Mastering RunDLL32 commands in Windows 11

Windows includes a rich set of built-in utilities that empower IT professionals and power users to automate tasks and streamline system management.

Among these tools, RunDLL32 stands out as a particularly versatile command-line utility. It enables you to load and execute functions directly from 32-bit dynamic-link libraries (DLLs), bypassing the need for dedicated executable files.

From creating custom shortcuts to automating administrative workflows, mastering RunDLL32 commands can significantly enhance your productivity and system control.

What is RunDLL32?

RunDLL32 - short for “Run DLL 32-bit” - is a native Windows utility that executes exported functions within dynamic-link libraries (DLLs). DLLs are modular libraries containing reusable code, data, and resources shared across multiple applications. Unlike standalone executables (.exe), DLLs cannot be launched directly; they require a host process to invoke their functions - and that’s precisely the role RunDLL32 fulfills.

First introduced with Windows 95 , RunDLL32.exe resides in the %SystemRoot%\System32 directory on all modern Windows installations. As a built-in OS component, it requires no additional software or configuration to use.

How RunDLL32 Works

When executed, RunDLL32 loads the specified DLL into memory and calls its designated entry point - a specific exported function. The command-line interface accepts the target DLL, function name, and any required arguments in a structured syntax.

The basic syntax is:

RunDLL32.exe <DLLname>,<FunctionName> [Arguments]

Common RunDLL32 Commands

Below are practical examples of RunDLL32 commands frequently used for system administration and quick access to Windows settings.

One of the most common use cases for RunDLL32 is launching Control Panel applets directly - bypassing menu navigation entirely.

Programs and Features (Add/Remove Programs)

RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl

User Accounts

RunDLL32.exe netplwiz.dll,UsersRunDll

Date and Time Settings

RunDLL32.exe shell32.dll,Control_RunDLL timedate.cpl

Bluetooth Settings

RunDLL32.exe shell32.dll,Control_RunDLL bthprops.cpl

RunDLL32 also provides direct access to system dialogs that are otherwise buried in nested menus.

Environment Variables

RunDLL32.exe sysdm.cpl,EditEnvironmentVariables

Creating Shortcuts with RunDLL32 Commands

RunDLL32 commands can also be used to create shortcuts for frequently used functions, and can be particularly useful for administrators or advanced users who need quick access to specific settings or tools.

Create a shortcut to open the “Add or Remove Programs” applet:

1. Right-click on the Desktop or in a folder, select New, and then select Shortcut.
2. In the “Type the location of the item” field, enter the RunDLL32 command: RunDLL32.exe shell32.dll,Control_RunDLL appwiz.cpl
3. Click Next, give your shortcut a name (e.g., “Add or Remove Programs”), and click Finish.

You now have a shortcut that, when double-clicked, will open the “Add or Remove Programs” applet.

Windows includes approximately 50 Control Panel applets, each identified by its .cpl file. Using RunDLL32 commands, you can launch any of these applets directly - saving time and eliminating the need to navigate through the traditional Control Panel interface.

Exploring RunDLL32 Options

For those who wish to dive deeper into the capabilities of RunDLL32.exe, it’s essential to explore the extensive range of options available. While Windows does not provide a built-in list of all RunDLL32 commands, you can use third-party tools to discover and list these options.

Total PE

Total PE  is a great tool that simplifies the process of exploring DLL files and identifying potential RunDLL32 commands. By loading a DLL like shell32.dll, you can delve into the details of the file and examine the list of exported functions.

To start, load the desired DLL into Total PE. The tool’s intuitive interface will display a wealth of information, including the list of exported functions. These functions represent the commands that can potentially be called using Rundll32.exe.

Image viewer

By carefully scrolling through this list, it is possible to identify the relevant functions and understand their respective roles. This method not only aids in uncovering hidden functionalities but also enhances the overall understanding of the DLL’s capabilities.

RunDLL32.exe commands can simplify various tasks, enhancing efficiency and control over the Windows environment. These commands will provide quick access to essential system functions and settings, enabling users to navigate and configure their system with ease.

Finding RunDLL32 Command-lines with Process Monitor

Process Monitor (Procmon)  is another great tool to explore RunDLL32 commands, and comes as part of the Sysinternals  suite. Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

You can use Procmon to capture RunDLL32 command lines as they are executed by the system or applications.

Download and run Procmon from Microsoft Sysinternals. It immediately begins capturing all system activity, which can be overwhelming without filters.

To add filters, open the Filter dialog by pressing CTRL + L or clicking the filter icon in the toolbar. This is where you define rules to narrow down the flood of events.

Image viewer

Add a Process Name filter In the filter window, set:

• Condition: Process Name
• Relation: is
• Value: rundll32.exe

Click Add. This ensures Procmon only shows events generated by RunDLL32.

Add an Operation filter Still in the filter window, add another rule:

• Condition: Operation
• Relation: is
• Value: Process Start

Click Add. This narrows the view to just the moments when RunDLL32 starts a new process.

Click Apply and click OK to apply the filters.

Procmon will display events, where RunDLL32.exe is invoked and the Operation is Process Start. Notice the command line arguments used in the Details column. Each entry will show the command line arguments used, revealing which DLL and function were executed.

By capturing these command lines, you gain insight into:

• System behavior: See which DLLs Windows itself is calling through RunDLL32.
• Troubleshooting: Identify misbehaving or redundant DLL calls that may slow down startup or cause errors.
• Security analysis: Detect suspicious or unauthorized DLLs being launched, a common tactic in malware persistence.

To get deeper into Process Monitor, head over to Windows IT Pro  on YouTube, and find loads of great videos on Sysinternals tools, e.g.;

Sysinternals | Fireside Chat - Mark Russinovich

A fantastic fireside chat with Mark Russinovich, co-founder of Sysinternals. A must-watch for anyone interested in Windows internals and troubleshooting.

Sysinternals | Process Monitor deep dive | Sami Laiho

A deep dive into Process Monitor, one of the most powerful tools in the Sysinternals suite. A must-watch for anyone interested in Windows internals and troubleshooting.

Rundll32.exe shell32.dll,ShellAbout

Rundll32.exe shell32.dll,Control_RunDLL

Rundll32.exe %SystemRoot%\System32\newdev.dll,DeviceInternetSettingUi

Rundll32.exe devmgr.dll DeviceManager_Execute

Rundll32.exe sysdm.cpl,EditEnvironmentVariables

Rundll32.exe powrprof.dll,SetSuspendState

Rundll32.exe user32.dll,LockWorkStation

Rundll32.exe shell32.dll,Control_RunDLL srchadmin.dll

Rundll32.exe shell32.dll,Control_RunDLL powercfg.cpl

Rundll32.exe advapi32.dll,ProcessIdleTasks

Rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,2

Rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,3

Rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,4

Rundll32.exe shell32.dll,Control_RunDLL Sysdm.cpl,,5

Rundll32.exe shell32.dll,Control_RunDLL desk.cpl

Rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,0

Rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL desk.cpl,,2

Rundll32.exe shell32.dll,Options_RunDLL 1

Rundll32.exe shell32.dll,Options_RunDLL 3

Rundll32.exe shell32.dll,Options_RunDLL 4

Rundll32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,0

Rundll32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,2

Rundll32.exe shell32.dll,Control_RunDLL Mmsys.cpl,,3

Rundll32.exe shell32.dll,Control_RunDLL %SystemRoot%\System32\Speech\SpeechUX\sapi.cpl,,1

Rundll32 %SystemRoot%\system32\shwebsvc.dll,AddNetPlaceRunDll

rundll32.exe shell32.dll,Control_RunDLL bthprops.cpl,,1

rundll32.exe shell32.dll,Control_RunDLL bthprops.cpl,,2

rundll32.exe shell32.dll,Control_RunDLL bthprops.cpl,,3

Rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL Connect

Rundll32.exe shell32.dll,Control_RunDLL ncpa.cpl

Rundll32.exe Shell32.dll,Control_RunDLL cscui.dll,,0

Rundll32.exe Shell32.dll,Control_RunDLL cscui.dll,,1

Rundll32.exe Shell32.dll,Control_RunDLL cscui.dll,,2

Rundll32.exe Shell32.dll,Control_RunDLL cscui.dll,,3

Rundll32.exe shell32.dll,Control_RunDLL NetSetup.cpl

Rundll32.exe shell32.dll,Control_RunDLL main.cpl @1

Rundll32.exe user32.dll,SwapMouseButton

Rundll32.exe shell32.dll,Control_RunDLL main.cpl

Rundll32.exe shell32.dll,Control_RunDLL main.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL main.cpl,,2

Rundll32.exe shell32.dll,Control_RunDLL main.cpl,,3

Rundll32.exe shell32.dll,Control_RunDLL main.cpl,,4

Rundll32.exe shell32.dll,Control_RunDLL tabletpc.cpl

rundll32.exe shell32.dll,Control_RunDLL tabletpc.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL joy.cpl

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,2

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,3

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,4

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,5

Rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,6

Rundll32.exe shell32.dll,Options_RunDLL 0

Rundll32.exe shell32.dll,Options_RunDLL 2

Rundll32.exe shell32.dll,Options_RunDLL 7

Rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL FontsFolder

Rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,0

Rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,2

Rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,3

Rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL AddPrinter

Rundll32.exe tcpmonui.dll,LocalAddPortUI

Rundll32.exe Printui.dll,PrintUIEntry /?

Rundll32.exe shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

Rundll32.exe shell32.dll,Control_RunDLL HotPlug.dll

Rundll32.exe keymgr.dll,PRShowSaveWizardExW

Rundll32.exe shell32.dll,Control_RunDLL wscui.cpl

Rundll32.exe keymgr.dll,KRShowKeyMgr

Rundll32.exe shell32.dll,Control_RunDLL nusrmgr.cpl

Rundll32.exe shell32.dll,Control_RunDLL firewall.cpl

Rundll32.exe shell32.dll,Control_RunDLL timedate.cpl

Rundll32.exe shell32.dll,Control_RunDLL timedate.cpl,,1

Rundll32.exe shell32.dll,Control_RunDLL Intl.cpl,,0

Rundll32.exe shell32.dll,Control_RunDLL Intl.cpl,,1

Rundll32.exe Shell32.dll,Control_RunDLL input.dll,,1

Rundll32.exe Shell32.dll,Control_RunDLL input.dll,,{C07337D3-DB2C-4D0B-9A93-B722A6C106E2}

Rundll32.exe shell32.dll,Control_RunDLL access.cpl

Rundll32.exe shell32.dll,Control_RunDLL odbccp32.cpl

Security Considerations

The flexibility that makes RunDLL32 useful also introduces security risks. Because it can execute arbitrary code from any DLL, attackers frequently abuse it to run malicious payloads while evading detection - a technique known as living off the land .

To mitigate these risks:

• Verify command sources: Only execute RunDLL32 commands from trusted documentation or scripts you’ve reviewed.
• Monitor for abuse: Use endpoint detection tools to flag unexpected RunDLL32 activity, especially commands referencing unusual DLL paths.
• Keep systems protected: Ensure endpoint security software is current and configured to detect suspicious DLL executions.
• Apply least privilege: Limit administrative access to reduce the impact of potential exploitation.

Final Thoughts

RunDLL32 is a powerful utility that bridges the gap between command-line efficiency and Windows system management. By invoking DLL functions directly, it enables IT professionals and power users to automate tasks, create custom shortcuts, and access system settings without navigating through layers of UI.

As with any powerful tool, responsible use is essential - always verify commands before execution and remain mindful of the security considerations outlined above.

Whether you’re streamlining administrative workflows or simply looking for faster access to frequently used settings, RunDLL32 commands are a valuable addition to your Windows toolkit.

–Jesper