reading data, chkdsk may be the right tool. The command can inspect a volume and, with the right switch, attempt repairs.

chkdsk /f is used when the issue is logical in nature. It repairs file system issues such as directory errors, index problems, or allocation inconsistencies. If Windows is using the drive, the volume may be locked. In that case, Windows can schedule the check for the next startup, before normal file usage blocks the repair.

chkdsk /r goes deeper. It looks for bad areas on the drive and attempts to recover readable information. Because /r includes /f, it can take longer and should be used when the scenario points to bad sectors, repeated read errors, or possible media issues.

Step 3: Treat format As A Destructive Command

format prepares a drive so Windows can use it, but it erases existing contents on the selected volume. On the exam, the key phrase is not simply "prepare a drive." The key question is whether the existing data should be preserved. If data must be kept, back it up first and do not format as a first troubleshooting step.

A command like format C: is extremely dangerous because C: is usually the main system drive. Even if the target is a removable drive or a newly installed disk, verify the letter and confirm the drive contents before proceeding. If the task is to create a fresh file system on an empty or disposable volume, formatting may be correct. If the task is to recover files, formatting is usually wrong.

Step 4: Use diskpart Only With A Verified Target

diskpart is more powerful than a normal file-copy or directory command because it manages disks, partitions, and volumes. After you start DiskPart, you work inside a separate command shell. The prompt changes to DISKPART>, and commands act on the selected disk or volume.

The sequence shown in the image demonstrates why this tool requires caution: list disk, select disk 0, clean, and exit. The clean command removes partition information from the selected disk. Used on the wrong disk, it can make data inaccessible. That is why the technician must identify the correct disk by size, type, location, and purpose before selecting it.

• diskpart: launches the DiskPart shell.
• list disk: displays disks that Windows can see.
• select disk 0: selects disk 0 as the active target.
• clean: removes partition information from the selected disk.
• exit: leaves DiskPart.

DiskPart is commonly used when preparing storage, fixing partitioning problems, working in recovery environments, or performing command-line disk management. It is not the tool to use casually when the user's goal is simply to find a file or copy a document.

Step 5: Use copy With Source, Destination, And Switches In Mind

The copy command moves or duplicates files from one location to another. It is simple, but simple does not mean risk-free. A bad destination path can place files in the wrong folder, and an overwrite switch can replace a file that the user still needs.

The image highlights /v and /y. The /v switch verifies that copied files were written correctly. The /y switch automatically answers yes to overwrite prompts. That can be helpful in scripts or known-safe workflows, but it should not be used blindly because it removes an important confirmation step.

For example, copy source.txt D:\Backup\ /v /y copies source.txt to the D:\Backup folder, verifies the write, and suppresses overwrite prompts. That may be correct when the technician has already confirmed the destination and overwrite behavior. It is risky when the source or destination is uncertain.

How These Commands Fit Together

A practical disk/file workflow often looks like this: identify the drive letter, navigate or list contents to confirm the target, back up important data, choose a repair or preparation command only if it matches the symptom, then verify the result. The command line is not a guessing tool. It is a precision tool.

1. Identify: What drive, folder, file, or disk is affected?
2. Confirm: Use drive letters, paths, and listing commands to verify the target.
3. Protect: Back up data before repair, formatting, partitioning, or overwriting.
4. Select: Use chkdsk, format, diskpart, or copy only when the command fits the goal.
5. Execute carefully: Watch the target, switch, and privilege level.
6. Verify: Confirm the disk, file, or folder is in the expected state afterward.
7. Document: Record the command used, target path or drive, result, and any follow-up recommendation.

Exam Clues To Remember

• "Logical file system errors" points to chkdsk /f.
• "Bad sectors" or "recover readable information" points to chkdsk /r.
• "Prepare the drive so Windows can use it" may point to format, but only if erasing data is acceptable.
• "Manage disks and partitions" points to diskpart.
• "Duplicate this file to another location" points to copy.
• "Verify copied data was written correctly" points to /v.
• "Automatically answer Yes to overwrite prompts" points to /y.
• "Back up first" is the safest answer before destructive storage work.

Bottom line: Disk and file command success comes from precision. The command matters, but the target matters even more.

Windows command-line paths are built from drive letters, colons, backslashes, and folder names. If you can read the path, you can reach the target.

Command-line navigation is more than typing cd. A technician must understand how Windows identifies storage locations and how a full path points to a specific file or folder. The image breaks the concept into a simple flow: drive letter, colon, backslash, folder path, result. That pattern is the backbone of Windows file-system navigation.

When a command uses a path, Windows needs to know which drive to start on and which folder structure to follow. If you type the wrong drive letter, forget the colon, use the wrong slash, or misspell a folder name, the command may fail or target the wrong location. This matters when using commands such as dir, cd, copy, robocopy, chkdsk, format, and diskpart.

Each Drive Has A Letter

Windows assigns a letter to each usable volume so the operating system and users can tell storage locations apart. The primary system drive is almost always C:, but other volumes may use letters such as D:, E:, or higher. External USB drives, optical drives, recovery media, mapped network drives, and additional partitions may all receive different letters.

The letter is the starting point. If you are working with the C drive, commands that target C: refer to that volume. If you are working with an external backup drive assigned D:, commands must target D: instead. In support work, never assume the drive letter just because it is common. Confirm the actual letter before running a command that changes data.

• C: commonly identifies the main Windows system drive.
• D: may be a second internal drive, USB drive, optical drive, or recovery-related volume.
• Mapped network drives may also use drive letters, but they point to network shares rather than local disks.
• Recovery environments can assign different letters than normal Windows.

The Colon Separates The Drive From The Path

The colon is not decoration. In Windows path syntax, the colon tells Windows that the previous character is a drive letter. C: means "the C drive." Without the colon, C is just a letter, not a drive reference. This is why command examples show the drive letter followed immediately by a colon.

Typing C: at a command prompt switches to the C drive context. Typing D: switches to the D drive context. If you need to move to a folder on another drive in one step, use the appropriate path command, such as cd /d D:\Projects, because normal cd behavior can be drive-context sensitive.

The Backslash Moves Into Folders

The backslash, \, separates folder levels in a Windows path. After the drive letter and colon, each backslash moves one level deeper into the folder structure. For example, C:\Users\brotocoljoe starts on the C drive, enters the Users folder, then enters the brotocoljoe folder.

Backslashes are a classic Windows path clue. Web addresses use forward slashes, but Windows local paths use backslashes. If a command fails, verify that the path uses the correct slash direction, the folder names are spelled correctly, and any folder names with spaces are placed in quotation marks.

Reading The Example Path

The example path C:\Users\brotocoljoe points to the brotocoljoe folder inside the Users folder on the C: drive. Read it left to right: start at C, enter Users, enter brotocoljoe, arrive at the target.

This same reading pattern works for longer paths. A path such as C:\Users\brotocoljoe\Documents\Reports starts on C, enters Users, enters brotocoljoe, enters Documents, and then reaches Reports. When troubleshooting, say the path out loud in that order if you need to verify that you are pointing to the correct location.

Absolute Paths And Relative Paths

A full path such as C:\Users\brotocoljoe is an absolute path. It begins with the drive letter and gives the complete route to the location. Absolute paths are useful when precision matters because the command does not depend as much on your current prompt location.

A relative path starts from where you already are. If the prompt is currently C:\Users>, typing cd brotocoljoe uses a relative path to enter the brotocoljoe folder. Relative paths are faster, but absolute paths are clearer when you are copying files, documenting commands, or working in an unfamiliar directory.

• Absolute path: C:\Users\brotocoljoe
• Relative path: brotocoljoe when you are already in C:\Users
• Root path: C:\ points to the top of the C drive.
• Parent path: .. means one folder level up.

Using Paths With Commands

Once you understand drive and folder structure, many command-line tools become easier to read. dir C:\Users lists the Users folder on C. cd C:\Users\brotocoljoe moves to that folder. copy report.txt D:\Backup\ copies a file to the Backup folder on D. chkdsk C: targets the C volume. format E: targets the E volume and would erase it, so the drive letter must be confirmed.

When a path contains spaces, use quotation marks. For example, cd "C:\Users\Joe Smith\Documents" keeps the full path together. Without quotes, the command interpreter may treat the path as separate pieces and fail.

Common Mistakes To Avoid

• Wrong drive letter: verify C:, D:, E:, and mapped drives before running commands.
• Missing colon: C: identifies a drive; C does not.
• Wrong slash direction: Windows local paths use backslashes.
• Spaces without quotes: wrap paths with spaces in quotation marks.
• Assuming recovery drive letters: letters can change in recovery or installation environments.
• Destructive target errors: formatting, cleaning, deleting, or overwriting the wrong path can cause data loss.

Exam Clues To Remember

• "Which drive?" points to the drive letter.
• "Drive letter followed by punctuation" points to the colon.
• "Move into folders" points to backslashes and folder names.
• "Exact file or folder location" points to a full path.
• "Folder name has spaces" points to quotation marks.
• "Command affects a volume" means confirm the drive letter before proceeding.

Bottom line: Drive letters and folder paths tell Windows exactly where to go. Read the path before you run the command, especially when data is at stake.

Folder commands let you create structure, clean up empty directories, and prepare reliable file-copy workflows from the command line.

Once you know how to navigate drives and paths, the next step is managing the folder structure itself. Windows command-line tools include simple commands for creating and removing directories, plus stronger file-copy tools for moving data between locations. These commands are common in real support work because technicians often need to create backup folders, organize logs, prepare destination directories, remove empty folders, or copy large folder trees.

The key commands in this lesson are md, mkdir, rd, rmdir, and robocopy. The first two create folders. The next two remove folders. Robocopy performs robust file and folder copying for larger or more reliable copy jobs. Each command is straightforward, but the technician still needs to verify the current path, target path, permissions, and data risk before running it.

Create Folders With md Or mkdir

md and mkdir both create a new directory. They are functionally equivalent for everyday Windows command-line use. If you are in C:\Users\brotocoljoe and type mkdir Labs, Windows creates a folder named Labs in the current location. If you provide a full path, Windows creates the folder at that exact location.

Creating folders is useful before copying files, collecting logs, staging backups, organizing scripts, or preparing a destination for deployment work. A technician might create D:\Backup before copying user files, or C:\Temp\Logs before exporting diagnostic information.

• md Reports: creates a Reports folder in the current directory.
• mkdir D:\Backup: creates a Backup folder on the D drive.
• mkdir "C:\Users\Joe Smith\Desktop\Logs": uses quotes because the path contains a space.
• Current location matters: relative folder names are created where the prompt is currently located.

Use Paths To Control Where A Folder Is Created

If you type only a folder name, Windows creates the folder in the current directory. If you type a full path, Windows creates it at that exact path. This distinction matters when preparing backup locations or working from an elevated prompt that may start in C:\Windows\System32 instead of the user folder.

For example, md Backup creates a Backup folder wherever you currently are. md D:\Backup creates it on the D drive. The second form is safer when the destination must be exact.

Remove Folders With rd Or rmdir

rd and rmdir remove directories. Like md and mkdir, they are paired command names that perform the same basic function. By default, the folder usually must be empty before it can be removed. That safety behavior helps prevent accidental deletion of files inside a directory.

If the folder is not empty, Windows may refuse to remove it unless additional options are used. That is a good thing. It gives the technician time to confirm whether files inside the folder are still needed. If the goal is cleanup, inspect the folder contents first with dir before removing anything.

• rd OldLogs: removes the empty OldLogs folder from the current directory.
• rmdir D:\Temp: removes an empty Temp folder on the D drive.
• Empty-folder rule: basic removal is intended for folders with no contents.
• Verify first: use dir before removing a folder so you know what is inside.

Understand Removal Risk

Folder removal commands are not the same as harmless navigation commands. Removing the wrong directory can disrupt applications, delete staging folders, break scripts, or remove locations users expect to keep. Additional options can remove folder trees and contents, so a technician should treat removal commands with care.

Before removing a folder, ask whether it is empty, whether it belongs to a user or application, whether the data is backed up, and whether the current path is the intended target. If the command is running elevated, the risk increases because elevated sessions can remove locations that a standard user cannot.

Use robocopy For Stronger File Copying

robocopy, short for Robust File Copy, is designed for reliable copying of files and folders. It is superior to older copy tools for large jobs, interrupted transfers, repeated synchronization, and copying folder trees. Robocopy is built into modern Windows versions, including Windows 10 and Windows 11.

Robocopy is especially useful when copying valuable data because it can handle retries, preserve structure, and provide more detailed results. A technician may use it to copy user profiles, migrate documents, collect files from a failing system, or mirror a folder to a backup location. Because robocopy can copy many files quickly, source and destination paths must be verified before running it.

• Robust copy jobs: use robocopy when reliability matters.
• Large folder trees: robocopy is designed for larger or more complex copy operations.
• Retries and resilience: robocopy can handle interruptions better than simple copy workflows.
• Built in: robocopy is included with Windows 10 and Windows 11.

Command Pairings To Memorize

Practical Workflow

1. Check location: look at the prompt and confirm the current drive and folder.
2. List contents: use dir before creating or removing folders.
3. Create intentionally: use md or mkdir with a clear folder name or full path.
4. Remove carefully: use rd or rmdir only after confirming the target is correct and safe to remove.
5. Copy reliably: use robocopy for large or important copy jobs.
6. Verify result: list the destination folder and confirm the expected files or folders are present.
7. Document: record the command, source, destination, and any files or folders changed.

Exam Clues To Remember

• "Create a new directory" points to md or mkdir.
• "Remove an empty directory" points to rd or rmdir.
• "Folder must be empty" is a removal command clue.
• "Large copy job" or "reliable copy" points to robocopy.
• "Built-in copy tool for Windows 10/11" can point to robocopy.
• "Source and destination paths" means verify both before copying.

Bottom line: Folder commands are simple, but simple commands can still affect important data. Know where you are, know what you are targeting, and verify before and after the command runs.

Handy command-line tools help technicians identify the computer, verify the Windows version, confirm the signed-in user, and manage local user accounts without digging through multiple settings screens.

Not every command-line task is about repairing disks or testing the network. Sometimes the job is simple: identify which computer you are on, confirm which Windows build is installed, check what account is currently active, or manage a local user account. These small commands save time because they provide fast context before you make a recommendation or start troubleshooting.

For Objective 1.5, know the purpose of hostname, winver, whoami, and net user. They are practical, quick, and exam-friendly because each answers a different support question: What is this device called? What version of Windows is it running? Who am I signed in as? What local users exist, or how can a local user be managed?

Use hostname To Identify The Computer

The hostname command displays the Windows device name. This is useful when you are working on multiple computers, connected through remote support, documenting an issue, matching a device to an inventory record, or confirming that you are troubleshooting the correct system.

A Windows device name is the computer name used by Windows for identification on the network and in system settings. If you have several command prompt windows open, hostname quickly tells you which machine the current shell belongs to. That helps prevent the classic support mistake of running a command on the wrong system.

• hostname: shows the current computer name.
• Best clue: the scenario asks for the device name or computer name.
• Great for remote work: confirms which endpoint you are connected to.
• Documentation value: record the hostname in tickets, change notes, and troubleshooting logs.

Use winver To Confirm Windows Version Information

The winver command opens the About Windows dialog box. It displays Windows edition and version information, including build details. Use it when you need a fast confirmation of the installed Windows release before checking compatibility, update status, support documentation, or vendor requirements.

Version information matters because troubleshooting steps can vary by Windows 10 vs. Windows 11, edition, build, support status, and update level. A user may say they are on Windows 11, but a technician should verify before recommending a feature or tool that depends on a specific version.

• winver: opens a graphical About Windows box.
• Best clue: the question asks how to quickly check Windows version or build.
• Support value: confirms whether the system matches documentation or vendor requirements.
• Upgrade value: helps verify whether a device is on the expected release after an update.

Use whoami To Confirm The Current User

The whoami command displays the current user context. It is especially helpful when you are working in multiple windows, switching between standard and elevated sessions, troubleshooting permissions, checking mapped resources, or verifying which account is being used in a remote session.

The command can also show more detailed account information. The image highlights whoami /all, which displays user and group details, security identifiers, and privilege information. That is useful when a permission issue may be tied to group membership or privilege level.

• whoami: shows the current signed-in user context.
• whoami /all: shows detailed user, group, SID, and privilege information.
• Best clue: the scenario asks who is currently logged in or what permissions are active.
• Security value: confirms whether you are operating as the expected account before making changes.

Use net user To View And Manage User Accounts

The net user command is a classic Windows command for viewing and managing user accounts from the command line. Without extra arguments, it can list user accounts. With a username, it can display information about a specific account. With additional options, it can create users, change passwords, and enable or disable accounts.

Because net user can change account state, some actions require elevated permissions. Viewing basic information is low risk, but adding users, resetting passwords, enabling disabled accounts, or disabling accounts can affect access and security. Follow organizational policy before changing any account.

• net user: lists local user accounts.
• net user brotocoljoe: views information for a specific user account.
• net user newuser P@ssw0rd /add: creates a new local user account when permitted.
• Best clue: the scenario asks about local users, passwords, or account management from the command line.

Know What Each Command Answers

Practical Technician Workflow

1. Identify the device: run hostname so the ticket, remote session, and inventory record all match.
2. Confirm the OS: run winver before using version-specific instructions or support guidance.
3. Confirm the user context: run whoami or whoami /all before troubleshooting permissions.
4. Review accounts carefully: use net user to inspect local users before making account changes.
5. Elevate only when needed: account changes may require an administrator prompt or approved credentials.
6. Document what you learn: record hostname, Windows version/build, user context, and account changes when relevant.

Exam Clues To Remember

• "Find the computer name" points to hostname.
• "Check Windows version quickly" points to winver.
• "Find the current user" points to whoami.
• "Show groups, privileges, and SID details" points to whoami /all.
• "List local users" points to net user.
• "Manage a local user from the command line" points to net user, with administrator permission when changing accounts.

Bottom line: Handy commands reduce guesswork. Use hostname, winver, whoami, and net user to identify the system, verify the OS, confirm the user, and manage accounts with confidence.

OS management commands help technicians enforce policy, verify applied settings, and repair protected Windows system files from the command line.

After you know how to identify the device, user, Windows version, network state, storage target, and file path, the next step is understanding commands that affect Windows management and operating system health. These commands are especially important in business environments because many Windows settings are controlled through Group Policy, and many stability issues involve protected system files.

This module focuses on Group Policy, gpupdate, gpresult, and sfc. Group Policy controls user and computer settings in managed Windows environments. gpupdate forces policies to refresh. gpresult reports which policies were applied. sfc /scannow scans protected Windows system files and attempts repair when corruption is found.

Understand Group Policy

Group Policy is a Windows management feature used to configure computers and users, especially in Active Directory domain environments. Administrators can use Group Policy to enforce security settings, desktop restrictions, update behavior, scripts, mapped resources, software settings, password policies, and many other configuration rules.

Group Policy settings are commonly applied when a user signs in or when the computer starts. They can also refresh periodically in the background. In a managed environment, a technician should not assume a setting was changed manually by the user. It may have been applied by policy.

• Computer policy: applies to the device, regardless of which user signs in.
• User policy: applies to a user account, often following the user across domain-joined systems.
• Domain clue: Group Policy is a major Active Directory management tool.
• Troubleshooting clue: if settings keep coming back, policy may be enforcing them.

Use gpupdate To Refresh Policy

The gpupdate command forces Group Policy to update immediately instead of waiting for the normal refresh interval. This is useful after a policy change, after a system joins a domain, after network connectivity is restored, or when a technician needs to test whether a new setting applies correctly.

The common exam idea is that gpupdate applies or refreshes policy, while gpresult displays the result. If the scenario says to force policy to update, think gpupdate. If it asks what policy actually applied, think gpresult.

• gpupdate /force: reapplies both user and computer policy settings.
• gpupdate /target:user /force: refreshes user policy only.
• gpupdate /target:computer /force: refreshes computer policy only.
• Restart or sign-out prompts: some policy changes may require a reboot or logoff before they fully apply.

Use gpresult To Verify Applied Policy

The gpresult command shows the Resultant Set of Policy, meaning the policies that actually apply to a computer or user after Windows processes domain, local, security, and inheritance rules. This matters because more than one policy may target the same device or user, and the effective result is what the system actually follows.

Use gpresult when you need evidence. It can help verify whether a user received a mapped drive policy, whether a computer received a security baseline, whether a setting is coming from Group Policy, or whether a policy is missing because the device is not in the expected organizational unit or security group.

• gpresult /r: shows a summary of applied policies for the current computer and user.
• gpresult /user sgc/brotocoljoe /v: shows verbose policy details for a specific user example.
• Best clue: the scenario asks you to verify which policy settings applied.
• Documentation value: gpresult output provides proof for troubleshooting and escalation notes.

Use sfc /scannow To Repair Protected System Files

SFC stands for System File Checker. The command sfc /scannow scans protected Windows system files and attempts to repair corrupted or missing files. It is useful when Windows behavior suggests system file damage, such as broken built-in tools, unusual OS errors, failed system components, or corruption after malware cleanup, storage problems, or interrupted updates.

System File Checker is not a general-purpose app repair tool, and it is not the first answer for every problem. Use it when the clue points to Windows system file integrity. Because it repairs protected system files, sfc /scannow typically requires an elevated command prompt.

• sfc /scannow: scans and repairs protected Windows system files.
• Best clue: corrupted or missing system files.
• Privilege clue: run from an elevated command prompt.
• Follow-up: review the result message and document whether repairs were made.

Policy Refresh vs. Policy Results vs. File Repair

Practical Technician Workflow

1. Identify the environment: determine whether the device is standalone, workgroup, domain joined, or cloud-managed.
2. Check the symptom: decide whether the issue is policy behavior, missing settings, user restrictions, or possible system file corruption.
3. Refresh when needed: use gpupdate after policy changes or when settings have not applied yet.
4. Verify the result: use gpresult to prove which policies apply to the user or computer.
5. Repair system files: use sfc /scannow when the clue points to protected Windows file corruption.
6. Retest and document: record the command, result, reboot/logoff requirement, and next step.

Exam Clues To Remember

• "Force Group Policy to refresh" points to gpupdate.
• "Show the policies applied" points to gpresult.
• "Specific user policy result" points to gpresult /user.
• "Computer-only or user-only policy refresh" points to gpupdate /target.
• "Corrupted or missing Windows system files" points to sfc /scannow.
• "Settings return after reboot or logon" may point to Group Policy enforcement.

Bottom line: OS management commands give technicians control and evidence. Use the right command for the job: refresh policy, verify policy, or repair Windows system files.

Objective 1.5 is about choosing the right Windows command-line tool, running it with the correct level of privilege, protecting data, and proving the result.

Command-line tools are fast, direct, and powerful. They help technicians move through the file system, identify devices and users, diagnose network problems, manage disks and folders, refresh policy, verify applied settings, and repair protected Windows system files. The key is not memorizing a pile of commands in isolation. The real skill is matching the scenario clue to the safest command that answers the question or fixes the problem.

Start With Privilege Awareness

Before running a command, decide whether the task only collects information or changes the system. Standard access is appropriate for many observation tasks, including navigation, listing files, checking the hostname, viewing the current user, testing connectivity, and confirming basic network information. Elevated access is reserved for tasks that affect protected system areas, storage, services, user accounts, policy, or system file repair.

• Least privilege: use only the access level needed for the task.
• Elevation clue: commands that repair, format, modify policy, change accounts, or touch protected areas may need administrator rights.
• Security habit: do not run every shell as administrator just because it is convenient.
• Verification habit: if a command fails with access denied, check privilege level before assuming the tool is broken.

Know Where You Are Before You Work

Navigation commands keep the technician oriented. Use dir to see what is in the current folder. Use cd or chdir to change directories. Use cd .. to move up one level. Use drive letters, colons, backslashes, and full paths when the target must be exact.

Many command-line mistakes happen because the right command is run against the wrong target. Before copying, deleting, formatting, checking, or repairing anything, confirm the current drive, current folder, source path, destination path, and spelling.

Match Network Commands To The Question

Network troubleshooting commands each answer a different question. ipconfig shows local IP settings. ping checks reachability and response time. netstat shows connections and listening ports. nslookup queries DNS. net manages classic Windows network resources and accounts. tracert traces the path to a destination. pathping combines route discovery with latency and loss information.

• Need local IP, subnet, gateway, DNS, or DHCP details: use ipconfig.
• Need to test whether a host responds: use ping.
• Need active connections or listening ports: use netstat.
• Need DNS answers: use nslookup.
• Need shares, mapped resources, or users: use net.
• Need the route packets take: use tracert.
• Need route plus performance data: use pathping.

Respect Disk And File Commands

Storage and file commands can solve real problems, but they can also erase data when used carelessly. chkdsk /f repairs logical file system issues. chkdsk /r checks for bad sectors and includes /f. format prepares a drive for use but erases data. diskpart manages disks and partitions and must be used with extreme care. copy handles basic file copies, while robocopy is stronger for larger, more reliable copy jobs.

• Backups come first: confirm important data is protected before disk, format, partition, or bulk copy work.
• Locked volume clue: some checks must be scheduled for startup if Windows is using the drive.
• Target discipline: verify the disk number, drive letter, folder path, source, and destination before pressing Enter.
• Copy verification: use options such as /v when confirming copied data matters.
• Overwrite caution: /y answers yes to overwrite prompts, so use it only when that behavior is intended.

Use Handy Commands For Fast Context

Small information commands reduce guesswork. hostname confirms the computer name. winver confirms the Windows version and build. whoami confirms the current user context. whoami /all shows detailed user, group, SID, and privilege information. net user lists or manages local user accounts, depending on the syntax and privilege level.

These commands are especially useful before remote work, account troubleshooting, escalation, documentation, or version-specific support. They tell you where you are, what system you are touching, and which account is active.

Manage Policy And System File Health Carefully

Windows management commands help enforce and verify configuration. gpupdate refreshes Group Policy. gpresult shows which policies actually applied. sfc /scannow scans protected Windows system files and attempts repair when corruption is found. These tools are evidence-driven: use them when the clue points to policy behavior, applied settings, or system file integrity.

• Force policy to refresh: use gpupdate /force.
• Refresh only user or computer policy: use gpupdate /target:user /force or gpupdate /target:computer /force.
• Verify applied policy: use gpresult /r or a user-specific gpresult command.
• Repair protected Windows files: use sfc /scannow from an elevated command prompt.
• Document prompts: record when a command requires restart, sign-out, or follow-up testing.

Technician Decision Rhythm

1. Identify the job: navigation, network, storage, file copy, account check, policy refresh, policy verification, or system file repair.
2. Confirm the target: device, user, path, drive, server, destination, or policy scope.
3. Choose the least risky command: collect information first, then make changes only when the evidence supports it.
4. Check privilege level: run elevated only when the task requires administrator access.
5. Protect data: back up files, confirm recovery options, and avoid destructive switches unless they are clearly required.
6. Run one controlled command: avoid stacking risky changes together.
7. Verify the result: rerun checks, inspect output, test connectivity, confirm files, or validate policy.
8. Document the work: record the command, target, output, change, result, and next step.

Exam Clues To Remember

• List folder contents: dir.
• Change folders: cd or chdir.
• Move up one folder: cd ...
• Check IP configuration: ipconfig.
• Test connectivity: ping.
• Trace a route: tracert.
• Combine route and packet loss data: pathping.
• Check DNS: nslookup.
• Check or repair a disk: chkdsk.
• Prepare a drive and erase contents: format.
• Manage partitions: diskpart.
• Reliable large copy: robocopy.
• Confirm device name: hostname.
• Confirm Windows version: winver.
• Confirm current user: whoami.
• Manage user accounts: net user.
• Refresh Group Policy: gpupdate.
• Verify Group Policy: gpresult.
• Repair protected system files: sfc /scannow.

Bottom line: Windows command-line tools are technician shortcuts with real power. Use them deliberately: know the purpose, know the target, know the privilege level, protect the data, and prove the outcome.