Sometimes I forget how the exact syntax of a CMD command looks and then I would like to search my own CMD history. Clearly, within the same session, you can browse it with the up and down arrow keys but what about the history of former CMD sessions? Is there a file, a log the history gets written to or does it all go to digital Nirvana?
Thanks!
Not natively but check out: http://mridgers.github.io/clink/ , makes cmd.exe much more productive. Quoting features from the project page:
No, Windows command prompt history can't be saved when a session ends.
Massimo is correct that your command prompt history does not persist across sessions. You could manually grab this before closing your prompt by typing doskey /history > history.txt
Or... you could use PowerShell as your CMD prompt, and follow this post to persist your history across sessions.
You can use clink.
Easiest way to install clink is using chocolatey. Once you install chocolatey, you can install clink by typing
Starting from the next time you start cmd.exe, it should store history across sessions.
It is possible to save the current history to file,
But it seems there is no way to load it back as history. It is possible only to use a command line argument to load and execute all lines,
cmd.exe /K somefile.txt
, what can be useful to load a list of doskey macros. This invocation could be included in a shortcut so you don't need to type it everytime; this reference has some additional info on this approach.
There is a similar question on Superuser that bring some alternatives, including clink, as suggested by @RobertBak.
Yes, it's possible
If all you want to do is save your command line history at the end of every session, here's a simple way to do it:
As other answers indicated,
doskey
allows you to list the command line history for the current session. It also allows you to create macros.This simple macro will save the command line history when you exit a
CMD
session:This creates a macro that remaps the
EXIT
command to copy the command line history into your user profile folder (e.g.,C:\Users\yourname\commands.log
). Unfortunately, you won't be able to easily go back to any of these entries by pressing the up arrow, but you can examine the file at any point to see what you did in the past.Autoloading
So that's the easy part. The tricky part is autoloading that doskey macro when you start a new command session. The short and dangerous answer is to just add it to the REGISTRY in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
. Anything you put in this entry will be run when you start aCMD
session.While that will work, it will definitely create unexpected side effects when doing any kind of scripting*.
So here's how I do it:
Create a file called
autoexec.bat
and store it in your profile folder (e.g.,C:\Users\yourname\autoexec.bat
). Then change the value ofHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor\AutoRun
to this:So yes, this batch file will run every time a
CMD
session is opened, but we'll do a trick to make sure it doesn't run in any subprocesses. Here is what you put in theautoexec.bat
file:How does this avoid those unexpected side effects?
All we're doing is creating an environment variable called
AUTOEXEC
. Then, when any subsequent subprocesses open a command session, they will run into the second line and immediately exit the script! This is because subprocesses automatically inherit the environment variables from the parent process.But wait, there's more!
This allows you to add as many macros as you want to your command session. For example:
Now you've got all the macros you can eat, and you're saving your command line session each time. But remember, if you don't explicitly type
exit
, the history won't be saved. Closing the window with the mouse won't work here.Hope this helps!
* because batch subprocesses often open a second copy of
CMD
which will run this command again and again, from slowing everything down to other unforseen issues.Command History: To enable a command history (that can be accessed using the up and down arrow keys) just execute doskey at the command prompt. For example, to create a command history of 100 elements:
ref:https://users.cs.jmu.edu/bernstdh/web/common/help/ntshell.php
clink is nice and the author publishes a chocolatey package on every release, however I would suggest DeepBlueCLI.
You can use https://github.com/sans-blue-team/DeepBlueCLI to set-up Windows Security Event ID 4688.
For PowerShell, DeepBlueCLI also uses module logging (PowerShell event 4013) and script block logging (4104). It does not use transcription.
The added benefit is that it logs the hash of the command line exe in AppLocker event log. Source: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing
Also, because this solution uses the Windows Event Log infrastructure, you can query it through WMI or PowerShell
Get-EventLog
. With clink, you have to learn another tool in order to detect system- or network-wide patterns of behavior.To save command history:
To reference commands:
This method won't change the command history of current session
To add the current session command history to the last save file:
Windows 10 now includes alternative and better shells ('terminals' as they call them).