Here are 100 advanced tips and tricks for Windows 10 and 11.

Advanced Windows Tips & Tricks (IT / MSP Level)

Index

🧠 System Administration & Control

Use gpedit.msc to enforce local group policies.
Use rsop.msc to view Resultant Set of Policy.
Use secpol.msc for local security policies.
Use lusrmgr.msc to manage local users/groups (Pro+).
Use whoami /groups to verify permissions.
Use net user username /active:no to disable accounts.
Use net localgroup administrators to audit admin users.
Use wmic useraccount get name,sid for SID mapping.
Use control userpasswords2 for advanced user control.
Use runas /user:domain\admin cmd to elevate without logout.

⚡ PowerShell & Automation

Use PowerShell profiles to load scripts automatically.
Run Get-ExecutionPolicy and set to RemoteSigned if needed.
Use Get-Process | Sort CPU -Descending to find heavy apps.
Use Get-Service | Where-Object {$_.Status -eq "Running"}
Use Invoke-Command for remote execution.
Use Enter-PSSession for remote shell access.
Use Get-WmiObject / Get-CimInstance for system queries.
Automate installs using PowerShell + winget.
Use Scheduled Tasks with PowerShell scripts.
Use Export-Csv for reporting.

🛡️ Security Hardening

Enable LSA Protection via registry.
Disable SMBv1 (security risk).
Use auditpol /get /category:* for auditing.
Enable Advanced Audit Policies.
Use AppLocker or WDAC for application control.
Disable NTLM where possible.
Enforce password complexity via GPO.
Enable Credential Guard.
Enable Exploit Protection settings.
Use Microsoft Defender Advanced Hunting queries.

🌐 Networking & Troubleshooting

Use netsh wlan show profiles to view saved WiFi.
Use netsh wlan export profile to backup WiFi configs.
Use route print to view routing table.
Use tracert for path analysis.
Use pathping for packet loss detection.
Use arp -a to view ARP table.
Use nslookup for DNS debugging.
Use Wireshark for deep packet inspection.
Reset TCP stack: netsh int ip reset
Reset Winsock: netsh winsock reset

💾 Disk & Storage Management

Use diskpart for advanced disk control.
Use list disk / select disk / clean carefully.
Convert MBR to GPT with mbr2gpt.exe.
Use Storage Spaces for redundancy.
Use chkdsk /f /r for disk repair.
Use fsutil for file system control.
Check disk usage with du (Sysinternals).
Use VHD mounting for backups.
Use ReFS for data integrity (servers).
Enable BitLocker with TPM + PIN.

🖥️ Performance Optimization

Use Resource Monitor (resmon) for deep analysis.
Use Performance Monitor (perfmon) counters.
Disable SysMain (Superfetch) on SSD-heavy systems.
Analyze boot time with Event Viewer → Diagnostics-Performance.
Use Autoruns (Sysinternals) to disable hidden startup apps.
Use Process Explorer instead of Task Manager.
Use Process Monitor for real-time file/registry tracking.
Adjust virtual memory manually for heavy workloads.
Disable unnecessary services via GPO.
Use GPU scheduling (Hardware-accelerated GPU scheduling).

🧰 Sysinternals Suite (Must Know)

Use Autoruns for startup control.
Use PsExec for remote command execution.
Use PsKill to terminate stubborn processes.
Use PsList for process info.
Use TCPView for live connections.
Use Handle.exe to find file locks.
Use AccessChk for permission auditing.
Use Sigcheck to verify file signatures.
Use RAMMap to analyze memory usage.
Use BgInfo for system info on desktop.

🧩 Windows Deployment & Imaging

Use DISM to service Windows images.
Use dism /online /cleanup-image /restorehealth regularly.
Capture images with dism /capture-image.
Use Windows Autopilot for device provisioning.
Use Sysprep before imaging systems.
Use Unattend.xml for automated installs.
Use WDS or MDT for deployments.
Use winget import/export for app setups.
Use Provisioning Packages (.ppkg).
Use Azure AD Join + Intune policies.

🔐 Identity & Access (Modern IT)

Use Azure AD / Entra ID conditional access.
Enforce MFA for all users.
Use Privileged Identity Management (PIM).
Audit sign-ins via Entra logs.
Use device compliance policies (Intune).
Use SSO integrations for SaaS apps.
Use passwordless authentication.
Monitor risky sign-ins.
Use Defender for Identity.
Use Just-in-Time (JIT) admin access.

🧯 Troubleshooting & Recovery

Use sfc /scannow + DISM combo for OS repair.
Use Safe Mode with Networking for malware cleanup.
Use System Restore via rstrui.exe.
Use Startup Repair (WinRE).
Analyze crashes with BlueScreenView or WinDbg.
Use Reliability Monitor (perfmon /rel).
Check logs in Event Viewer.
Use Reset this PC (keep files) when needed.
Use offline Defender scan for rootkits.
Keep a bootable USB toolkit (WinPE, tools, drivers).

Author: Ryan C. Smith

Ryan C. Smith

Enterprise IT management for Bay Area businesses. San Ramon headquartered. Serving Fremont, Oakland, Hayward, San Jose, and beyond since 1996.

Services

Fully Managed IT
Co-Managed IT
Cybersecurity Compliance
Cloud Migration (Azure)
IT Helpdesk Support
Business Continuity

Industries

Healthcare / HIPAA
Legal Firms
Defense Contractors
Manufacturing
Professional Services

Company

About Blackhawk MSP
Our Team
Case Studies
Contact Us
Free Security Audit

© 2025 Blackhawk MSP · San Ramon, CA · Managed IT Services for the Bay Area

Privacy Policy · Terms of Service