IT Admin Toolkit: what every button does

IT Admin Toolkit is a Windows program for IT support: repairs, checks, reports and shortcuts in one window. This page explains each button: what it does, when to use it and what to expect. Open the program’s Help button, or the small ? on a card, to land on the right spot.

Download Free

Free download for Windows 10 and 11. Choose the installer, or the portable file that runs without installing. Windows may show a blue SmartScreen warning because the program is new and not yet signed: click More info, then Run anyway. Each download is published on GitHub, where you can also scan it with VirusTotal.

Download for Windows Source and release notes

Installer (Setup) or Portable

Before you start

Windows 10 or 11. The program asks for administrator rights because repairs and system checks need them.
It works without internet, except where a button says so (updates, installs, speed test, DISM).
Every button runs one fixed command chosen by the program. There is no free command line, and the boxes for host names and ports accept only safe characters.
Actions that change something ask you first. Every action is written to a daily log file you can open with the “Activity log” button.
Nothing is uploaded. The program has no account, no tracking and sends no data about your PC.

System and disk repairs

ScanSFC /SCANNOW

Scans and repairs corrupted Windows system files.

When to use it: Windows crashes, apps fail to start, or system files seem damaged after a failed update or malware.
What to expect: Takes 10 to 30 minutes. A progress percentage runs in the console. It may say it repaired files, found nothing, or could not fix some (then run DISM first and try again).

Apply fixDISM RestoreHealth

Repairs the Windows image through Windows Update (use it when SFC fails).

When to use it: SFC cannot repair files, or Windows Update keeps failing. DISM fixes the component store that SFC copies from.
What to expect: Takes 10 to 40 minutes and needs an internet connection. It may sit at 20% or 62% for a while; that is normal. Run SFC again afterwards.

ScanCHKDSK C: /scan

Checks drive C: for errors without a restart.

When to use it: Files are corrupted, the disk makes odd noises, or Windows reports file system errors.
What to expect: Scans drive C: while Windows keeps running, and reports whether errors were found. It does not fix bad sectors; for that Windows asks for a restart.

CreateRestore point

Creates a restore point before repairs. Windows allows one per 24 hours.

When to use it: Before risky repairs, driver installs or registry changes, so you can go back if something breaks.
What to expect: Windows creates one restore point per 24 hours by default; a second one on the same day may be skipped silently. System Protection must be on for drive C:.

One-click fixes

Apply fixFix Print Spooler⚠ Asks for confirmation

Clears stuck print jobs and restarts the Spooler service.

When to use it: A document is stuck in the print queue, the printer shows “printing” forever, or nothing prints.
What to expect: Stops the Spooler service, deletes the waiting print jobs and starts it again. Everything waiting in the queue is lost and must be printed again. Takes a few seconds.

Apply fixReset Windows Update⚠ Asks for confirmation

Restarts the wuauserv, bits and cryptsvc services.

When to use it: Windows Update is stuck, fails with an error code, or keeps “checking for updates”.
What to expect: Restarts the update services (wuauserv, bits, cryptsvc). It does not delete downloaded updates. Try Windows Update again afterwards; a restart can help.

RunGPUpdate /force

Immediately refreshes Active Directory group policies.

When to use it: A company policy (wallpaper, drive mapping, restrictions) has not arrived on a domain PC yet.
What to expect: Re-applies Active Directory group policies immediately. On a home PC outside a domain it only reports that there is nothing to update. Some policies need a sign-out or restart.

Apply fixRebuild icon cache⚠ Asks for confirmation

Fixes blank or corrupted icons. Restarts Explorer.

When to use it: Desktop or taskbar icons are blank, wrong, or show a generic white page.
What to expect: Closes File Explorer, deletes the icon cache files and starts Explorer again. The taskbar and desktop disappear for a few seconds and come back. Save your work in open folders first.

RunSync system time

Synchronises the Windows clock with an NTP server.

When to use it: The clock is wrong, websites show certificate errors, or domain login fails because of time difference.
What to expect: Starts the Windows Time service and forces a sync with the time server. Needs internet (or a domain controller). Fixes drift, not the time zone.

Software and startup

ViewInstalled programs

Lists every program with version and publisher. Use appwiz.cpl to uninstall.

When to use it: Before cleaning a PC, to see what is installed, or to find old and unwanted programs.
What to expect: Prints every program with version and publisher, sorted by name. It only reads the list. To remove a program use the appwiz.cpl button in Panels.

ViewStartup programs

Shows which programs start with Windows and slow the boot down.

When to use it: The PC boots slowly, or something unknown starts with Windows.
What to expect: Lists the programs that launch at sign-in, with the command and where it is registered (registry or startup folder). It only shows; to switch items off use “Startup settings”.

OpenStartup settings

Opens the Windows page where you switch startup apps on or off.

When to use it: After checking the startup list, when you want to switch unneeded programs off.
What to expect: Opens the Windows Settings page “Startup apps”. Each program has an on/off switch and Windows shows its impact on boot time. Nothing is changed until you flip a switch.

RunUpdate ALL programs

Runs winget upgrade --all and updates every program that supports it.

When to use it: To bring all programs up to date in one go, for example on a freshly installed or a neglected PC.
What to expect: Runs “winget upgrade --all”. Needs internet and winget (built into Windows 10 and 11). Programs that are open may fail to update. It can take a long time and some installers ask for confirmation.

Hardware, keys and system report

CreateSystem report

Creates a text file on the desktop with CPU, RAM, disks, network and serial number.

When to use it: To document a customer PC, send specs to someone, or keep a record before a repair.
What to expect: Creates a text file on the Desktop named SystemReport-<computer>-<date>.txt with computer model, serial number, BIOS, Windows version, CPU, graphics, disks, volumes and network. It opens the folder with the file selected. Nothing is sent anywhere.

ViewSerial Number & BIOS

Service tag / S/N, manufacturer, model and BIOS version.

When to use it: When you need the serial number or service tag for warranty, support or inventory.
What to expect: Shows manufacturer, model, computer name, BIOS version and date, and the serial number from the firmware. Some home-built PCs show placeholder text such as “To be filled by O.E.M.”.

ViewWindows key (OEM)

Reads the factory key from BIOS/UEFI, if one is embedded.

When to use it: Before reinstalling Windows on a branded PC, to know whether a key is stored in the firmware.
What to expect: Reads the OEM key embedded in BIOS/UEFI. Many PCs have none (digital licence tied to the hardware or a retail key); then it says so. The key is only shown on screen.

ViewActivation status

Shows whether Windows and Office are activated.

When to use it: To check if Windows or Office is genuine and activated, for example on a second-hand PC.
What to expect: Shows the product name and licence status: Licensed, Grace period, Notification or Unlicensed. It only reads the status; it does not activate anything.

ViewDisk health (S.M.A.R.T.)

Checks the health of all SSD and HDD drives.

When to use it: The PC is slow, freezes, or you want to check a disk before trusting it with data.
What to expect: Lists every physical disk with type (SSD/HDD), size and HealthStatus. “Healthy” is good; “Warning” or “Unhealthy” means back up your data now. It does not show detailed S.M.A.R.T. attributes.

CreateBattery report

Builds and opens a detailed laptop battery wear report.

When to use it: A laptop battery drains fast and you want to know how worn it is.
What to expect: Windows builds an HTML report and it opens in your browser. Compare “Design capacity” with “Full charge capacity”: a big gap means a worn battery. Desktop PCs have no battery and will show an error.

View10 last critical errors

The 10 most recent system errors from Event Viewer.

When to use it: After a blue screen, a freeze or an unexpected restart, to see what Windows logged.
What to expect: Shows the 10 newest Error and Critical entries of the System log with time, source, event ID and message. Search the event ID online to find the cause. It only reads the log.

ViewCPU, RAM and uptime

Summary of processor, Windows version, memory and time since last boot.

When to use it: A quick look at what a PC has, or how long it has been running without a restart.
What to expect: Prints processor model, cores, Windows version, total and free RAM and the last boot time. It is a short summary; use “System report” for the full picture.

Disk space, large files and cleanup

ViewFree disk space

Size, free space and percentage for every drive.

When to use it: The disk is full or Windows warns about low space.
What to expect: Shows each drive letter with label, size, free space in GB and percent free. Below about 10% free, Windows slows down and updates may fail. It only reads values.

ScanLarge files

Finds the 25 biggest files (over 100 MB) in the user folder. May take a while.

When to use it: To find what fills the disk: old videos, installers, ISO files, backups.
What to expect: Searches your user folder (Desktop, Documents, Downloads and so on) for the 25 biggest files over 100 MB and prints size and path. On a big disk it can take several minutes. Nothing is deleted; you decide what to remove.

ScanBiggest folders

Shows which user folder takes up the most space.

When to use it: After “Large files”, to see which folder in your profile is the heaviest.
What to expect: Adds up the size of each folder directly inside your user folder and lists them from biggest to smallest, in GB. Can take a few minutes on large profiles. Read-only.

OpenDisk Cleanup

Opens the classic Windows Disk Cleanup.

When to use it: To free space from Windows leftovers: old update files, thumbnails, the Recycle Bin.
What to expect: Opens the classic Disk Cleanup window. You pick what to delete and confirm there. The program itself deletes nothing.

ViewDriver list

Lists installed drivers with version and manufacturer.

When to use it: To see which driver versions are installed, for example when hunting a faulty device.
What to expect: Lists up to 400 signed drivers with device name, version and manufacturer, sorted by device. Read-only.

CreateDriver backup

Copies all drivers to a folder on the desktop. Handy before a reinstall.

When to use it: Before reinstalling Windows, so you can reinstall the same drivers without hunting for them online.
What to expect: Copies all third-party drivers into a new folder “DriversBackup-<date>” on the Desktop. It can take a few minutes and a few hundred MB. To restore, point Device Manager to that folder.

Security, users and scheduled tasks

ViewMicrosoft Defender

Real-time protection status and last signature update.

When to use it: To check that the built-in antivirus is on and up to date.
What to expect: Shows whether the antivirus service and real-time protection are enabled, when the virus definitions were last updated and when the last quick scan ended. If another antivirus is installed, Defender may be off by design.

RunUpdate Defender

Downloads the latest virus definitions.

When to use it: Before a scan, or when the status shows old definitions.
What to expect: Downloads the newest virus definitions from Microsoft. Needs internet. Takes under a minute.

ScanQuick scan

Runs a quick virus scan with Microsoft Defender.

When to use it: A quick check when a PC behaves strangely or after downloading something doubtful.
What to expect: Runs a Microsoft Defender quick scan of the usual hiding places. Typically a few minutes; the console tab stays busy until it finishes. For a deep check use Windows Security’s full scan.

ViewFirewall

Shows whether the firewall is on for each network profile.

When to use it: To see if the Windows firewall is protecting the PC, for example after a connection problem or a suspicious install.
What to expect: Shows Domain, Private and Public profiles and whether each is enabled. Turning it off is not offered here on purpose.

ViewBitLocker

Encryption status of the drives.

When to use it: To know if a drive is encrypted, before servicing a laptop or changing hardware.
What to expect: Runs “manage-bde -status” and shows protection and encryption percentage for each volume. If BitLocker is on, make sure the recovery key is saved before touching BIOS or hardware.

ViewLocal users

Lists the computer’s accounts and whether they are enabled.

When to use it: To audit accounts on a PC: forgotten users, disabled accounts, last sign-in.
What to expect: Lists local accounts, whether each is enabled and its last logon time. Domain accounts are not shown. Read-only.

ViewLocal administrators

Which accounts have administrator rights.

When to use it: To check who can change anything on the PC, for example after repairs by someone else.
What to expect: Lists the members of the local Administrators group. Unknown names here deserve a closer look. Read-only.

ViewScheduled tasks

Non-Microsoft tasks. Handy for spotting suspicious or leftover programs.

When to use it: To find programs that run on a schedule: leftover updaters, adware, or a suspicious task.
What to expect: Lists scheduled tasks that are not part of Microsoft, with name, state and path. To open or disable one, use the taskschd.msc button in Panels.

Network diagnostics and Wi-Fi

ViewWi-Fi passwords

Shows the saved Wi-Fi networks and their passwords.

When to use it: To recover a Wi-Fi password you saved on this PC and forgot, for example to connect a phone.
What to expect: Shows every saved Wi-Fi network with its password in plain text. It reads only this PC’s own saved profiles, and nothing leaves the PC. Keep the screen private.

RunFlush DNS

Clears the DNS cache (ipconfig /flushdns).

When to use it: A website will not load after it moved, or a recent DNS change has not reached the PC yet.
What to expect: Clears the DNS resolver cache so the PC asks for fresh addresses. Instant and harmless. It does not fix a broken connection.

Apply fixFull network reset⚠ Asks for confirmation

Release, renew, flush DNS, Winsock and TCP/IP reset. Needs a restart.

When to use it: The last resort for network problems: no internet while other devices work, adapters stuck, strange Winsock errors.
What to expect: Releases and renews the IP address, clears DNS, then resets Winsock and the TCP/IP stack. You may lose the connection for a few seconds, and static IP settings on that interface may be cleared. Restart the PC afterwards to finish.

ViewIPConfig /all

Full report of network adapters, MAC and DHCP.

When to use it: To see the IP address, gateway, DNS servers and MAC address of every network card.
What to expect: Prints the full ipconfig report for Ethernet, Wi-Fi and virtual adapters, including DHCP lease times. Read-only.

TestSpeed test

Downloads 25 MB from Cloudflare and works out the download speed.

When to use it: A quick check of the download speed of this PC’s connection.
What to expect: Downloads a 25 MB test file from Cloudflare (speed.cloudflare.com) and reports the time and speed in Mbit/s. It is the only button that uses your data on purpose, and it measures download only, not upload.

ViewHosts file

Shows the hosts file (a common cause of odd redirects).

When to use it: A site is blocked or redirects somewhere odd on only this PC. The hosts file is a common cause.
What to expect: Prints the hosts file. Lines starting with # are comments. A line such as “0.0.0.0 example.com” blocks that site. Read-only.

OpenEdit hosts

Opens the hosts file in Notepad with administrator rights.

When to use it: To remove a bad entry from the hosts file or add one on purpose.
What to expect: Opens the hosts file in Notepad with administrator rights. Edit, then save with Ctrl+S. Keep a copy of the original lines before changing; a wrong line can break access to websites.

Admin panels and remote assistance

These buttons simply open the matching Windows tool in its own window. Nothing is changed until you act inside that window.

ncpa.cpl Network connections
appwiz.cpl Programs and features
sysdm.cpl System properties / domain
services.msc Windows services
devmgmt.msc Device Manager
diskmgmt.msc Disk Management
eventvwr.msc Event Viewer (logs)
taskschd.msc Task Scheduler
lusrmgr.msc Local users and groups
compmgmt.msc Computer Management
God Mode All settings in one panel
Quick Assist Windows remote assistance
Network and Sharing Center Network and sharing settings

Other controls

Clean %TEMP%

Delete temporary files only. It asks for confirmation, deletes only files older than 24 hours and skips anything in use. It reports how many items and how many MB were freed. Your documents and downloads are not touched.

Install programs (Winget)

One click installs a program silently with Windows’ own package manager, winget. Only the programs shown on the buttons are allowed: 7-Zip, Chrome, Firefox, Notepad++, PowerToys, VLC, TreeSize Free and Adobe Reader. Needs internet; progress shows in the console tab.

Ping, Traceroute, NSLookup

Type an IP address or a name in the box and press a button. Ping tests whether the target answers and how fast. Traceroute shows the hops on the way. NSLookup shows which address a name resolves to. Only letters, digits, dots, hyphens and colons are accepted in the box; anything else is rejected before a command runs.

Port check

Checks whether a TCP port on a host accepts connections, for example 3389 for Remote Desktop or 443 for HTTPS. Enter the host above and the port number (1 to 65535). The result says True or False for TcpTestSucceeded.

Netstat -ano

Lists all network connections and listening ports with the PID of the program that owns each. Match the PID in the process list to see which program is talking to the network.

Processes and End task

Refresh loads every running process with its memory use, biggest first. Type in the filter box to find one by name. “End task” asks for confirmation and then stops that process by force; unsaved data in it is lost. Core Windows processes such as csrss, lsass, svchost and winlogon are protected and cannot be ended from here.

Remote Desktop (RDP)

Opens Windows’ own Remote Desktop Connection (mstsc). Type the IP or name of the other PC first, or leave the box empty to open the plain window. The other PC must allow Remote Desktop and you need its credentials.

Console tabs and the activity log

Every task opens in its own tab at the bottom, so several can run at once and none cancels another. The dot on a tab is yellow while running, green when it finished well and red if it ended with an error. Stop ends the active tab, × closes a tab, Clear empties it, Expand makes the console taller, and Ctrl+C stops the active tab when no text is selected. Every action is also written to a daily log file; the “Activity log” button opens its folder.

↑ Back to top