Windows Administration Cheatsheet

2026-09-20

Powershell case-insensitive, можно все вводить в lowercase

	Linux (sh)	Windows (powershell)	Как работает
Services	`systemctl start/stop/enable` `journalctl -u svc`	`sc.exe start/stop/query` `Get-Service \\| Start-Service`	SCM => `HKLM\SYSTEM\CurrentControlSet\Services`
Scheduler (cron)	`crontab -e` `0 * * * * /script.sh` `at`, `anacron`	`schtasks /create /sc HOURLY` `Register-ScheduledTask` `taskschd.msc`	Task Scheduler Service `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule`
Firewall (iptables)	`iptables -A INPUT -p tcp --dport 80 -j ACCEPT` `nft add rule inet filter` `ufw allow 80/tcp`	`netsh advfirewall firewall add rule` `New-NetFirewallRule -Port 80`	WFP - Windows Filtering Platform `BFE` service => `fwpkclnt.sys` `FwpmFilterAdd()`
Network / netns	`ip netns add myns` `ip link set eth0 netns myns` `ss -tulpn`, `ip route`	`netsh interface / routing` `Get-NetAdapter`, `Get-NetRoute` `netstat -ano`	NDIS / WFP callout drivers HNS (Hyper-V Network Service) `nsi.dll` => NSI kernel driver
Processes (ps/strace)	`ps aux`, `top`, `htop` `strace -p PID` `lsof -p PID` `kill -9`	`tasklist`, `taskkill /PID /F` `Get-Process`, `Stop-Process` `handle.exe`, `procmon` (Sysinternals)	`NtQuerySystemInformation` `PsLookupProcessByProcessId` `PsSetCreateProcessNotifyRoutineEx`
Registry (/etc, sysctl)	`/etc/`, `sysctl -w` `/proc/sys/`, `/sys/` environment variables	`reg query/add/delete` `Get-ItemProperty HKLM:\...` `regedit`	`CmRegisterCallback` `ZwOpenKey` / `ZwQueryValueKey` Configuration Manager
Logs (journald/auditd)	`journalctl -f` `tail -f /var/log/syslog` `auditd + ausearch`	`Get-EventLog`, `wevtutil` `Get-WinEvent -LogName Security` `eventvwr.msc`	ETW - Event Tracing for Windows `EtwRegister` / `EtwWrite` главный канал данных EDR

(1) services ( linux=systemd )

(sc.exe query type=all | findstr /i "SERVICE_NAME").get_count()

Get-Service <service_name>

sc.exe start/stop X

#свой сервис, будет хранится в registry : HKLM\SYSTEM\CurrentControlSet\Services\MY_SERVICE
sc.exe create MY_SERVICE binPath="c:\folder" start=auto
sc.exe description MY_SERVICE "ADDING DESCRIPTION"
sc.exe start MY_SERVICE

#посмотреть зависимости
sc.exe qc <service_name> 

#journalctl -u scm | tail -n20
Get-EventLog -LogName System -Source "Service Control Manager" -Newest 20

(2) schtasks ( linux=cron )

#every hour
schtasks /create /tn "TASKNAME" /tr "c:\script.ps1" /sc HOURLY /mo 1

#launch on load
schtasks /create /tn "tASKNAME" /tr "c:\script.ps1" /sc ONSTART

#on user X logon
... /sc ONLOGON /ru "X"

#listing/deleting
schtasks /query /fo LIST /v
schtasks /delete /tn "taskname" /f

#scripting

$trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -Once -At (Get-Date)

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-File C:\script.ps1"

Register-ScheduledTask -TaskName "MyTask" -Trigger $trigger -Action $action -RunLevel Highest

(3) firewall (linux=iptables/ufw)

#ufw status verbose
netsh advfirewall firewall show rule name=X/all

#allow in tcp/8080
netsh advfirewall firewall add rule name="in_tcp_8080" dir=in action=allow protocol=TCP localport=8008

#block out to ip=X
netsh advfirewall firewall add rule name="out_block_X" dir=out action=block protocol=TCP remoteip=X

#delete rule
netsh advfirewall firewall delete rule name="out_block_X"

#scripting
New-NetFirewallRule -DisplayName "name" -Direction Inbound -protocol tcp -localport 8080 -action allow

Get-NetFirewallRule | Where-Object {$_.Enabled -eq "True"}

Remove-NetFirewallRule -DisplayName "name"

(4) netsh/Get-Net* (linux=ip)

#ip l
Get-NetAdapter

#ip route
get-netroute
route print 

#ss -tulpn / netstat
netstat -ano 
get-netTCPconnection | where-object {$_.State -eq "Listen"} #where-object ~= grep

#dns 
resolve-dnsname google.com 
nslookup google.com

#tcpdump встроенного нет, можно
netsh trace start capture=yes tracefule=C:\outfile
netsh trace stop
# //
pktmon start --capture -f c:\capture
pktmon stop

(5) processes (linux=ps/strace/lsof)

#ps aux
# sort-object, select-object ~= awk / perl
get-process | sort-object cpu -descending | select-object -first 20 # | head -n20

#lsof -p открытые файлы процесса
#sysinternals suite - add to PATH
handle.exe -p notepad.exe

#loaded DLLs 
get-process notepad | select-object -expandproperty modules/handle/handles/...

(get-process notepad).modules | ft filename, modulename #ft = awk

#kill
stop-process -id 1234 -force
taskkill /pid 1234 /f

#wmic 
wmic process where "name='notepad.exe'" get processid, commandline, executablepath

(6) registry (linux=/etc ?)

#read
get-itemproperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -name productname

#write
set-itemproperty "HKCU:\Software\X" -name "SomeSetting" -Value "1"

#create key
new-item "hklm:\software\x" -force

#enum keys
get-childitem "HKLM:\SYSTEM\CurrentControlSet\Services"

#autostart ~= systemd enable
reg ad "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "X" /t REG_SZ /d "C:\X.exe"

(7) logs (linux=journalctl)

Logs are powered by ETW (Event Tracing for Windows). EDRs lean heavily on using ETW .

#system events (journalctl)
get-eventlog -logname system -newest 50
get-eventlog -logname security -newest 50 | where-object {$_.EventID -eq 4624} #logins

#etw    == auditd 
#logman == etw session control
logman query providers # to enum ETW telemetry sources
#PS C:\Users\user> logman query providers | findstr /i "process"
#Microsoft-Windows-Kernel-Process         {22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}
#Microsoft-Windows-Kernel-Processor-Power {0F67E49F-FE51-4E9F-B490-6F2948CC6027}
#Microsoft-Windows-ProcessExitMonitor     {FD771D53-8492-4057-8E35-8C02813AF49B}
#Microsoft-Windows-Processor-Aggregator   {CBA16CF2-2FAB-49F8-89AE-894E718649E7}
#Microsoft-Windows-ProcessStateManager    {D49918CF-9489-4BF1-9D7B-014D864CF71F}
#Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor {DC84BBF4-CDED-56EF-BF3B-E2051D5589D5}
#UMDF - Host Process Trace                {485E7DF0-0A80-11D8-AD15-505054503030}

logman query providers | findstr /i "process"

logman start mysession -p "Microsoft-Windows-Kernel-Process" -o c:\trace.etl -ets
logman stop mysession -ets

#to analyze the .etl file:
tracerpt c:\trace.etl -o c:\trace.xml -of XML