The CompTIA A+ Core 2 domain on operating systems and system administration requires you to know a specific set of command-line tools and system utilities. This concept — using the command line to manage Windows — is the difference between being a user who can only click buttons and being a technician who can fix computers when the mouse stops working, the screen is black, or you need to change settings on a hundred machines at once. For the 220-1202 exam, you must memorise the names, functions, and syntax of about twenty essential commands, and that is exactly what this chapter covers.
Jump to a section
A simple way to picture Windows Command Line and System Tools
A master shipwright who builds custom wooden boats uses two very different sets of tools. When a client brings in a boat that needs a new mast, the shipwright reaches for a set of adzes, chisels, and planes that are all carefully stored in a special tool chest. But when the same shipwright needs to design the hull shape for a completely new vessel, he doesn't use those hand tools. Instead, he pulls out his drafting table, T-square, curve templates, and a stack of heavy tracing paper. He draws the lines first, erases mistakes, and creates a detailed plan before any wood is cut. In the same way, an IT professional uses the Graphical User Interface (GUI) — the visual windows, icons, and mouse-driven menus — when performing common, one-off tasks like resetting a password or changing a display setting. However, when they need to automate repetitive tasks across dozens or hundreds of computers, or when they need to fix a system that won't even load the GUI, they switch to the command line. The command line is like the drafting table: it's where you write precise, repeatable instructions that can be saved, copied, and executed without needing a mouse or a graphical screen. Just as a shipwright's blueprint ensures every boat is built the same way, a command-line script ensures every computer gets the exact same configuration, every time.
The shipwright also knows that his toolbox contains a specific tool for each job: a spokeshave for shaping spars, a caulking iron for sealing seams. The command line has its own equivalent — singular tools like chkdsk (Check Disk) for scanning hard drives, sfc (System File Checker) for repairing Windows system files, and gpupdate for refreshing group policies. These are the shipwright's specialised tools, each designed for one critical task. A beginner IT pro who only knows the GUI is like an apprentice who can only use a hammer — they can do a few things, but slowly and with limited precision. Learning the command line transforms that apprentice into the master shipwright, capable of diagnosing problems and executing repairs with speed, accuracy, and repeatability.
The Windows Command Line, also called the Command Prompt or cmd.exe, is a text-based interface where you type commands to perform tasks instead of clicking icons. Think of it as a direct, no-nonsense conversation with the operating system. You type a command, press Enter, and Windows obeys immediately. This is much faster than navigating through menus for repetitive tasks and is essential when the graphical interface (the desktop, start menu, and taskbar) is broken or not loaded.
The main command-line interpreter is cmd.exe, but a more powerful one called PowerShell also exists. For CompTIA A+, you need to focus on the traditional cmd commands, though a few PowerShell commands like Get-ChildItem (equivalent to dir) may appear. The command line sits on top of the operating system kernel — the core of Windows that manages memory, processes, and hardware. When you run a command like ipconfig, Windows translates that text into system calls that read the network configuration and display it back to you.
Why does this matter? Because as an IT support technician, you will often face problems that prevent the GUI from loading at all. A virus might disable the desktop. A corrupted driver might cause a black screen after boot. In those moments, the command line is your only way to interact with the computer. You can boot into the Windows Recovery Environment (WinRE), open a command prompt, and run sfc /scannow to repair system files, or bootrec /fixmbr to fix the master boot record so the computer can start again.
The exam specifically tests your knowledge of these command-line tools and their common switches (options that modify how a command works, usually preceded by a forward slash / or a hyphen -). You need to know what each command does and when to use it. Here is a breakdown of the most important commands for the 220-1202 exam:
chkdsk (Check Disk): Scans a hard drive for errors, bad sectors, and file system corruption. Common switches: /f fixes errors, /r recovers readable information from bad sectors. Used when a user reports a file won't open or the drive makes strange noises.
sfc (System File Checker): Scans and repairs protected Windows system files. The most common use is sfc /scannow, which checks every system file and replaces any that are corrupted with a cached copy from the Windows component store.
gpupdate (Group Policy Update): Forces a Windows computer to immediately download and apply the latest Group Policy settings from the domain controller. Without this, a computer might wait up to 90 minutes to get new security policies. gpupdate /force ensures all policies are reapplied regardless of whether they have changed.
gpresult (Group Policy Result): Shows which Group Policies are currently applied to a user or computer. Use gpresult /r to get a quick summary, or gpresult /h report.html to export a detailed HTML report for troubleshooting policy issues.
shutdown: Shuts down or restarts a computer from the command line. Common switches: /r restarts, /s shuts down, /t xxx sets a timer in seconds (e.g., shutdown /r /t 60 restarts in one minute). Useful for remotely restarting a machine or scheduling a restart after installing updates.
diskpart: A powerful disk partitioning tool. Running diskpart enters its own command environment. From there you can list disk, select disk 0, list partition, select partition 1, active (marks a partition as bootable), and format. Caution: one wrong command can wipe all data.
bootrec (Boot Recovery): Used to repair the Windows bootloader. Commands include bootrec /fixmbr, bootrec /fixboot, bootrec /scanos, and bootrec /rebuildbcd. This is your go-to when Windows won't start and you see errors like "Bootmgr is missing".
format: Formats a disk or partition. From a recovery environment, format c: /fs:NTFS would format the C: drive with the NTFS file system. This wipes all data, so use with extreme care.
copy, xcopy, robocopy: File copying commands. copy is basic. xcopy copies directories and subdirectories. robocopy (Robust File Copy) is the most powerful, capable of resuming interrupted copies, preserving permissions, and mirroring entire folder structures. It is the command you use for large backup operations.
dir: Lists the contents of a directory. Use dir /a to show all files including hidden and system files. Use dir /s to list files in subdirectories too.
md or mkdir: Creates a new directory (folder).
rd or rmdir: Removes (deletes) a directory.
cd or chdir: Changes the current directory. cd .. goes up one level. cd \ goes to the root of the current drive.
del or erase: Deletes one or more files. Unlike the Recycle Bin, this is permanent.
hostname: Displays the name of the computer on the network.
ping: Tests network connectivity to another device by sending ICMP packets. ping 8.8.8.8 checks if you can reach the internet or that specific IP address.
ipconfig: Shows IP address configuration. ipconfig /all shows every detail including MAC address, DHCP server, and DNS servers. ipconfig /release and ipconfig /renew are used to get a new IP address from a DHCP server.
nslookup or nslookup: Queries DNS servers to resolve a hostname like google.com to an IP address. Used to diagnose why a website won't load even when other sites work.
netstat: Displays active network connections, listening ports, and network statistics. netstat -a shows all connections and listening ports. netstat -b shows which program created each connection — essential for finding malware that is connecting to a remote server.
tracert (Trace Route): Traces the path packets take to a destination, showing each router hop. tracert 8.8.8.8 shows where a connection slows down or fails.
pathping: Combines ping and tracert to provide detailed latency and packet loss statistics for each hop.
tasklist: Displays a list of all running processes (programs and background services).
taskkill: Terminates a running process by its Process ID (PID) or image name. taskkill /f /im notepad.exe forcefully closes Notepad.
systeminfo: Shows detailed system configuration including OS version, installation date, processor, and memory.
recovery commands: From the Windows Recovery Environment, commands like bcdedit, bootsect, and diskpart are vital for fixing boot problems.
For the exam, memorise the command and its most common switch. The exam will ask questions like "Which command would a technician use to force an update of Group Policy?" The answer is gpupdate. Or "Which command repairs corrupted system files?" The answer is sfc /scannow.
Open Command Prompt as Administrator
Press the Windows key, type 'cmd', right-click 'Command Prompt' and select 'Run as administrator'. Some commands (like sfc, diskpart, and bootrec) require elevated privileges to modify system files. If you run them as a standard user, you will get an 'Access Denied' error.
Run sfc /scannow to check system file integrity
Type 'sfc /scannow' and press Enter. Windows will scan all protected system files for corruption and repair any that are damaged using a cached copy in the Windows component store. This command cannot be interrupted safely. It is the first step when Windows behaves erratically, crashes frequently, or throws file-related errors.
Run chkdsk /f on the system drive to fix file system errors
Type 'chkdsk C: /f' and press Enter. If the drive is in use (which it almost always is), you will be prompted to schedule the scan for the next system restart. Accept. This command checks the file system for logical errors (like lost clusters, cross-linked files, and directory errors) and fixes them. It is commonly run when a user reports that files cannot be opened or the computer blue-screened.
Use bootrec to repair boot configuration if Windows won't start
Boot into the Windows Recovery Environment (WinRE) from installation media or the Advanced Startup Options. Open Command Prompt from Troubleshoot > Advanced Options. Run 'bootrec /fixmbr', then 'bootrec /fixboot', then 'bootrec /rebuildbcd'. This sequence repairs the master boot record, writes a new boot sector, and rebuilds the boot configuration database. Restart the computer.
Use gpupdate /force to apply updated group policies immediately
From an elevated Command Prompt, type 'gpupdate /force' and press Enter. This tells the computer to connect to the domain controller and download any new or changed Group Policies immediately, regardless of the normal refresh interval. After the command completes, run 'gpresult /r' to verify the policies are applied correctly.
Use diskpart to prepare a hard drive for a new OS installation
From the recovery environment or a running system, type 'diskpart'. Then type 'list disk' to see all disks. Type 'select disk 0' (or the appropriate number). Type 'clean' to remove all partitions. Type 'create partition primary'. Type 'select partition 1'. Type 'active' to mark it as bootable. Type 'format fs=ntfs quick' to format. Finally, type 'assign' to give it a drive letter. This prepares a new drive for installing Windows.
Use robocopy to perform a large file migration
Open an elevated Command Prompt. Type a command like 'robocopy C:\Users\jdoe\\Desktop\\*.* D:\\Backup\\Desktop /E /R:2 /W:5'. The /E switch copies all subdirectories including empty ones. /R:2 retries twice if a file is locked. /W:5 waits five seconds between retries. This is much more robust than using copy or xcopy because robocopy can resume after network interruptions and skip files that already exist and are identical.
Let us walk through a typical morning for a level 1 helpdesk technician named Priya at a mid-sized company called "BrightPath Financial". Priya starts her day by checking the ticketing system. Ticket #7842 reads: "User Janet in Accounting says her computer is acting slow, and when she opens File Explorer, it crashes. Also, her printer stopped working yesterday."
Priya does not rush to Janet's desk. First, she uses a remote support tool to connect to Janet's computer. The remote session shows the Windows desktop, but Priya knows she can work faster by opening a command prompt as Administrator. She presses Windows+X and selects "Command Prompt (Admin)". She types tasklist and looks for any unusual processes consuming high memory. She notices a process called svchost.exe (Service Host) using 2.5 GB of RAM — that is abnormally high. She runs tasklist /svc to see which services are running inside that svchost instance. The output shows a service name that matches a known Windows Update issue. Priya decides to run sfc /scannow from the command line to check system file integrity. The scan finds corrupted files and repairs them.
Next, the printer issue. Priya suspects a corrupt print spooler service. She types net stop spooler to stop the service, then navigates to C:\Windows\System32\spool\PRINTERS using the cd command and runs del *.* to delete all stuck print jobs. Then she types net start spooler to restart the service. Both the system slowdown and the printer issue are resolved without restarting the computer.
Later that morning, a critical ticket comes in: "Server BLDG2-BACKUP won't boot. Screen shows 'Bootmgr is missing'." Priya cannot use remote tools for this. She walks to the server room, inserts a Windows installation USB, boots from it, and selects "Repair your computer". From the recovery environment, she opens the command prompt. She runs:
bootrec /fixmbr — repairs the master boot record.
bootrec /fixboot — repairs the boot sector.
bootrec /rebuildbcd — scans for Windows installations and rebuilds the Boot Configuration Data.
After this, the server boots normally. Priya closes the ticket with detailed notes about the commands used.
After lunch, the IT manager asks Priya to update the security settings on 50 workstations in the training room. Instead of logging into each one manually, she writes a simple command-line script (a batch file). She uses gpupdate /force as part of the script, then shutdown /r /t 30 to restart each machine 30 seconds after the script runs. She deploys the script using a network login script. The whole task takes 15 minutes instead of several hours.
Finally, at 4:30 PM, a user reports that they cannot open a specific shared folder on the network. Priya uses ping to test connectivity to the file server — the ping succeeds. She then uses nslookup to check DNS resolution for the server name — it resolves to the correct IP. She uses netstat -a to see if the user's computer has an active connection to the server on port 445 (the SMB port used for file sharing). It does not. She uses net use * /delete to clear any stale connections, then asks the user to reconnect. The issue is resolved.
These scenarios show real, daily use of command-line tools. IT professionals do not memorise every switch — they remember the most common patterns and use the built-in help (command /h or /?) to discover others. The exam expects you to know the exact command and its most common switch for each problem.
The 220-1202 exam tests command-line and system administration tools thoroughly. Expect at least 8–12 questions from this domain. The exam loves to present a scenario and ask "Which command should the technician use?" The key is to distinguish between commands that sound similar but do different things.
Here are the exact concepts the exam tests repeatedly:
System file repair: The exam will ask you to repair corrupted system files. The correct answer is almost always sfc /scannow. A common trap is offering chkdsk /f as an alternative — chkdsk repairs disk errors, not system files. Know the difference.
Boot repair commands: If a computer displays "Bootmgr is missing" or "Invalid boot.ini", the answer is bootrec commands. Specifically, bootrec /fixmbr and bootrec /rebuildbcd. The trap is offering sfc /scannow or chkdsk — those do not fix boot loader problems.
Group Policy management: Questions will ask you to force an immediate policy update. The correct answer is gpupdate /force. If they ask you to see what policies are applied, the answer is gpresult /r. The trap: do not confuse gpupdate (updates policies) with gpresult (displays policies).
Disk management: The exam tests diskpart commands. You need to know the sequence for making a partition bootable: list disk, select disk 0, list partition, select partition 1, active. The trap is using format without marking the partition active first — Windows won't boot from an inactive partition.
Network diagnostics: Expect questions where a user cannot access a website but other sites work. The answer is nslookup to test DNS. If the user cannot access any network resource, the answer is ipconfig /all to verify IP configuration, then ping to test connectivity. The trap is using netstat to diagnose connectivity — netstat shows active connections but does not test connectivity to a remote host.
Process management: The exam will ask how to terminate a process that is not responding. The answer is taskkill /f /im processname.exe. The trap is offering tasklist — that only lists processes, it does not kill them.
Command order and syntax: The exam tests the shutdown command with its switches. Remember: /r for restart, /s for shutdown, /t xxx for timer. A common question: "What command schedules a restart in 60 seconds?" Answer: shutdown /r /t 60.
File copying tools: The exam may ask which command is best for copying a large directory structure while preserving permissions and allowing resumption of interrupted transfers. The answer is robocopy. The trap is xcopy — while xcopy can copy directories, it does not handle network interruptions gracefully.
Recovery environment commands: In WinRE, the exam expects you to know bootrec, diskpart, bcdedit, and sfc. If the question is set in the recovery environment, sfc /scannow still works if the system drive is accessible, but bootrec is specific to boot issues.
Trap patterns to watch for:
Switch confusion: For example, shutdown /r restarts, but shutdown /s shuts down. The exam may list both as options and expect you to choose the correct one for the scenario.
Command aliases: dir and ls both list files, but ls is not a native Windows command (it exists in PowerShell). The exam sticks to traditional cmd commands, so dir is the correct answer.
Capitalisation and spacing: The exam does not care about capitalisation, but it does care about spaces. sfc /scannow is correct; sfc/scannow without a space is a syntax error that exam questions may use as a distractor.
Net command: The net command has many subcommands (net use, net share, net view, net user). The exam may ask about net use for mapping drives or net user for managing user accounts. Do not confuse these with netstat.
Key definitions to memorise:
SFC: System File Checker. Repairs protected system files.
CHKDSK: Check Disk. Scans and repairs file system errors and bad sectors.
GPUPDATE: Group Policy Update. Forces policy refresh.
GPRESULT: Group Policy Result. Displays applied policies.
BOOTREC: Boot Recovery. Repairs boot configuration.
DISKPART: Disk Partition. Manages disk partitions from the command line.
TASKKILL: Terminates processes.
ROBOCOPY: Robust File Copy. Advanced file copying with resilience.
Study these by writing them on flashcards. For each command, write the scenario on one side and the command on the other. For example, "System files corrupted" -> sfc /scannow. "Bootmgr missing" -> bootrec /fixmbr.
sfc /scannow repairs corrupted Windows system files by replacing them with cached copies from the component store.
bootrec /fixmbr and bootrec /rebuildbcd are the primary commands for fixing a missing or corrupted bootloader.
gpupdate /force forces an immediate refresh of Group Policy, bypassing the default 90-minute refresh interval.
gpresult /r displays a summary of applied Group Policies, useful for diagnosing why a setting is or is not applied.
chkdsk /f repairs file system errors and chkdsk /r locates and attempts to recover data from bad sectors.
diskpart requires a precise sequence: list disk, select disk, list partition, select partition, then active or format.
robocopy is the preferred command for copying large directory structures across a network because it can resume interrupted transfers and preserve permissions.
taskkill /f /im processname.exe forcefully terminates a process that is not responding or malicious.
ipconfig /all displays complete IP configuration including MAC address, DHCP server, and DNS servers.
nslookup queries DNS to resolve a hostname to an IP address, essential for diagnosing DNS-related connectivity issues.
These come up on the exam all the time. Here's how to tell them apart.
sfc /scannow
Repairs protected Windows system files (e.g., kernel files, DLLs)
Requires no drive access conflicts — runs on live system (but cannot repair all files if some are in use)
Does not check or repair disk surfaces or file system structure
chkdsk /f
Repairs file system logical errors (lost clusters, cross-linked files)
Usually requires a lock on the drive and schedules to run at next reboot
Does not replace corrupted system files; only fixes the file system structure
gpupdate /force
Forces the computer to connect to the domain and download latest policies
Changes the applied policies on the machine
Used after changing a policy on the server to make it take effect immediately
gpresult /r
Reports (displays) which policies are currently applied to the user and computer
Does not change any settings — it is read-only
Used to diagnose why a policy is or is not affecting a user
bootrec /fixmbr
Writes a new Master Boot Record (MBR) to the system partition
Does not scan for operating systems; just replaces the MBR code
Typically needed when the MBR is corrupted by malware or a failed dual-boot setup
bootrec /rebuildbcd
Scans all disks for Windows installations and rebuilds the Boot Configuration Data (BCD) store
Requires manual confirmation to add each found OS to the boot menu
Used when the BCD store is missing, corrupted, or misconfigured (e.g., after resizing a partition)
ipconfig /release
Releases (drops) the current IP address lease from the DHCP server
Disables the network adapter's IP configuration (sets to 0.0.0.0)
Run this first before /renew to force a fresh IP address
ipconfig /renew
Requests a new IP address lease from the DHCP server
Re-enables network connectivity with a new or renewed IP
Run this after /release to re-establish network connection
Mistake
The command line is only for advanced IT people and is not something a beginner needs to learn for the exam.
Correct
The command line is a core part of the CompTIA A+ exam and is used by entry-level helpdesk technicians daily for tasks like resetting network connections, killing stuck processes, and fixing boot errors.
Many beginners come from a consumer background where they only use a mouse and keyboard shortcuts. They mistakenly believe that since the GUI works for them, it is sufficient for IT support. The exam tests command-line proficiency precisely because the GUI is not always available.
Mistake
If a computer won't boot, the first command to try is chkdsk /f.
Correct
If a computer won't boot, the first command to try depends on the error. If the error is 'Bootmgr is missing' or 'Invalid boot.ini', the correct command is bootrec. chkdsk /f scans the file system and is appropriate if you suspect disk corruption, but it does not repair the bootloader.
Beginners often associate all boot problems with a 'corrupted hard drive', so they jump to chkdsk. However, the boot process has distinct stages: BIOS/UEFI -> MBR -> Boot Sector -> Boot Manager -> OS Loader. Most boot errors are in the boot manager or boot sector, not the file system itself.
Mistake
Typing 'help' in the command prompt will give you a full tutorial on how to use Windows commands.
Correct
Typing 'help' lists a brief summary of available commands, but it does not explain switches or provide tutorials. For detailed help on a specific command, you type the command followed by '/?' (e.g., 'dir /?'). The 'help' command is useful but limited.
New users expect the command line to be intuitive like a modern app with a manual. They do not realise that command-line help is terse and intended for people who already know the basics. The exam does not test 'help'—it tests specific commands and their switches.
Mistake
Running sfc /scannow will fix any problem with Windows, including malware infections.
Correct
sfc /scannow only repairs protected Windows system files by replacing corrupted ones with cached copies. It cannot remove malware, fix registry settings, or repair third-party software. Malware often re-infects immediately after repair. You would need a full antivirus scan and possibly a clean install.
Beginners hear 'sfc repairs Windows' and assume it is a magic fix for all problems. This misconception is dangerous because it leads to wasted time and incomplete troubleshooting. The exam tests knowing what each tool's scope is.
Mistake
gpupdate /force and gpresult /r do the same thing — they both show you the group policies applied to your computer.
Correct
gpupdate /force forces the computer to download and apply the latest Group Policies from the domain controller. gpresult /r displays the list of policies that are currently applied. They serve completely different purposes: one updates, the other reports.
The names sound similar because both contain 'gp' for Group Policy. Beginners confuse 'update' with 'result'. The exam sets traps by swapping these in scenarios, expecting you to choose the correct tool for the action needed.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Command Prompt (cmd.exe) is the older, simpler command-line interpreter that uses basic commands like dir, copy, and ipconfig. PowerShell is a more powerful shell built on the .NET framework that uses cmdlets (like Get-ChildItem) and supports object-oriented output, scripting, and automation. For the A+ exam, focus on traditional command-line commands, though you may see one or two PowerShell questions.
You can boot into WinRE by interrupting the boot process three times (turn the computer off when the Windows logo appears, three times in a row), or by booting from a Windows installation USB/DVD and selecting 'Repair your computer'. Then go to Troubleshoot > Advanced Options > Command Prompt.
No. sfc /scannow only checks and repairs protected Windows system files, typically located in C:\Windows. It does not touch your personal documents, photos, or installed programs. However, it may replace driver files if they are corrupted, which could temporarily affect a piece of hardware until you reinstall its driver.
It means you do not have sufficient permissions. Many commands (like sfc, diskpart, and net stop) require Administrator privileges. Right-click Command Prompt and select 'Run as administrator', or run the command inside an already elevated prompt.
No, the 'clean' command removes all partition and volume information from the selected disk. Once you run it, the data is gone and cannot be recovered by normal means. Only run 'clean' if you are certain the disk does not contain important data.
The /f switch fixes errors on the disk (logical file system errors). The /r switch locates bad sectors and recovers readable information — it implies /f, so it does everything /f does plus the sector recovery. Use /r if you suspect physical damage to the drive surface.
You've finished Windows Command Line and System Tools. Continue through the 220-1202 study guide to build a complete picture of the exam.
Done with this chapter?