Windows administration is the part of the job nobody writes on a CV and everybody does. A server gets built, joined to a domain, given the four or five tools you cannot work without, and then left alone until something breaks. These are the posts covering that work, collected in one place.
The PowerShell side of the same job lives in the PowerShell Complete Guide, and if you are running Linux tooling on a Windows machine, the WSL Complete Guide covers that end.
The Guides
🖥️ Windows Server & Domains
📦 Installing Your Toolkit
⌨️ Terminal & Shell
🧹 Housekeeping & Fixes
The Commands Worth Knowing by Heart
| Command | What it answers |
|---|---|
systeminfo | Build, uptime, domain, patches and memory in one screen. First thing to run on a box you have never seen. |
whoami /groups | Which groups your token actually carries. Answers most “access denied” questions before you start guessing. |
gpresult /r | Which Group Policy objects applied, and which did not. The other half of an access-denied answer. |
sfc /scannow | Verifies protected system files and repairs them from the local store. |
DISM /Online /Cleanup-Image /RestoreHealth | Repairs the component store itself. Run it before sfc when sfc cannot fix what it finds. |
netstat -ano | Every listening port with the owning process id. Pair it with tasklist to name the process. |
tasklist /svc | Processes with the services running inside them, which matters when several share a svchost. |
sc query <name> | Service state without opening the MMC console. |
nltest /dsgetdc:<domain> | Which domain controller this host is actually talking to. Useful when a domain join looks fine but behaves oddly. |
Two Habits That Save You
Write down what the box looked like before you changed it. A screenshot of
systeminfo and the output of gpresult /r costs ten seconds and turns
“it used to work” into something you can actually compare against.
Check DNS first, every time. A surprising share of domain, authentication and “the server is not reachable” problems are one wrong resolver on the network adapter. It is the cheapest thing to rule out and the most common thing to find.
Frequently Asked Questions
Server Core or the full desktop experience?
Core if the box does one job and you administer it remotely, which is the normal case for a database or application server. The smaller install surface means fewer patches and fewer reboots. Take the desktop experience when software insists on a GUI installer, and check that before you build rather than after.
Why does a domain join succeed but authentication still fail?
Almost always DNS. A domain member has to resolve the domain’s SRV records, so its DNS server must be a domain controller or forward to one. Setting a public resolver on a domain-joined host is the classic cause. nltest /dsgetdc:<domain> tells you which controller it found, if any.
Is a package manager worth it on a server?
On a workstation, clearly. On a server it depends on whether you are allowed unattended downloads from the internet, which in a lot of estates you are not. Where it is allowed, scripted installs make a rebuild repeatable, and repeatable beats fast.
Can I delete the Windows.old folder safely?
Yes, once you are sure you will not roll the upgrade back, and Windows removes it on its own after ten days anyway. Use Disk Cleanup or Storage Sense rather than deleting the folder by hand, because parts of it are owned by TrustedInstaller and a manual delete tends to leave fragments behind.
Leave a Reply