🛠️ Windows Technical Maintenance Cheat Sheet

For Windows troubleshooting, system maintenance, and basic network diagnostics

Run Command Prompt or PowerShell as Administrator unless otherwise noted.

---

1. 📦 Update Installed Applications

winget upgrade --all

Purpose: Updates applications managed by Windows Package Manager.

Useful commands:

winget upgrade

List applications with available updates.

winget list

List installed applications recognized by WinGet.

winget upgrade --all --include-unknown

Attempt to update packages where the installed version cannot be reliably determined.

---

2. 🔧 Windows System File Checker

sfc /scannow

Purpose: Scans protected Windows system files and attempts to repair corrupted or modified files.

Check only:

sfc /verifyonly

Typical use: Run this when Windows is behaving strangely, applications are crashing, or system components appear damaged.

---

3. 🧰 DISM Component Store Repair

DISM /Online /Cleanup-Image /RestoreHealth

Purpose: Checks the Windows component store and repairs corruption.

Useful progression:

DISM /Online /Cleanup-Image /CheckHealth

Quick check for previously detected corruption.

DISM /Online /Cleanup-Image /ScanHealth

Performs a more detailed scan.

DISM /Online /Cleanup-Image /RestoreHealth

Attempts to repair detected corruption.

Recommended order

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM can repair the component store that SFC may rely on for repairs.

---

🔋 4. Battery Diagnostics

powercfg /batteryreport

Creates an HTML battery report, normally in your Windows user directory.

To specify a location:

powercfg /batteryreport /output "%USERPROFILE%\Desktop\battery-report.html"

Useful information includes:

• Design capacity

• Full-charge capacity

• Battery cycles

• Recent battery usage

• Battery capacity history

• Estimated battery life

Additional power diagnostics

powercfg /energy

Generates a power-efficiency diagnostic report.

---

🌐 5. DNS Cache

ipconfig /displaydns

Displays the DNS records currently cached by the Windows DNS Client.

Clear DNS cache

ipconfig /flushdns

Useful when troubleshooting:

• DNS resolution problems

• Recently changed DNS records

• Access to websites by hostname

• Local DNS inconsistencies

Additional network commands

ipconfig /all

Detailed adapter configuration.

ipconfig /release
ipconfig /renew

Release and renew DHCP configuration.

nslookup example.com

Perform a DNS lookup.

---

🖧 6. MAC Address / Network Adapter Information

getmac /v

Displays MAC addresses along with adapter information.

A more detailed alternative:

ipconfig /all

Look for:

Physical Address

PowerShell alternative

Get-NetAdapter

For additional information:

Get-NetAdapter | Format-List *

---

🔍 7. Useful Network Diagnostics

Test connectivity

ping 8.8.8.8

Tests basic IP connectivity.

Test DNS + connectivity

ping google.com

If 8.8.8.8 works but google.com doesn't, investigate DNS.

Trace network path

tracert google.com

Shows the path packets take toward the destination.

View active connections

netstat -ano

Shows connections, listening ports, and associated PIDs.

PowerShell:

Get-NetTCPConnection

---

🛡️ 8. Windows Defender Status

PowerShell as Administrator:

Get-MpComputerStatus

Check Defender detections:

Get-MpThreatDetection

Start a Defender scan:

Start-MpScan -ScanType QuickScan

For a full scan:

Start-MpScan -ScanType FullScan

---

💻 9. System Information

systeminfo

Useful for quickly collecting:

• Windows version

• Build number

• Hostname

• Installed RAM

• Boot time

• Domain/workgroup

• Hotfix information

• Network configuration

PowerShell:

Get-ComputerInfo

---

🔐 10. Logged-On Users

query user

Shows interactive Windows sessions.

Also useful:

whoami

Current user.

whoami /all

Displays the user's groups, privileges, and security information.

---

⚡ Quick Maintenance Runbook

For a periodic check, I would use:

winget upgrade --all

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

ipconfig /flushdns

ipconfig /all

getmac /v

systeminfo

Then, from PowerShell as Administrator:

Get-MpComputerStatus
Get-NetAdapter

🧪 Cyber/Hacking Laptop Tip

For a dedicated security-testing laptop, I'd also keep system integrity, Defender status, network configuration, listening ports, and installed software documented. That gives you a useful baseline when something changes unexpectedly.

Quick reference:

Task	Command
Update apps	winget upgrade --all
Repair system files	sfc /scannow
Repair component store	DISM /Online /Cleanup-Image /RestoreHealth
Battery report	powercfg /batteryreport
DNS cache	ipconfig /displaydns
Clear DNS	ipconfig /flushdns
MAC addresses	getmac /v
Network config	ipconfig /all
Connections/ports	netstat -ano
System information	systeminfo
Current user	whoami /all
User sessions	query user
Defender status	Get-MpComputerStatus
Network adapters	Get-NetAdapter

Would you like the next version as a one-page printable cheat sheet, Kali-vs-Windows command comparison, or Windows hacking/forensics command sheet?

 Monitor DNS and SNI

Wireshark

tls.record.content_type==22

DNS Monitor

# IMPORTANT: This script was created used ChatGPT. Use at your own risk.

from scapy.all import sniff

from scapy.layers.dns import DNS, DNSQR

from datetime import datetime

LOG_FILE = "dns_log.txt"

# Optional: domains you want highlighted

BLOCKLIST = [

    "adult",

    "porn",

    "gambling",

    "casino",

]

seen = set()

def process_packet(packet):

    if packet.haslayer(DNSQR):

        try:

            domain = packet[DNSQR].qname.decode("utf-8").rstrip(".")

            # Avoid duplicate spam

            now_minute = datetime.now().strftime("%Y-%m-%d %H:%M")

            unique_key = f"{now_minute}:{domain}"

            if unique_key in seen:

                return

            seen.add(unique_key)

            timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")

            warning = ""

            for word in BLOCKLIST:

                if word.lower() in domain.lower():

                    warning = " [POTENTIALLY INAPPROPRIATE]"

                    break

            log_entry = f"[{timestamp}] {domain}{warning}"

            # Print to screen

            print(log_entry)

            # Save to file

            with open(LOG_FILE, "a", encoding="utf-8") as f:

                f.write(log_entry + "\n")

        except Exception as e:

            print(f"Error processing packet: {e}")

print("DNS monitor started...")

print(f"Logging to: {LOG_FILE}")

print("Press CTRL+C to stop.\n")

# Sniff DNS traffic (UDP port 53)

sniff(filter="udp port 53", prn=process_packet, store=False)

SNI Monitor

# IMPORTANT: This script was created used ChatGPT. Use at your own risk.

from scapy.all import sniff, TCP, Raw

from datetime import datetime

LOG_FILE = "sni_log.txt"

def extract_sni(payload):

    try:

        data = bytes(payload)

        # TLS Handshake check

        if len(data) < 5:

            return None

        # TLS Handshake record

        if data[0] != 0x16:

            return None

        pos = 43

        # Session ID

        session_id_length = data[pos]

        pos += 1 + session_id_length

        # Cipher Suites

        cipher_suites_length = int.from_bytes(data[pos:pos+2], 'big')

        pos += 2 + cipher_suites_length

        # Compression Methods

        compression_methods_length = data[pos]

        pos += 1 + compression_methods_length

        # Extensions

        extensions_length = int.from_bytes(data[pos:pos+2], 'big')

        pos += 2

        end = pos + extensions_length

        while pos + 4 <= end:

            ext_type = int.from_bytes(data[pos:pos+2], 'big')

            ext_length = int.from_bytes(data[pos+2:pos+4], 'big')

            pos += 4

            # SNI Extension

            if ext_type == 0x0000:

                sni_data = data[pos:pos+ext_length]

                # Skip list length + name type

                server_name_length = int.from_bytes(sni_data[3:5], 'big')

                server_name = sni_data[5:5+server_name_length]

                return server_name.decode(errors="ignore")

            pos += ext_length

    except Exception:

        return None

    return None

def packet_callback(packet):

    if packet.haslayer(TCP) and packet.haslayer(Raw):

        payload = packet[Raw].load

        sni = extract_sni(payload)

        if sni:

            timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")

            line = f"[{timestamp}] {sni}"

            print(line)

            with open(LOG_FILE, "a") as f:

                f.write(line + "\n")

print("Listening for TLS SNI traffic...")

sniff(filter="tcp port 443", prn=packet_callback, store=False)

STOP POSTING PICTURES WITH YOUR METADATA IN FULL VIEW 

remove meta data from jpg on macOS using Terminal

you will need Brew install on your mac

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

install ExifTool

brew install exiftool

open terminal and change directory to the location of files you wish to remove meta data

Terminal commands

this will display the metadata in your file

exiftool your_file.jpeg

removed all metadata from your file

exiftool -all= -overwrite_original your_file.jpeg 

Extra Paranoid removal

exiftool -all= --icc_profile:all -m -overwrite_original *.jpeg

validate your metadata has been removed

exiftool "your_file.jpg" | grep -i "gps\|location\|date\|camera\|iphone"

Pro-Tip, remove all metadata in files in a directory

exiftool -all= -overwrite_original -r *.jpeg *.jpeg *.png *.heic 2>/dev/null && echo "All metadata stripped ✅"

STOP POSTING PICTURES WITH YOUR METADATA IN FULL VIEW

 My Brew install list

Brew install btop

Brew install nvtop

Brew install asitop

Brew install duf

Brew install cool-retro-term

Brew install mtr

Brew install glances

brew install termshark

brew install lsof

brew install ipcalc

more to come, if you don't know what these do, google is your friend. I recommend you install them and geek out on them

 Linux grep Commands

V grep "example" my.txt search for "example" in "my.txt" 

V grep "example" * txt search for "example" in all ".txt" files 

V grep-i "example" my.txt search for "example" while ignoring cases 

V grep-c "example" my.txt count # of lines that contain "example" 

V grep-n "example" my.txt show line numbers along with matched lines v grep-r "example" '. search for "example" in all files recursively grep-v "example" my.txt display lines that do not contain "example" 

V grep-w "example" search for lines containing "example" as a full word 

V grep -e "key1" -e "key?" my.txt show lines containing either pattern 

V grep-v-e "key1" -e "key2" my.txt show lines containing neither pattern 

V grep "key1"key2" my.txt display lines contain both "key1" and "key?"

V grep -E "errorlwarning" app.log use extended regex for matching 

V grep -E "^[a-zA-Z]" my.tt another extended regex example v grep-m3 "keyword" my.txt limit grep output to a fixed number of lines 

V grep-A2-B2 "example" my.txt show 2 lines before and after match v grep -C3 "error" server.log show 3 lines before and after match grep- "spoofing" my.txt show lines that exactly match a string 

V grep- "example" * display file names that match the pattern 

V grep "^hello" my.txt show all lines that start with "hello" 

V grep "done$" my.txt show all lines that end with "done" grep-o "begin."end" my.txt show only the matched string v grep -color "example" my.txt display matches with color v grep "[0-9]" my.txt show all lines that contain any digits grep-a "string" my.bin search for a string in a binary file

 

Useful Wireshark filters

• ip.addr == 10.0.0.1: Show all traffic with 10.0.0.1 as either source or destination.
• ip.addr == 10.0.0.0/24: Show all traffic to and from any address in 10.0.0.0/24.
• ip.src == 10.0.0.1 && ip.dst == 10.0.0.2: Show all traffic from 10.0.0.1 to 10.0.0.2.
• ! ip.addr == 10.0.0.1): Exclude all traffic to or from 10.0.0.1.
• iсmp.type == 3: Show ICMP "destination unreachable" packets.
• tcp or udp: Show TCP or UDP traffic.
• tcp.port == 80: Show TCP traffic with port 80.
• tcp.srcport < 1000: Show TCP traffic with source port range.
• http or dns: Show all HTTP or DNS traffic.
• tcp.flags.syn == 1: Show TCP packets with SYN flag set.
• tcp.flags == 0x012: Show TCP packets with both SYN and ACK flags set.
• tcp.analysis.retransmission: Show all retransmitted TCP packets.
• http.request.method == "GET": Show TCP packets associated with HITP GET.
• http.response.code == 404: Show packets associated with HTTP 404 response.
• http.host == www.abc.com: Show HTTP traffic matching the Host header field.
• tls.handshake: Show only TLS handshake packets.
• tis.handshake.type == 1: Show client Hello packet during TLS handshake.
• dhep and ip.addr == 10.0.0.0/24: Show DHCP traffic for 10.0.0.0/24 subnet.
• dhcp.hw.mac_addr == 00:11:22:33:44:55: Show DHCP packets for client MAC address.
• dns.resp.name == cnn.com: Show DNS responses with name field of "cnn.com".
• frame contains keyword: Show all packets that contain the word "keyword".
• frame.len > 1000: Show all packets with total length larger than 1000 bytes.
• eth.addr == 00:11:22:33:44:55: Show all traffic to or from the specified MAC address.
• eth[0x47:2] == 01:80: Match Ethernet frames with 2 bytes at offset 0x47 == 01:80.
• !(arp or icmp or stp): Filter out background traffic from ARP, ICMP, and STP.
• vlan.id == 100: Show packets with VLAN ID 100.

 DEFCON 31

See ya at the wall of sheep