An Old Admin Cheat Sheet vs. Windows 11 — Part 2: Consoles, RSAT, and the Commands That Fix Things
Part 1 tested the launcher layer of a twenty-year-old cheat sheet against Windows 11. Now the second table: the .msc management consoles and Active Directory tools — plus the modern command-line kit my old sheet never knew, and a funeral for wmic.
Type the name of a program, folder, document, or Internet resource, and Windows will open it for you.
If the .cpl files from Part 1 aged well, the .msc consoles aged almost perfectly. The Microsoft Management Console is the layer Microsoft never dared to rebuild — the same snap-ins, the same tree on the left, the same right-click menus that were there when my cheat sheet was written. Which means: everything you learn here works on the Windows 11 laptop and on the Server 2022 box in the rack, identically.
The consoles that never left
| Command | Console | Status |
|---|---|---|
| compmgmt.msc | Computer Management — the multitool. Event Viewer, users, shares, Device Manager, Disk Management under one roof. Right-click it → "Connect to another computer" and it manages a remote machine. | ALIVE |
| devmgmt.msc | Device Manager. | ALIVE |
| diskmgmt.msc | Disk Management — partitions, drive letters, VHD mounting. | ALIVE |
| services.msc | Services — startup types, recovery actions, log-on accounts. | ALIVE |
| eventvwr.msc | Event Viewer — still where every real diagnosis starts. | ALIVE |
| taskschd.msc | Task Scheduler — wasn't on my old sheet, absolutely belongs on yours. | ALIVE |
| lusrmgr.msc | Local Users and Groups (Pro and up — Home edition refuses). | ALIVE |
| gpedit.msc | Local Group Policy Editor (Pro and up). | ALIVE |
| secpol.msc | Local Security Policy — password policy, audit policy, user rights. | ALIVE |
| certmgr.msc | Certificates — current user store. | ALIVE |
| certlm.msc | Certificates — local machine store. Newer than my sheet (Windows 8.1) and the one you usually mean when a service can't find its cert. | ALIVE |
| fsmgmt.msc | Shared Folders — who has which file open over SMB, and the fastest way to close a stuck handle. | ALIVE |
| perfmon.msc | Performance Monitor. Its younger sibling resmon answers "what is hammering the disk" faster. | ALIVE |
| wf.msc | Windows Defender Firewall with Advanced Security — the real rule editor behind firewall.cpl. | ALIVE |
| wmimgmt.msc | WMI Control. The console outlived its own command-line client — see the obituary below. | ALIVE |
The sheet's casualties on this table are exactly three: dfrg.msc (defragmentation — today dfrgui, though on SSDs Windows schedules TRIM itself), ntmsmgr.msc (Removable Storage Manager, removed back in Vista — I had to look up what it even was), and rsop.msc, which still opens but has been deprecated for years; gpresult below does its job better.
The Active Directory shelf — now called RSAT
The old sheet's AD table — dsa.msc, dnsmgmt.msc, dssite.msc, domain.msc, dhcpmgmt.msc — works unchanged on Server 2022. On a Windows 11 admin workstation those consoles aren't installed by default; they come with the Remote Server Administration Tools, which since Windows 10 1809 are optional features you install per-tool. No download hunting; one line per capability:
# see what's available / installed Get-WindowsCapability -Online -Name "Rsat*" | Select Name, State # the AD console pack (dsa.msc, dssite.msc, domain.msc ...) Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" # DNS, DHCP, Group Policy Management (gpmc.msc) Add-WindowsCapability -Online -Name "Rsat.Dns.Tools~~~~0.0.1.0" Add-WindowsCapability -Online -Name "Rsat.DHCP.Tools~~~~0.0.1.0" Add-WindowsCapability -Online -Name "Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0"
Two notes from the field. First, the biggest omission on my old sheet: gpmc.msc, the Group Policy Management Console — in any domain job you'll open it daily; gpedit.msc only edits the local policy. Second, the sheet's pkmgmt.msc ("Public Key Management") no longer exists under that name; its modern descendant is pkiview.msc, Enterprise PKI on a CA. And certsrv.msc, dfsgui.msc→dfsmgmt.msc, rrasmgmt.msc all still greet you on any server carrying those roles.
Microsoft would prefer you use Windows Admin Center or the Server Manager dashboard for much of this. Both are fine. But when a domain controller is misbehaving at 2 a.m., dsa.msc plus muscle memory beats a web dashboard that first wants to update itself.
What the old sheet was missing: commands that fix things
Everything so far opens a tool. The modern half of my toolkit doesn't open anything — it diagnoses and repairs directly. These are the ones I'd tattoo onto a new admin's terminal, in the order I actually reach for them:
# 1. repair the component store first ... DISM /Online /Cleanup-Image /RestoreHealth # 2. ... then let SFC repair system files from it sfc /scannow
Order matters and almost every tutorial gets it backwards: sfc repairs system files from the component store, so if the store itself is damaged, run DISM first or SFC repairs from a broken source.
# forgotten Wi-Fi password, in plain text netsh wlan show profile name="OfficeWLAN" key=clear # the classic "network is haunted" reset pair (reboot after) netsh int ip reset netsh winsock reset # DNS lies, part 1 and 2 ipconfig /flushdns ipconfig /displaydns | more # which process owns that port netstat -ano | findstr :443
# what policies actually applied to this machine/user gpresult /r gpupdate /force # Entra ID / hybrid join state — first stop for every SSO mystery dsregcmd /status # who am I, with groups and privileges — SIDs included whoami /all # who else is logged on to this box quser
# update (almost) everything installed, one line winget upgrade --all # why is this laptop's battery suddenly terrible powercfg /batteryreport # reboot straight into UEFI setup — no F2-hammering at boot shutdown /r /fw /t 0
Windows 11 24H2 even added a real sudo (enable it under Settings → System → For developers). sudo netstat -ab from an unelevated terminal feels deeply wrong and deeply right at the same time.
Obituary: wmic, ~2002–2026
One entry from the old toolbox deserves a formal goodbye. wmic — the WMI command line that generations of admins used for wmic bios get serialnumber — is gone: removed by default in Windows 11 24H2, stripped out on upgrade to 25H2, and after the next feature update it won't even be installable as a Feature on Demand. WMI itself lives on; only the tool is dead. The replacement is PowerShell, and honestly, it's better:
# wmic bios get serialnumber Get-CimInstance Win32_BIOS | Select SerialNumber # wmic os get lastbootuptime Get-CimInstance Win32_OperatingSystem | Select LastBootUpTime # wmic product get name (which you should never have run anyway) winget list
If you still have scripts calling wmic — and every shop my age does — this is the year they finally get ported, not because the new way is fashionable but because the old binary is literally being deleted.
GUIs are furniture. Consoles and commands are load-bearing walls.
Final score for a cheat sheet old enough to vote: of its ~45 commands, roughly three quarters run unmodified on Windows 11 in 2026, and most of the casualties died with Internet Explorer or XP's wizards. That's a better compatibility record than any GUI, any API, and frankly most of my own code. If you're starting out in Windows administration: learn the Settings app, sure — but learn the layer beneath it, because that layer demonstrably outlives the paint jobs. Start your own sheet with the ten commands from this series you'll actually use. Then mail it to yourself. See you in twenty years.