Home » Posts tagged 'cmd'
Tag Archives: cmd
Windows Server Multipath I/O
You can enable the Windows Server 2008 R2 Multipath I/O (MPIO) feature from the command line using this DISM command:
dism /online /enable-feature:MultipathIo
To disable this feature use:
dism /online /disable-feature:MultipathIo
To show the currently enabled/installed features use this DISM command:
dism /online /get-features
Examples of AD from the Command-line
User Information
Find DN of Currently Logged On User
Paste code as is:
dsquery * domainroot -filter “(samAccountName=%USERNAME%)”
Find User With Primary Email Address
Retrieve user object matching given address as primary SMTP e-mail.
Syntax:
dsquery * domainroot -filter “(&(objectClass=User) (mail=))” -l -d -attr *
Example:
dsquery * domainroot -filter “(&(objectClass=User) (mail=John.Doe@mydom.com))” -l -d mydom.local -attr *
Find User With Any Email Address
Retrieve user object matching any assigned e-mail address.
Syntax:
dsquery * domainroot -filter “(&(objectClass=User) (proxyAddresses=**))” -l -d -attr *
Example:
dsquery * domainroot -filter “(&(objectClass=User) (proxyAddresses=*John.Doe@mydom.com*))” -l -d mydom.local -attr *
Find Email of User when DN is Known
Retrieve user object matching given DN and show primary SMTP e-mail address.
Syntax:
dsquery * domainroot -filter “(distinguishedName=)” -d -l -attr mail
Example:
dsquery * domainroot -filter “(distinguishedName=CN=Kerekes\, Charlie,OU=Knoxville,DC=mydom,DC=local)” -d mydom.local -l -attr mail
Find Hidden GAL Recipients
Retrieve all user objects that are hidden from the Global Address List in Exchange.
Syntax:
dsquery * domainroot -filter “(&(objectClass=User) (msExchHideFromAddressLists=TRUE))” -l -d -attr displayName
Example:
dsquery * domainroot -filter “(&(objectClass=User) (msExchHideFromAddressLists=TRUE))” -l -d mydom.local -attr displayName
Users With Password Set to Never Expire
Retrieve list of users with the “Password never expires” attribute set.
Syntax:
dsquery * domainroot -filter “(&(objectClass=user) (userAccountControl>=65536))” -attr sAMAccountName userPrincipalName userAccountControl -d
Example:
dsquery * domainroot -filter “(&(objectClass=user) (userAccountControl>=65536))” -attr sAMAccountName userPrincipalName userAccountControl -d mydom.local
Group Information
List Members of a Group
Querying AD for group membership is a multi-step process. The reason is that AD stores group membership in two places. The first place is the most obvious—in the member attribute of the group object. The second is not as obvious—as an integer value in the primaryGroupID attribute of user objects.
For most scenarios, querying the member attribute of group objects will provide a complete list of members. However, if the group in question is set as a default group for any user object, that user will not be listed in the member attribute.
Query the Group’s “Member” Attribute
The sample below lists all members stored in the member attribute of the group. If this query is not showing all members, you will need to perform the queries in the next section as well.
Syntax:
dsquery * domainroot -filter “(&(objectClass=group)(name=))” -l -d -attr member
Example:
dsquery * domainroot -filter “(&(objectClass=group)(name=Help Desk Associates))” -l -d mydom.local -attr member
Query the User’s “primaryGroupID” Attribute
First, we determine the primary group ID for the group in question. We do this by finding the SID of the group object; the last segment of the SID is used as the primary group ID.
Syntax:
dsquery * domainroot -filter “(&(objectClass=group)(name=))” -l -d -attr objectSid
Example:
dsquery * domainroot -filter “(&(objectClass=group)(name=Help Desk Associates))” -l -d mydom.local -attr objectSid
The above query will produce an output similar to this:
S-1-5-21-123456789-1234567890-9876543211-1169
Now we are ready to find all user objects that have the above group set as their default.
Syntax:
dsquery * domainroot -filter “(&(objectClass=user)(primaryGroupID=))” -l -d -attr cn
Example:
dsquery * domainroot -filter “(&(objectClass=user)(primaryGroupID=1169))” -l -d mydom.local -attr cn
List Group Members with Additional User Attributes
If we want more than the DN of group members, we need to use a FOR statement to first generate the list of members, then query each member object for the desired attributes.
Please be aware that the example below queries only the member attribute of the group and will miss any user objects with this group as their default. See the above section for details about the primaryGroupID attribute.
Syntax:
for /F “delims=*” %i IN (‘dsquery * domainroot -filter “(&(objectClass=group)(name=))” -l -d -attr member’) DO @dsquery * domainroot -filter “(distinguishedName=%i)” -attr
Example:
for /F “delims=*” %i IN (‘dsquery * domainroot -filter “(&(objectClass=group)(name=Help Desk Associates))” -l -d mydom.local -attr member’) DO @dsquery * domainroot -filter “(distinguishedName=%i)” -attr displayName samAccountName mail
Computer Information
List All Computer Objects
Syntax:
dsquery * domainroot -filter “(objectClass=Computer)” -attr name -l -d
Example:
dsquery * domainroot -filter “(objectClass=Computer)” -attr name -l -d mydom.local
List Computer Objects in a Specific OU
This example lists all computer objects stored in the mydom.local/Servers/Exchange OU.
Syntax:
dsquery * “” -filter “(objectClass=Computer)” -attr name -l -d
Example:
dsquery * “ou=Exchange,ou=Servers,dc=mydom,dc=local” -filter “(objectClass=Computer)” -attr name -l -d mydom.local
List All Domain Controllers
Syntax:
dsquery * “ou=domain controllers,
” -filter “(objectClass=Computer)” -attr name -l -d
Example:
dsquery * “ou=domain controllers,dc=mydom,dc=local” -filter “(objectClass=Computer)” -attr name -l -d mydom.local
Find DN of Computer Object in Current Domain
The DN contains the full directory path of the computer object and can be helpful in locating the computer using the GUI tools in a complex AD structure.
Syntax:
dsquery * domainroot -filter “(&(objectClass=Computer) (name=))”
Example:
dsquery * domainroot -filter “(&(objectClass=Computer) (name=exch19))”
Disable Driver Signing in Windows 7
I have not tried this in Win7x64, but in Win7 32-bit (x86) it works to disable the signed driver requirements in Windows 7.
bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS bcdedit.exe -set TESTSIGNING ON
Please note that changing Driver Sign may be a security risk. I in no way endorse or recommend that this should be used by anyone who does not understand the risks involved.
Remote Desktop Settings
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
“AllowRemoteRPC”=dword:00000001
“fDenyTSConnections”=dword:00000000
wmic /node:”” /USER:”” RDTOGGLE WHERE ServerName=”” CALL SetAllowTSConnections 1
Manageing Window Data Execution Prevention
Command Line
Disable DEP
bcdedit.exe/set {current} nx AlwaysOff
<reboot>
Enable DEP
Enable DEP bcdedit.exe/set {current} nx AlwaysOn
<reboot>
GUI
Control Panel\All Control Panel Items\System –> Advanced system properties –> Performance | Settings… –> Data Execution Prevention
<reboot>
WinRM & WinRS multi-hop
Multi-Hop Support in WinRM
http://msdn.microsoft.com/en-us/library/ee309365(VS.85).aspx
Windows Remote Management (WinRM) supports the delegation of user credentials across multiple remote computers. The multi-hop support functionality can now use Credential Security Service Provider (CredSSP) for authentication. CredSSP enables an application to delegate the user’s credentials from the client computer to the target server. CredSSP authentication is intended for environments where Kerberos delegation cannot be used. ***Support for CredSSP was added to allow a user to connect to a remote server and have the ability to access a second-hop machine, such as a file share. ***
To configure multi-hop support using CredSSP authentication for WinRM
CredSSP must be enabled in the client configuration settings.
winrm set winrm/config/client/auth '@{CredSSP="true"}'
CredSSP must be enabled in the WinRM service configuration settings.
winrm set winrm/config/service/auth '@{CredSSP="true"}'
Example
Using CredSSP Authentication with Explicit Credentials
winm OPERATION –remote:https://myMachine –authentication:CredSSP –username:myUsername –password:myPassword
Reset Windows Local “Group Policy Objects” Back To Defaults
This is from MS KB/Q: 313222. It should not change or reset the IPSec settings, but you might want back them up just in case.
Use the SECEDIT command to copy the original setting that are stored in the “defltbase.inf” file.
Get BIOS Info from the Command Line using WMI
Use the WMI Command Line (wmic) utility to retrive WMI information including BIOS settings.
C:\>wmic csproduct get vendor,name,identifyingnumber
IdentifyingNumber Name Vendor
J**L**1 Latitude E6400 Dell Inc.
Windows Domain Secure Channel Testing
Use the NLTEST.EXE utility to test domain communication methods.
U:\>nltest.exe /?
Usage: nltest [/OPTIONS]
Eject Removable Media command
From an administrative level command promt:
rsm eject /PF"Volume Label" /Astart
Variable expansion
Something to remember is that be default .bat and .cmd scripts do not process all the variable updates, or expansion, immediately. To use variable that are updated or created inside a loop for instance you must have Variable Expansion enabled.
A quick check to see if variable expansion is enable in your command prompt is to run this:
If Variable Expansion is ON you will see:
c:\> echo !errorlevel!
0
If expansion is OFF you get:
c:\> echo !errorlevel!
!errorlevel!
When launching cmd.exe from a prompt; Command-line; Run…; or Search programs and files you can specify the /V:ON parameter to enable expansion.
Within a bat/cmd file variable expansion can be controlled through the SETLOCAL [ENABLEDELAYEDEXPANSION | DISABLEDELAYEDEXPANSION] statement.
Turn on variable expansion (delayed) and you will not be sorry.
–Mike
Command line DHCP MAC address filtering
Enable or disable a filtering:
netsh dhcp server v4 set filter [enforceallowlist=1|0] [enforcedenylist=1|0] netsh dhcp server v4 set filter enforceallowlist=1 netsh dhcp server v4 add filter
UAC on/off via REG.EXE
There’s a quick way you can enable or disable this annoying window from the command line:
Disable UAC
reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
DOS variables: %date% and %time%
Need to do some date and/or time manipulation in a DOS batch/command file? Here is a good example:
set filedatetime=%date:~10%-%date:~4,2%-%date:~7,2%_%time:~0,2%%time:~3,2%%time:~6,2%%time:~9,2%
echo %filedatetime% 2009-01-28_15120393
Hope this helps you with your batch files.