System32 on Windows Cmd Help

rdpsign

Thu, 29 Sep 2022 05:54:05 +0000

Remote Desktop Session Host Server Sign Tool

rdpsign

C:\Windows\system32\rdpsign.exe /?

Output:

All rdp file(s) have been succesfully signed.

STDERR:

NAME

rdpsign [options] [items to sign]

OPTIONS

 /sha256 HASH
 Specified the SHA256 hash of the signing certificate.
 /q
 Quiet mode: No output when success, minimal output when failed.
 /v
 Verbose mode: Display all warnings, messages, and status.
 /l
 Test signing and output results without actually replacing any of the inputs. Ignores when input files are on stdin.

Return Code: 1

certreq

Thu, 29 Sep 2022 05:53:56 +0000

CertReq.exe

certreq

C:\Windows\system32\certreq.exe /?

Output:

Usage:
 CertReq -?
 CertReq [-v] -?
 CertReq [-Command] -?

 CertReq [-Submit] [Options] [RequestFileIn [CertFileOut [CertChainFileOut [FullResponseFileOut]]]]
 Submit a request to a Certification Authority.

 Options:
 -attrib AttributeString
 -binary
 -PolicyServer PolicyServer
 -config ConfigString
 -Anonymous
 -Kerberos
 -ClientCertificate ClientCertId
 -UserName UserName
 -p Password
 -crl
 -rpc
 -AdminForceMachine
 -RenewOnBehalfOf
 -NoChallenge

 CertReq -Retrieve [Options] RequestId [CertFileOut [CertChainFileOut [FullResponseFileOut]]]
 Retrieve a response to a previous request from a Certification Authority.

 Options:
 -binary
 -PolicyServer PolicyServer
 -config ConfigString
 -Anonymous
 -Kerberos
 -ClientCertificate ClientCertId
 -UserName UserName
 -p Password
 -crl
 -rpc
 -AdminForceMachine

 CertReq -New [Options] [PolicyFileIn [RequestFileOut]]
 Create a new request as directed by PolicyFileIn

 Options:
 -attrib AttributeString
 -binary
 -cert CertId
 -PolicyServer PolicyServer
 -config ConfigString
 -Anonymous
 -Kerberos
 -ClientCertificate ClientCertId
 -UserName UserName
 -p Password
 -pin Pin
 -user
 -machine
 -xchg ExchangeCertFile

 CertReq -Accept [Options] [CertChainFileIn | FullResponseFileIn | CertFileIn]
 Accept and install a response to a previous new request.

 Options:
 -user
 -machine
 -pin Pin

 CertReq -Policy [Options] [RequestFileIn [PolicyFileIn [RequestFileOut [PKCS10FileOut]]]]
 Construct a cross certification or qualified subordination request
 from an existing CA certificate or from an existing request.

 Options:
 -attrib AttributeString
 -binary
 -cert CertId
 -PolicyServer PolicyServer
 -Anonymous
 -Kerberos
 -ClientCertificate ClientCertId
 -UserName UserName
 -p Password
 -pin Pin
 -noEKU
 -AlternateSignatureAlgorithm
 -HashAlgorithm HashAlgorithm

 CertReq -Sign [Options] [RequestFileIn [RequestFileOut]]
 Sign a certificate request with an enrollment agent or qualified
 subordination signing certificate.

 Options:
 -binary
 -cert CertId
 -PolicyServer PolicyServer
 -Anonymous
 -Kerberos
 -ClientCertificate ClientCertId
 -UserName UserName
 -p Password
 -pin Pin
 -crl
 -noEKU
 -HashAlgorithm HashAlgorithm

 CertReq -Enroll [Options] TemplateName
 CertReq -Enroll -cert CertId [Options] Renew [ReuseKeys]
 Enroll for or renew a certificate.

 Options:
 -PolicyServer PolicyServer
 -user
 -machine
 -pin Pin

 CertReq -EnrollAIK [Options] [KeyContainerName]
 Enroll for AIK certificate.

 Options:
 -config

 CertReq -EnrollCredGuardCert [Options] TemplateName [ExtensionInfFile]
 Enroll for machine account Credential Guard certificate.

 Options:
 -config

 CertReq -EnrollLogon [Options]
 Enroll for Hello for Business Logon certificate via ADFS.

 Options:
 -q

 CertReq -Post [Options]
 POST an http request.

 Options:
 -attrib AttributeString
 -config URL

Return Code: 0

certutil

Thu, 29 Sep 2022 05:53:56 +0000

CertUtil.exe

certutil

C:\Windows\system32\certutil.exe /?

Output:


Verbs:
 -dump -- Dump configuration information or file
 -dumpPFX -- Dump PFX structure
 -asn -- Parse ASN.1 file

 -decodehex -- Decode hexadecimal-encoded file
 -decode -- Decode Base64-encoded file
 -encode -- Encode file to Base64

 -deny -- Deny pending request
 -resubmit -- Resubmit pending request
 -setattributes -- Set attributes for pending request
 -setextension -- Set extension for pending request
 -revoke -- Revoke Certificate
 -isvalid -- Display current certificate disposition

 -getconfig -- Get default configuration string
 -ping -- Ping Active Directory Certificate Services Request interface
 -pingadmin -- Ping Active Directory Certificate Services Admin interface
 -CAInfo -- Display CA Information
 -ca.cert -- Retrieve the CA's certificate
 -ca.chain -- Retrieve the CA's certificate chain
 -GetCRL -- Get CRL
 -CRL -- Publish new CRLs [or delta CRLs only]
 -shutdown -- Shutdown Active Directory Certificate Services

 -installCert -- Install Certification Authority certificate
 -renewCert -- Renew Certification Authority certificate

 -schema -- Dump Certificate Schema
 -view -- Dump Certificate View
 -db -- Dump Raw Database
 -deleterow -- Delete server database row

 -backup -- Backup Active Directory Certificate Services
 -backupDB -- Backup Active Directory Certificate Services database
 -backupKey -- Backup Active Directory Certificate Services certificate and private key
 -restore -- Restore Active Directory Certificate Services
 -restoreDB -- Restore Active Directory Certificate Services database
 -restoreKey -- Restore Active Directory Certificate Services certificate and private key
 -importPFX -- Import certificate and private key
 -dynamicfilelist -- Display dynamic file List
 -databaselocations -- Display database locations
 -hashfile -- Generate and display cryptographic hash over a file

 -store -- Dump certificate store
 -enumstore -- Enumerate certificate stores
 -addstore -- Add certificate to store
 -delstore -- Delete certificate from store
 -verifystore -- Verify certificate in store
 -repairstore -- Repair key association or update certificate properties or key security descriptor
 -viewstore -- Dump certificate store
 -viewdelstore -- Delete certificate from store
 -UI -- invoke CryptUI
 -attest -- Verify Key Attestation Request

 -dsPublish -- Publish certificate or CRL to Active Directory

 -ADTemplate -- Display AD templates
 -Template -- Display Enrollment Policy templates
 -TemplateCAs -- Display CAs for template
 -CATemplates -- Display templates for CA
 -SetCASites -- Manage Site Names for CAs
 -enrollmentServerURL -- Display, add or delete enrollment server URLs associated with a CA
 -ADCA -- Display AD CAs
 -CA -- Display Enrollment Policy CAs
 -Policy -- Display Enrollment Policy
 -PolicyCache -- Display or delete Enrollment Policy Cache entries
 -CredStore -- Display, add or delete Credential Store entries
 -InstallDefaultTemplates -- Install default certificate templates
 -URLCache -- Display or delete URL cache entries
 -pulse -- Pulse autoenrollment event or NGC task
 -MachineInfo -- Display Active Directory machine object information
 -DCInfo -- Display domain controller information
 -EntInfo -- Display enterprise information
 -TCAInfo -- Display CA information
 -SCInfo -- Display smart card information

 -SCRoots -- Manage smart card root certificates

 -DeleteHelloContainer -- Delete Hello Logon container.
 ** Users need to sign out after using this option for it to complete. **
 -verifykeys -- Verify public/private key set
 -verify -- Verify certificate, CRL or chain
 -verifyCTL -- Verify AuthRoot or Disallowed Certificates CTL
 -syncWithWU -- Sync with Windows Update
 -generateSSTFromWU -- Generate SST from Windows Update
 -generatePinRulesCTL -- Generate Pin Rules CTL
 -downloadOcsp -- Download OCSP Responses and Write to Directory
 -generateHpkpHeader -- Generate HPKP header using certificates in specified file or directory
 -flushCache -- Flush specified caches in selected process, such as, lsass.exe
 -addEccCurve -- Add ECC Curve
 -deleteEccCurve -- Delete ECC Curve
 -displayEccCurve -- Display ECC Curve
 -sign -- Re-sign CRL or certificate

 -vroot -- Create/delete web virtual roots and file shares
 -vocsproot -- Create/delete web virtual roots for OCSP web proxy
 -addEnrollmentServer -- Add an Enrollment Server application
 -deleteEnrollmentServer -- Delete an Enrollment Server application
 -addPolicyServer -- Add a Policy Server application
 -deletePolicyServer -- Delete a Policy Server application
 -oid -- Display ObjectId or set display name
 -error -- Display error code message text
 -getreg -- Display registry value
 -setreg -- Set registry value
 -delreg -- Delete registry value

 -ImportKMS -- Import user keys and certificates into server database for key archival
 -ImportCert -- Import a certificate file into the database
 -GetKey -- Retrieve archived private key recovery blob, generate a recovery script,
 or recover archived keys
 -RecoverKey -- Recover archived private key
 -MergePFX -- Merge PFX files
 -ConvertEPF -- Convert PFX files to EPF file

 -add-chain -- (-AddChain) Add certificate chain
 -add-pre-chain -- (-AddPrechain) Add pre-certificate chain
 -get-sth -- (-GetSTH) Get signed tree head
 -get-sth-consistency -- (-GetSTHConsistency) Get signed tree head changes
 -get-proof-by-hash -- (-GetProofByHash) Get proof by hash
 -get-entries -- (-GetEntries) Get entries
 -get-roots -- (-GetRoots) Get roots
 -get-entry-and-proof -- (-GetEntryAndProof) Get entry and proof
 -VerifyCT -- Verify certificate SCT
 -? -- Display this usage message


CertUtil -? -- Display a verb list (command list)
CertUtil -dump -? -- Display help text for the "dump" verb
CertUtil -v -? -- Display all help text for all verbs

CertUtil: -? command completed successfully.

Return Code: 0

dsregcmd

Thu, 29 Sep 2022 05:53:56 +0000

DSREG commandline tool

dsregcmd

C:\Windows\system32\dsregcmd.exe /?

Output:

DSREGCMD switches
 /? : Displays the help message for DSREGCMD
 /status : Displays the device join status
 /status_old : Displays the device join status in old format
 /join : Schedules and monitors the Autojoin task to Hybrid Join the device
 /leave : Performs Hybrid Unjoin
 /debug : Displays debug messages
 /refreshprt : Refreshes PRT in the CloudAP cache
 /UpdateDevice : Update device attributes to Azure AD

Return Code: 0

klist

Thu, 29 Sep 2022 05:53:56 +0000

Tool for managing the Kerberos ticket cache

klist

C:\Windows\system32\klist.exe /?

Output:


Usage: klist.exe [command]

Command list:
 [tickets] [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 tgt [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 purge [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 sessions [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 kcd_cache [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 get <SPN> [-lh <LogonId.HighPart>] [-li <LogonId.LowPart>]
 [-kdcoptions <options>] [-cacheoptions <options>]
 add_bind <DOMAIN> <DC>
 query_bind
 purge_bind
 cloud_debug

Return Code: 4294967295

mstsc

Thu, 29 Sep 2022 05:53:56 +0000

Remote Desktop Connection

mstsc

C:\Windows\system32\mstsc.exe /?

Output:

[Window Title]
Remote Desktop Connection Usage

[Content]
MSTSC [<connection file>] [/v:<server[:port]>] [/g:<gateway>] [/admin] [/f[ullscreen]] [/w:<width> /h:<height>] [/public] | [/span] [/multimon] [/edit "connection file"] [/restrictedAdmin] [/remoteGuard] [/prompt] [/shadow:<sessionID> [/control] [/noConsentPrompt]]

"connection file" -- Specifies the name of an .RDP file for the connection.

/v:<server[:port]> -- Specifies the remote PC to which you want to connect.

/g:<gateway> -- Specifies the RD Gateway server to use for the connection. This parameter is only read if the endpoint remote PC is specified with /v.

/admin -- Connects you to the session for administering a remote PC.

/f -- Starts Remote Desktop in full-screen mode.

/w:<width> -- Specifies the width of the Remote Desktop window.

/h:<height> -- Specifies the height of the Remote Desktop window.

/public -- Runs Remote Desktop in public mode.

/span -- Matches the remote desktop width and height with the local virtual desktop, spanning across multiple monitors, if necessary. To span across monitors, the monitors must be arranged to form a rectangle.

/multimon -- Configures the Remote Desktop Services session monitor layout to be identical to the current client-side configuration.

/edit -- Opens the specified .RDP connection file for editing.

/restrictedAdmin -- Connects you to the remote PC in Restricted Administration mode. In this mode, credentials won't be sent to the remote PC, which can protect you if you connect to a PC that has been compromised. However, connections made from the remote PC might not be authenticated by other PCs, which might impact application functionality and compatibility. This parameter implies /admin.

/remoteGuard -- Connects your device to a remote device using Remote Guard. Remote Guard prevents credentials from being sent to the remote PC, which can help protect your credentials if you connect to a remote PC that has been compromised. Unlike Restricted Administration mode, Remote Guard also supports connections made from the remote PC by redirecting all requests back to your device.

/prompt -- Prompts you for your credentials when you connect to the remote PC.

/shadow:<sessionID> -- Specifies the ID of the session to shadow.

/control -- Allows control of the session when shadowing.

/noConsentPrompt -- Allows shadowing without user consent.

[OK]

Return Code: 1

robocopy

Thu, 29 Sep 2022 05:53:53 +0000

Microsoft Robocopy

robocopy

C:\Windows\system32\Robocopy.exe /?

Output:


-------------------------------------------------------------------------------
 ROBOCOPY :: Robust File Copy for Windows
-------------------------------------------------------------------------------

 Started : Monday, January 01, 2006 15:04:06 AM
 Usage :: ROBOCOPY source destination [file [file]...] [options]

 source :: Source Directory (drive:\path or \\server\share\path).
 destination :: Destination Dir (drive:\path or \\server\share\path).
 file :: File(s) to copy (names/wildcards: default is "*.*").

::
:: Copy options :
::
 /S :: copy Subdirectories, but not empty ones.
 /E :: copy subdirectories, including Empty ones.
 /LEV:n :: only copy the top n LEVels of the source directory tree.

 /Z :: copy files in restartable mode.
 /B :: copy files in Backup mode.
 /ZB :: use restartable mode; if access denied use Backup mode.
 /J :: copy using unbuffered I/O (recommended for large files).
 /EFSRAW :: copy all encrypted files in EFS RAW mode.

 /COPY:copyflag[s] :: what to COPY for files (default is /COPY:DAT).
 (copyflags : D=Data, A=Attributes, T=Timestamps, X=Skip alt data streams).
 (S=Security=NTFS ACLs, O=Owner info, U=aUditing info).


 /SEC :: copy files with SECurity (equivalent to /COPY:DATS).
 /COPYALL :: COPY ALL file info (equivalent to /COPY:DATSOU).
 /NOCOPY :: COPY NO file info (useful with /PURGE).
 /SECFIX :: FIX file SECurity on all files, even skipped files.
 /TIMFIX :: FIX file TIMes on all files, even skipped files.

 /PURGE :: delete dest files/dirs that no longer exist in source.
 /MIR :: MIRror a directory tree (equivalent to /E plus /PURGE).

 /MOV :: MOVe files (delete from source after copying).
 /MOVE :: MOVE files AND dirs (delete from source after copying).

 /A+:[RASHCNET] :: add the given Attributes to copied files.
 /A-:[RASHCNET] :: remove the given Attributes from copied files.

 /CREATE :: CREATE directory tree and zero-length files only.
 /FAT :: create destination files using 8.3 FAT file names only.
 /256 :: turn off very long path (> 256 characters) support.

 /MON:n :: MONitor source; run again when more than n changes seen.
 /MOT:m :: MOnitor source; run again in m minutes Time, if changed.

 /RH:hhmm-hhmm :: Run Hours - times when new copies may be started.
 /PF :: check run hours on a Per File (not per pass) basis.

 /IPG:n :: Inter-Packet Gap (ms), to free bandwidth on slow lines.

 /SJ :: copy Junctions as junctions instead of as the junction targets.
 /SL :: copy Symbolic Links as links instead of as the link targets.

 /MT[:n] :: Do multi-threaded copies with n threads (default 8).
 n must be at least 1 and not greater than 128.
 This option is incompatible with the /IPG and /EFSRAW options.
 Redirect output using /LOG option for better performance.

 /DCOPY:copyflag[s] :: what to COPY for directories (default is /DCOPY:DA).
 (copyflags : D=Data, A=Attributes, T=Timestamps, E=EAs, X=Skip alt data streams).

 /NODCOPY :: COPY NO directory info (by default /DCOPY:DA is done).

 /NOOFFLOAD :: copy files without using the Windows Copy Offload mechanism.

 /COMPRESS :: Request network compression during file transfer, if applicable.

::
:: File Selection Options :
::
 /A :: copy only files with the Archive attribute set.
 /M :: copy only files with the Archive attribute and reset it.
 /IA:[RASHCNETO] :: Include only files with any of the given Attributes set.
 /XA:[RASHCNETO] :: eXclude files with any of the given Attributes set.

 /XF file [file]... :: eXclude Files matching given names/paths/wildcards.
 /XD dirs [dirs]... :: eXclude Directories matching given names/paths.

 /XC :: eXclude Changed files.
 /XN :: eXclude Newer files.
 /XO :: eXclude Older files.
 /XX :: eXclude eXtra files and directories.
 /XL :: eXclude Lonely files and directories.
 /IS :: Include Same files.
 /IT :: Include Tweaked files.

 /MAX:n :: MAXimum file size - exclude files bigger than n bytes.
 /MIN:n :: MINimum file size - exclude files smaller than n bytes.

 /MAXAGE:n :: MAXimum file AGE - exclude files older than n days/date.
 /MINAGE:n :: MINimum file AGE - exclude files newer than n days/date.
 /MAXLAD:n :: MAXimum Last Access Date - exclude files unused since n.
 /MINLAD:n :: MINimum Last Access Date - exclude files used since n.
 (If n < 1900 then n = n days, else n = YYYYMMDD date).

 /FFT :: assume FAT File Times (2-second granularity).
 /DST :: compensate for one-hour DST time differences.

 /XJ :: eXclude symbolic links (for both files and directories) and Junction points.
 /XJD :: eXclude symbolic links for Directories and Junction points.
 /XJF :: eXclude symbolic links for Files.

 /IM :: Include Modified files (differing change times).
::
:: Retry Options :
::
 /R:n :: number of Retries on failed copies: default 1 million.
 /W:n :: Wait time between retries: default is 30 seconds.

 /REG :: Save /R:n and /W:n in the Registry as default settings.

 /TBD :: Wait for sharenames To Be Defined (retry error 67).

 /LFSM :: Operate in low free space mode, enabling copy pause and resume (see Remarks).

 /LFSM:n[KMG] :: /LFSM, specifying the floor size in n [K:kilo,M:mega,G:giga] bytes.

::
:: Logging Options :
::
 /L :: List only - don't copy, timestamp or delete any files.
 /X :: report all eXtra files, not just those selected.
 /V :: produce Verbose output, showing skipped files.
 /TS :: include source file Time Stamps in the output.
 /FP :: include Full Pathname of files in the output.
 /BYTES :: Print sizes as bytes.

 /NS :: No Size - don't log file sizes.
 /NC :: No Class - don't log file classes.
 /NFL :: No File List - don't log file names.
 /NDL :: No Directory List - don't log directory names.

 /NP :: No Progress - don't display percentage copied.
 /ETA :: show Estimated Time of Arrival of copied files.

 /LOG:file :: output status to LOG file (overwrite existing log).
 /LOG+:file :: output status to LOG file (append to existing log).

 /UNILOG:file :: output status to LOG file as UNICODE (overwrite existing log).
 /UNILOG+:file :: output status to LOG file as UNICODE (append to existing log).

 /TEE :: output to console window, as well as the log file.

 /NJH :: No Job Header.
 /NJS :: No Job Summary.

 /UNICODE :: output status as UNICODE.

::
:: Job Options :
::
 /JOB:jobname :: take parameters from the named JOB file.
 /SAVE:jobname :: SAVE parameters to the named job file
 /QUIT :: QUIT after processing command line (to view parameters).
 /NOSD :: NO Source Directory is specified.
 /NODD :: NO Destination Directory is specified.
 /IF :: Include the following Files.

::
:: Remarks :
::
 Using /PURGE or /MIR on the root directory of the volume formerly caused
 robocopy to apply the requested operation on files inside the System
 Volume Information directory as well. This is no longer the case; if
 either is specified, robocopy will skip any files or directories with that
 name in the top-level source and destination directories of the copy session.

 The modified files classification applies only when both source
 and destination filesystems support change timestamps (e.g., NTFS)
 and the source and destination files have different change times but are
 otherwise the same. These files are not copied by default; specify /IM
 to include them.

 The /DCOPY:E flag requests that extended attribute copying should be
 attempted for directories. Note that currently robocopy will continue
 if a directory's EAs could not be copied. This flag is also not included
 in /COPYALL.

 Using /LFSM requests robocopy to operate in 'low free space mode'.
 In that mode, robocopy will pause whenever a file copy would cause the
 destination volume's free space to go below a 'floor' value, which
 can be explicitly specified by the LFSM:n[KMG] form of the flag.
 If /LFSM is specified with no explicit floor value, the floor is set to
 ten percent of the destination volume's size.
 Low free space mode is incompatible with /MT, /EFSRAW, /B, and /ZB.

Return Code: 16

securityhealthservice

Thu, 29 Sep 2022 05:53:37 +0000

Windows Security Health Service

securityhealthservice

C:\Windows\system32\SecurityHealthService.exe /?

Output:

Unknown switch.

Return Code: 2147942487

nltest

Thu, 29 Sep 2022 04:58:58 +0000

Microsoftr Logon Server Test Utility

nltest

C:\Windows\system32\nltest.exe /?

STDERR:

Usage: nltest [/OPTIONS]


 /SERVER:<ServerName> - Specify <ServerName>

 /QUERY - Query <ServerName> netlogon service
 /REPL - Force partial sync on <ServerName> BDC
 /SYNC - Force full sync on <ServerName> BDC
 /PDC_REPL - Force UAS change message from <ServerName> PDC

 /SC_QUERY:<DomainName> - Query secure channel for <Domain> on <ServerName>
 /SC_RESET:<DomainName>[\<DcName>] - Reset secure channel for <Domain> on <ServerName> to <DcName>
 /SC_VERIFY:<DomainName> - Verify secure channel for <Domain> on <ServerName>
 /SC_CHANGE_PWD:<DomainName> - Change a secure channel password for <Domain> on <ServerName>
 /DCLIST:<DomainName> - Get list of DC's for <DomainName>
 /DCNAME:<DomainName> - Get the PDC name for <DomainName>
 /DSGETDC:<DomainName> - Call DsGetDcName /PDC /DS /DSP /GC /KDC
 /TIMESERV /GTIMESERV /WS /NETBIOS /DNS /IP /FORCE /WRITABLE /AVOIDSELF /LDAPONLY /BACKG /DS_6 /DS_8 /DS_9 /DS_10
 /KEYLIST /TRY_NEXT_CLOSEST_SITE /SITE:<SiteName> /ACCOUNT:<AccountName> /RET_DNS /RET_NETBIOS
 /DNSGETDC:<DomainName> - Call DsGetDcOpen/Next/Close /PDC /GC
 /KDC /WRITABLE /LDAPONLY /FORCE /SITESPEC
 /DSGETFTI:<DomainName> - Call DsGetForestTrustInformation
 /UPDATE_TDO
 /LSAQUERYFTI:<TrustedForest> - Call LsaQueryForestTrustInformation
 /DSGETSITE - Call DsGetSiteName
 /DSGETSITECOV - Call DsGetDcSiteCoverage
 /DSADDRESSTOSITE:[MachineName] - Call DsAddressToSiteNamesEx
 /ADDRESSES:<Address1,Address2,...>
 /PARENTDOMAIN - Get the name of the parent domain of this machine
 /WHOWILL:<Domain>* <User> [<Iteration>] - See if <Domain> will log on <User>
 /FINDUSER:<User> - See which trusted domain will log on <User>
 /TRANSPORT_NOTIFY - Notify netlogon of new transport

 /DBFLAG:<HexFlags> - New debug flag

 /USER:<UserName> - Query User info on <ServerName>

 /TIME:<Hex LSL> <Hex MSL> - Convert NT GMT time to ascii
 /LOGON_QUERY - Query number of cumulative logon attempts
 /DOMAIN_TRUSTS - Query domain trusts on <ServerName>
 /PRIMARY /FOREST /DIRECT_OUT /DIRECT_IN /ALL_TRUSTS /V
 /DSREGDNS - Force registration of all DC-specific DNS records
 /DSDEREGDNS:<DnsHostName> - Deregister DC-specific DNS records for specified DC
 /DOM:<DnsDomainName> /DOMGUID:<DomainGuid> /DSAGUID:<DsaGuid>
 /DSQUERYDNS - Query the status of the last update for all DC-specific DNS records

 /BDC_QUERY:<DomainName> - Query replication status of BDCs for <DomainName>

 /LIST_DELTAS:<FileName> - display the content of given change log file

 /CDIGEST:<Message> /DOMAIN:<DomainName> - Get client digest
 /SDIGEST:<Message> /RID:<RID in hex> - Get server digest

 /SHUTDOWN:<Reason> [<Seconds>] - Shutdown <ServerName> for <Reason>
 /SHUTDOWN_ABORT - Abort a system shutdown

Return Code: 1

clipup

Thu, 29 Sep 2022 04:58:56 +0000

Client License Platform migration tool

clipup

C:\Windows\system32\ClipUp.exe /?

Output:

Done.

Return Code: 0

gpresult

Thu, 29 Sep 2022 04:58:56 +0000

Query Group Policy RSOP Data

gpresult

C:\Windows\system32\gpresult.exe /?

Output:


GPRESULT [/S system [/U username [/P [password]]]] [/SCOPE scope]
 [/USER targetusername] [/R | /V | /Z] [(/X | /H) <filename> [/F]]

Description:
 This command line tool displays the Resultant Set of Policy (RSoP)
 information for a target user and computer.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which the
 command should run.
 Can not be used with /X, /H.

 /P [password] Specifies the password for the given user
 context. Prompts for input if omitted.
 Cannot be used with /X, /H.

 /SCOPE scope Specifies whether the user or the
 computer settings need to be displayed.
 Valid values: "USER", "COMPUTER".

 /USER [domain\]user Specifies the user name for which the
 RSoP data is to be displayed.

 /X <filename> Saves the report in XML format at the
 location and with the file name specified
 by the <filename> parameter. (valid in Windows
 Vista SP1 and later and Windows Server 2008 and later)

 /H <filename> Saves the report in HTML format at the
 location and with the file name specified by
 the <filename> parameter. (valid in Windows
 at least Vista SP1 and at least Windows Server 2008)

 /F Forces Gpresult to overwrite the file name
 specified in the /X or /H command.

 /R Displays RSoP summary data.

 /V Specifies that verbose information should
 be displayed. Verbose information provides
 additional detailed settings that have
 been applied with a precedence of 1.

 /Z Specifies that the super-verbose
 information should be displayed. Super-
 verbose information provides additional
 detailed settings that have been applied
 with a precedence of 1 and higher. This
 allows you to see if a setting was set in
 multiple places. See the Group Policy
 online help topic for more information.

 /? Displays this help message.


Examples:
 GPRESULT /R
 GPRESULT /H GPReport.html
 GPRESULT /USER targetusername /V
 GPRESULT /S system /USER targetusername /SCOPE COMPUTER /Z
 GPRESULT /S system /U username /P password /SCOPE USER /V

Return Code: 0

lpksetup

Thu, 29 Sep 2022 04:58:48 +0000

Language Pack Installer

lpksetup

C:\Windows\system32\lpksetup.exe /?

Output:

[Window Title]
Install or uninstall display languages

[Main Instruction]
Install or uninstall display languages

[Content]
MODES:

 lpksetup /?
 lpksetup /i [{* | language_list}] [/p language_pack_path] [options]
 lpksetup /u [language_list] [options]

Help

 /? - Display this help text.

Install

 /i - Installs the specified language packs. Cannot be used with the /u option. If you do not include * or
 language_list after the /i option, and if the /s option is not used, the program will start and you can install
 through the graphical user interface (GUI).

 * - Specifies a wildcard character that represents all language packs found in language_pack_path or
 the directory where Lpksetup.exe is located.

 language_list - Specifies the names of one or more languages in a space-delimited list. Use the
 language name format "language-REGION" for each language specified, where language is the lowercase ISO
 639 language code and REGION is the uppercase ISO 3166-1 country/region identifier, e.g., en-US, fr-FR,
 en-GB, zh-CN.

 /p - Indicates the path of the language packs to install. If the /s and /i option are both used, the /p option
 is required.

 language_pack_path - Can be a directory or a folder path, e.g., c:\langpackfolder\ or
 \\networkshare\langpackfolder.

Uninstall

 /u - Uninstalls the specified language pack or packs. Cannot be used with the /i option. If you do not include
 language_list after the /u option, and if the /s option is not used, the program will start and you can
 uninstall through the GUI.

 language_list - Specifies the names of one or more languages in a space-delimited list. Use the
 language name format "language-REGION" for each language specified, where language is the lowercase ISO
 639 language code and REGION is the uppercase ISO 3166-1 country/region identifier, e.g., en-US, fr-FR,
 en-GB, zh-CN.

OPTIONS:

 /r - Suppresses the need to restart after an operation is completed. A message will be logged to the event log
 about the need to restart.

 /f - If the computer must restart, forces a restart even if there are other users logged on to the computer
 after an operation is completed.

 /a - Verifies that all listed language packs can be installed or removed before processing. If any of the
 language packs cannot be installed or removed, an error is returned and none of the specified language packs
 are installed or removed.

 If you do not include the /a option,
 all specified language packs are installed or removed except the one that failed, an entry is created in the
 Event log, and the operation is returned as successful.

 /s - Performs a silent and unattended operation that requires no user input. The GUI is suppressed.

EXAMPLES:

 Install all language packs that are located at the given location:
 lpksetup /i * /p <language_pack_path>

 Uninstall two language packs - Lpksetup will be started in GUI mode but will not require user intervention:
 lpksetup /u ja-JP es-ES

 Install three language packs stored at the given location:
 lpksetup /i ja-JP en-US es-ES /r /s /p <language_pack_path>

[Close]

Return Code: 1

refsutil

Thu, 29 Sep 2022 04:58:43 +0000

refsutil.exe

refsutil

C:\Windows\system32\refsutil.exe /?

Output:

---- Commands Supported ----
fixboot Repair boot sectors
leak Leak Detection and Fixing
salvage Salvage operations for corrupt volume
triage Handle corruptions

Return Code: 0

mdmdiagnosticstool

Thu, 29 Sep 2022 04:58:41 +0000

MdmDiagnosticsTool

mdmdiagnosticstool

C:\Windows\system32\MdmDiagnosticsTool.exe /?

Output:


 Usage1: C:\Windows\system32\MdmDiagnosticsTool.exe -out <output folder path>
 * Output MDM diagnostics info only to given folder path specified in -out parameter.
 eg: C:\Windows\system32\MdmDiagnosticsTool.exe -out c:\temp\outputfolder

 Usage2: C:\Windows\system32\MdmDiagnosticsTool.exe -area <area name(s)> -cab <output cab file path>
 * Collect predefined area logs and create a log cab to given cab file.
 * Supported area name example:
 Autopilot
 DeviceProvisioning
 Tpm
 * It also supports multiple areas, separated by ';', example:
 Autopilot;DeviceEnrollment;Tpm
 * Please find all possible areas in registry under:
 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MdmDiagnostics\Area
 eg: C:\Windows\system32\MdmDiagnosticsTool.exe -area Autopilot;Tpm -cab c:\temp\AutopilotDiag.cab
 Usage3: C:\Windows\system32\MdmDiagnosticsTool.exe -area <area name(s)> -zip <output zip file path>
 * Collect predefined area logs and create a log zip to given zip file. Areas supported are the same as Usage2 for creating cab
 Usage4: C:\Windows\system32\MdmDiagnosticsTool.exe -xml <xml file of information to gather> -zip <output zip file path> -server <MDM Server to alert>
 * Collect information specified in the xml and create a log zip to given zip file.

Return Code: 2147942487

licensingdiag

Thu, 29 Sep 2022 04:58:38 +0000

Licensing Diagnostic Tool

LicensingDiag

C:\Windows\system32\licensingdiag.exe /?

Output:

---------------------------
Microsoft Licensing Diagnostic Tool
---------------------------
Usage: LicensingDiag -cab <CAB file path name>
---------------------------
OK
---------------------------

Return Code: 1

bcdedit

Thu, 29 Sep 2022 04:58:35 +0000

Boot Configuration Data Editor

bcdedit

C:\Windows\system32\bcdedit.exe /?

Output:


BCDEDIT - Boot Configuration Data Store Editor

The Bcdedit.exe command-line tool modifies the boot configuration data store.
The boot configuration data store contains boot configuration parameters and
controls how the operating system is booted. These parameters were previously
in the Boot.ini file (in BIOS-based operating systems) or in the nonvolatile
RAM entries (in Extensible Firmware Interface-based operating systems). You can
use Bcdedit.exe to add, delete, edit, and append entries in the boot
configuration data store.

For detailed command and option information, type bcdedit.exe /? <command>. For
example, to display detailed information about the /createstore command, type:

 bcdedit.exe /? /createstore

For an alphabetical list of topics in this help file, run "bcdedit /? TOPICS".

Commands that operate on a store
================================
/store Used to specify a BCD store other than the current system default.
/createstore Creates a new and empty boot configuration data store.
/export Exports the contents of the system store to a file. This file
 can be used later to restore the state of the system store.
/import Restores the state of the system store using a backup file
 created with the /export command.
/sysstore Sets the system store device (only affects EFI systems, does
 not persist across reboots, and is only used in cases where
 the system store device is ambiguous).

Commands that operate on entries in a store
===========================================
/copy Makes copies of entries in the store.
/create Creates new entries in the store.
/delete Deletes entries from the store.
/mirror Creates mirror of entries in the store.

Run bcdedit /? ID for information about identifiers used by these commands.

Commands that operate on entry options
======================================
/deletevalue Deletes entry options from the store.
/set Sets entry option values in the store.

Run bcdedit /? TYPES for a list of datatypes used by these commands.
Run bcdedit /? FORMATS for a list of valid data formats.

Commands that control output
============================
/enum Lists entries in the store.
/v Command-line option that displays entry identifiers in full,
 rather than using names for well-known identifiers.
 Use /v by itself as a command to display entry identifiers
 in full for the ACTIVE type.

Running "bcdedit" by itself is equivalent to running "bcdedit /enum ACTIVE".

Commands that control the boot manager
======================================
/bootsequence Sets the one-time boot sequence for the boot manager.
/default Sets the default entry that the boot manager will use.
/displayorder Sets the order in which the boot manager displays the
 multiboot menu.
/timeout Sets the boot manager time-out value.
/toolsdisplayorder Sets the order in which the boot manager displays
 the tools menu.

Commands that control Emergency Management Services for a boot application
==========================================================================
/bootems Enables or disables Emergency Management Services
 for a boot application.
/ems Enables or disables Emergency Management Services for an
 operating system entry.
/emssettings Sets the global Emergency Management Services parameters.

Command that control debugging
==============================
/bootdebug Enables or disables boot debugging for a boot application.
/dbgsettings Sets the global debugger parameters.
/debug Enables or disables kernel debugging for an operating system
 entry.
/hypervisorsettings Sets the hypervisor parameters.

Command that control remote event logging
=========================================
/eventsettings Sets the global remote event logging parameters.
/event Enables or disables remote event logging for an operating
 system entry.

Return Code: 0

mrt

Thu, 29 Sep 2022 04:50:07 +0000

Microsoft Windows Malicious Software Removal Tool

MRT

C:\Windows\system32\MRT.exe /?

Output:

---------------------------
Malicious Software Removal Tool
---------------------------
Usage:
/Q or /quiet - quiet mode; if set, no UI is shown
/? or /help - displays usage information
/N - detect-only mode
/F - force full scan
/F:Y - same as above, but automatically clean infected files.
---------------------------
OK
---------------------------

Return Code: 1

bitlockerwizard

Thu, 07 Jul 2022 23:49:33 +0000

BitLocker Drive Encryption Wizard

bitlockerwizard

C:\Windows\system32\BitLockerWizard.exe /?

STDERR:

Bitlocker Wizard Launcher
 Usage: BitlockerWizard X: <P|R|S|T>
 P is mapped to FVEUI_AFTER_TPM_PPI_NO_REBOOT
 R is mapped to FVEUI_AFTER_TPM_PPI_REBOOT
 S is mapped to FVEUI_MODE_CREATE_NO_REBOOT
 T is mapped to FVEUI_MODE_CREATE_AFTER_REBOOT
 U is mapped to FVEUI_MODE_DUPLICATEKEY
 V is mapped to FVEUI_MODE_RESUME
 W is mapped to FVEUI_AFTER_REPARTITION
 X is mapped to FVEUI_PARAM_AFTER_REPARTITION_TPM_PPI
 Y is mapped to FVEUI_PARAM_SAVE_RECOVERY
 Z is mapped to FVEUI_PARAM_PASSPHRASE
 K is mapped to FVEUI_PARAM_STARTUPKEY
 J is mapped to FVEUI_PARAM_CHANGE_PIN
 I is mapped to FVEUI_PARAM_STARTUP_UNLOCK

Return Code: 0

wbadmin

Thu, 07 Jul 2022 23:49:33 +0000

Command Line Interface for Microsoftr BLB Backup

wbadmin

C:\Windows\system32\wbadmin.exe /?

Output:

wbadmin 1.0 - Backup command-line tool
(C) Copyright Microsoft Corporation. All rights reserved.

---- Commands Supported ----

ENABLE BACKUP -- Creates or modifies a daily backup schedule.
DISABLE BACKUP -- Disables the scheduled backups.
START BACKUP -- Runs a one-time backup.
STOP JOB -- Stops the currently running backup or recovery
 operation.
GET VERSIONS -- Lists details of backups that can be recovered
 from a specified location.
GET ITEMS -- Lists items contained in a backup.
GET STATUS -- Reports the status of the currently running
 operation.
DELETE BACKUP -- Deletes one or more backups.

Return Code: 4294967295

scriptrunner

Thu, 07 Jul 2022 23:49:13 +0000

scriptrunner

C:\Windows\system32\ScriptRunner.exe /?

Output:

Usage:
ScriptRunner.exe
-appvscript scriptFileName [Arguments] [-appvscriptrunnerparameters [-wait] [-timeout=<TimeInSeconds>] [-rollbackonerror]]
-appvscript scriptFileName [Arguments] [-appvscriptrunnerparameters [-wait] [-timeout=<TimeInSeconds>] [-rollbackonerror]]
...
Default values for -appvscriptrunnerparameters: No wait, No timeout, No rollback on error
Every parameter must be separated by a unicode space character (U+0020)
Example:
ScriptRunner.exe -appvscript foo.cmd arg1 arg2 -appvscriptrunnerparameters -wait -timeout=30 -rollbackonerror -appvscript foobar.exe arg1 arg2

Return Code: 0

wsl

Thu, 07 Jul 2022 23:49:01 +0000

Microsoft Windows Subsystem for Linux Launcher

wsl

C:\Windows\system32\wsl.exe –help

Output:


Copyright (c) Microsoft Corporation. All rights reserved.

Usage: wsl.exe [Argument]

Arguments:

 --install <Options>
 Install Windows Subsystem for Linux features. If no options are specified,
 the recommended features will be installed along with the default distribution.

 To view the default distribution as well as a list of other valid distributions,
 use 'wsl --list --online'.

 Options:
 --distribution, -d [Argument]
 Specifies the distribution to be downloaded and installed by name.

 Arguments:
 A valid distribution name (not case sensitive).

 Examples:
 wsl --install -d Ubuntu
 wsl --install --distribution Debian

 --list, -l [Options]
 Lists distributions.

 Options:
 --online, -o
 Displays a list of available distributions for install with 'wsl --install'.

 --help
 Display usage information.

Return Code: 1

upprinterinstaller

Thu, 07 Jul 2022 23:49:00 +0000

UPPrinterInstaller

upprinterinstaller

C:\Windows\system32\UPPrinterInstaller.exe /?

Output:

usage: UPPrinterInstaller.exe <[-install | -i] | [-uninstall | -u]> <[-printersharedid | -psi] [printersharedid]> <[-omadmaccountid | -oai] [omadmacountid]>
 <[-correlationid | -cri] [correlationid]>
 Required parameters:
 -install or -uninstall
 -printersharedid printersharedid
 -omadmaccountid omadmaccountid
 -correlationid correlationid
 Example:
 UPPritnerInstaller.exe -install -printersharedid E7CBB880-A194-450A-ACC7-86AEE809B971 -omadmaccountid 8A917C42-BE97-49EA-AD77-6EF9FE143E04 -correlationid 8A7E7CDE-D0EE-4C45-86FB-3570C3D5F81F

Return Code: 2147942487

spectrum

Thu, 07 Jul 2022 23:48:59 +0000

Windows Perception Service

spectrum

C:\Windows\system32\Spectrum.exe /?

Output:

Unrecognized parameter: /?
Parameters:
 /debug to run the service executable in debug mode
 /safemode to set up the service to run in safe mode
 /safemode:off to disable safe mode if enabled

Return Code: 2147942487

pktmon

Thu, 07 Jul 2022 23:48:58 +0000

Packet Monitor

pktmon

C:\Windows\system32\PktMon.exe /?

Output:

pktmon <command> [OPTIONS | help]
 Advanced packet capture and event collection.

Commands
 filter Manage packet filters.
 list List packet processing components.

 start Start packet capture and event collection.
 stop Stop data collection.
 status Query current status.
 unload Unload PktMon driver.

 counters Display current packet counters.
 reset Reset packet counters to zero.

 etl2txt Convert log file to text format.
 etl2pcap Convert log file to pcapng format.
 hex2pkt Decode packet in hexadecimal format.

 help Show help text for specific command.
 Example: pktmon start help

Return Code: 0

ksetup

Thu, 07 Jul 2022 23:48:56 +0000

Kerberos Setup tool

ksetup

C:\Windows\system32\ksetup.exe /?

Output:


USAGE:
/SetRealm <DnsDomainName>
 Makes this computer a member of an RFC1510 Kerberos Realm
/MapUser <Principal> [Account]
 Maps a Kerberos Principal ('*' = any principal)
 to an account ('*' = an account by same name);
 If account name is omitted, mapping is deleted
 for the specified principal
/AddKdc <RealmName> [KdcName]
 Defines a KDC entry for the given realm.
 If KdcName omitted, DNS may be used to locate KDCs.
/DelKdc <RealmName> [KdcName]
 deletes a KDC entry for the realm.
 If KdcName omitted, the realm entry itself is deleted.
/AddKpasswd <Realmname> <KpasswdName>
 Add Kpasswd server address for a realm
/DelKpasswd <Realmname> <KpasswdName>
 Delete Kpasswd server address for a realm
/Server <Servername>
 specify name of a Windows machine to target the changes.
/SetComputerPassword <Password>
 Sets the password for the computer's domain account
 (or host principal)
/RemoveRealm <RealmName>
 delete all information for this realm from the registry.
/Domain [DomainName]
 use this domain (if DomainName is unspecified, detect it)
/ChangePassword <OldPasswd> <NewPasswd>
 Use Kpasswd to change the logged-on user's password.
 Use '*' to be prompted for passwords.
/ListRealmFlags (no args)
 Lists the available Realm flags that ksetup knows
/SetRealmFlags <realm> <flag> [flag] [flag] [...]
 Sets RealmFlags for a specific realm
/AddRealmFlags <realm> <flag> [flag] [flag] [...]
 Adds additional RealmFlags to a realm
/DelRealmFlags <realm> <flag> [flag] [flag] [...]
 Deletes RealmFlags from a realm.
/DumpState (no args)
 Analyze the kerberos configuration on the given machine.
/AddHostToRealmMap <host> <realm>
 Adds a mapping for <host> to <realm> to the registry.
/DelHostToRealmMap <host> <realm>
 Deletes existing mapping for <host> to <realm> from the registry.
/SetEncTypeAttr <domainname> <enctypes>
 Sets the encryption types trust attribute for <domain> to <enctypes> (multiple types should be separated by spaces).
 Supported encryption types are:
 DES-CBC-CRC, DES-CBC-MD5, RC4-HMAC-MD5,
 AES128-CTS-HMAC-SHA1-96, AES256-CTS-HMAC-SHA1-96
/GetEncTypeAttr <domainname>
 Gets the encryption types trust attribute for <domain>.
/AddEncTypeAttr <domainname> <enctypes>
 Adds <enctypes> to the encryption types trust attribute for <domain> (multiple types should be separated by spaces).
/DelEncTypeAttr <domainname>
 Deletes the encryption types trust attribute for <domain>.

Return Code: 0

checknetisolation

Thu, 07 Jul 2022 23:48:55 +0000

AppContainer Network Isolation Diagnostic Tool

checknetisolation

C:\Windows\system32\CheckNetIsolation.exe /?

Output:


Usage:
 CheckNetIsolation [Module]
 List Of Modules:
 LoopbackExempt - controls the loopback exemption of AppContainers
 and Package Families to ease application
 development.
 Debug - Starts a network traffic troubleshooting session
 of an AppContainer or Package Family. Generates a
 report of network capabilities that are used, not
 used or missing, together with the network traffic
 generated by the application.
 -? - Displays this help message.

Return Code: 0

LoopbackExempt

C:\Windows\system32\CheckNetIsolation.exe LoopbackExempt /?

Output:


Usage:
 CheckNetIsolation LoopbackExempt [operation] [-n=] [-p=]
 List of operations:
 -a - Add the AppContainer or Package Family to the loopback
 exempted list.
 -d - Delete an AppContainer or Package Family from the
 loopback exempted list.
 -c - Clear the list of loopback exempted AppContainers and
 Package Families.
 -s - Show a list of loopback exempted AppContainers and
 Package Families.

 List of arguments:
 -n= - AppContainer Name or Package Family Name.
 -p= - AppContainer or Package Family Security Identifier (SID).
 -? - Displays this help message for the LoopbackExempt module.

OK.

Return Code: 0

Debug

C:\Windows\system32\CheckNetIsolation.exe debug /?

Output:


Usage:
 CheckNetIsolation Debug [-n=] [-p=]

 List of arguments:
 -n= - AppContainer Name or Package Family Name.
 -p= - AppContainer or Package Family Security Identifier (SID).
 -cac - Indicate that the debug session should include events
from Child AppContainers.

 -? - Displays this help message for the Debug module.

OK.

Return Code: 0

diskperf

Thu, 07 Jul 2022 23:48:55 +0000

Disk Performance Configuration Utility

diskperf

C:\Windows\system32\diskperf.exe -?

Output:



DISKPERF=====================

Starts and stops system disk performance counters.

Used without the command switches, DISKPERF reports what disk
performance counters are enabled on the specified Windows 2000 computer.

Disk performance counters can be specified to report the
performance of the individual physical drives, or the individual
logical drives or storage volumes. Note that these two sets of
performance counters are measured independently. The user
has the option of enabling and disabling them independently
using the command line switches.
NOTE: This command can only be used to control remote
Windows 2000 systems. In newer systems, these performance counters
are automatically enabled.

DISKPERF [-Y[D|V] | -N[D|V]] [\\computername]

 -Y Sets the system to start all disk performance counters
 when the system is restarted.

 -YD Enables the disk performance counters for physical drives.
 when the system is restarted.
 -YV Enables the disk performance counters for logical drives
 or storage volumes when the system is restarted.
 -N Sets the system to disable all disk performance counters
 when the system is restarted.

 -ND Disables the disk performance counters for physical drives.
 -NV Disables the disk performance counters for logical drives.
 \\computername Is the name of the computer you want to
 see or set disk performance counter use.
 The computer must be a Windows 2000 system.
 NOTE: Disk performance counters are permanently enabled on
 systems beyond Windows 2000.

Return Code: 0

logman

Thu, 07 Jul 2022 23:48:55 +0000

Performance Log Utility

logman

C:\Windows\system32\logman.exe /?

Output:


Microsoft r Logman.exe (10.0.19041.1741)

Usage:
 C:\Windows\system32\logman.exe [create|query|start|stop|delete|update|import|export] [options]

Verbs:
 create Create a new data collector.
 query Query data collector properties. If no name
 is given all data collectors are listed.
 start Start an existing data collector and set the
 begin time to manual.
 stop Stop an existing data collector and set the
 end time to manual.
 delete Delete an existing data collector.
 update Update an existing data collector's properties.
 import Import a data collector set from an XML file.
 export Export a data collector set to an XML file.

Adverbs:
 counter Create a counter data collector.
 trace Create a trace data collector.
 alert Create an alert data collector.
 cfg Create a configuration data collector.
 providers Show registered providers.

Options (counter):
 -c <path [path [...]]> Performance counters to collect.
 -cf <filename> File listing performance counters to collect,
 one per line.
 -f <bin|bincirc|csv|tsv|sql> Specifies the log format for the data
 collector. For SQL database format, you must
 use the -o option in the command line with
 the DNS!log option. The defaults is binary.
 -sc <value> Maximum number of samples to collect with a
 performance counter data collector.
 -si <[[hh:]mm:]ss> Sample interval for performance counter data
 collectors.

Options (trace):
 -f <bin|bincirc|csv|tsv|sql> Specifies the log format for the data
 collector. For SQL database format, you must
 use the -o option in the command line with
 the DNS!log option. The defaults is binary.
 -mode <trace_mode> Event Trace Session logger mode. For more
 information visit -
 https://go.microsoft.com/fwlink/?LinkID=136464
 -ct <perf|system|cycle> Specifies the clock resolution to use when
 logging the time stamp for each event. You
 can use query performance counter, system
 time, or CPU cycle.
 -ln <logger_name> Logger name for Event Trace Sessions.
 -ft <[[hh:]mm:]ss> Event Trace Session flush timer.
 -[-]p <provider [flags [level]]> A single Event Trace provider to enable.
 The terms 'Flags' and 'Keywords' are
 synonymous in this context.
 -pf <filename> File listing multiple Event Trace providers
 to enable.
 -[-]rt Run the Event Trace Session in real-time mode.
 -[-]ul Run the Event Trace Session in user mode.
 -bs <value> Event Trace Session buffer size in kb.
 -nb <min max> Number of Event Trace Session buffers.

Options (alert):
 -[-]el Enable/Disable event log reporting.
 -th <threshold [threshold [...]]> Specify counters and their threshold
 values for and alert.
 -[-]rdcs <name> Data collector set to start when alert fires.
 -[-]tn <task> Task to run when alert fires.
 -[-]targ <argument> Task arguments.
 -si <[[hh:]mm:]ss> Sample interval for performance counter data
 collectors.

Options (cfg):
 -[-]ni Enable/Disable network interface query.
 -reg <path [path [...]]> Registry values to collect.
 -mgt <query [query [...]]> WMI objects to collect.
 -ftc <path [path [...]]> Full path to the files to collect.

Options:
 -? Displays context sensitive help.
 -s <computer> Perform the command on specified remote system.
 -config <filename> Settings file containing command options.
 [-n] <name> Name of the target object.
 -pid <pid> Process identifier.
 -xml <filename> Name of the XML file to import or export.
 -as Perform the requested operation asynchronously.
 -[-]u <user [password]> User to Run As. Entering a * for the password
 produces a prompt for the password. The
 password is not displayed when you type it at
 the password prompt.
 -m <[start] [stop]> Change to manual start or stop instead of a
 scheduled begin or end time.
 -rf <[[hh:]mm:]ss> Run the data collector for the specified
 period of time.
 -b <M/d/yyyy h:mm:ss[AM|PM]> Begin the data collector at specified time.
 -e <M/d/yyyy h:mm:ss[AM|PM]> End the data collector at specified time.
 -o <path|dsn!log> Path of the output log file or the DSN and
 log set name in a SQL database. The default
 path is '%systemdrive%\PerfLogs\Admin'.
 -[-]r Repeat the data collector daily at the
 specified begin and end times.
 -[-]a Append to an existing log file.
 -[-]ow Overwrite an existing log file.
 -[-]v <nnnnnn|mmddhhmm> Attach file versioning information to the end
 of the log name.
 -[-]rc <task> Run the command specified each time the log
 is closed.
 -[-]max <value> Maximum log file size in MB or number of
 records for SQL logs.
 -[-]cnf <[[hh:]mm:]ss> Create a new file when the specified time has
 elapsed or when the max size is exceeded.
 -y Answer yes to all questions without prompting.
 -fd Flushes all the active buffers of an existing
 Event Trace Session to disk.
 -ets Send commands to Event Trace Sessions
 directly without saving or scheduling.

Note:
 Where [-] is listed, an extra - negates the option.
 For example --u turns off the -u option.

More Information:
 Microsoft TechNet - https://go.microsoft.com/fwlink/?LinkID=136332

Examples:
 logman start perf_log
 logman update perf_log -si 10 -f csv -v mmddhhmm
 logman create counter perf_log -c "\Processor(_Total)\% Processor Time"
 logman create counter perf_log -c "\Processor(_Total)\% Processor Time" -max 10 -rf 01:00
 logman create trace trace_log -nb 16 256 -bs 64 -o c:\logfile
 logman create alert new_alert -th "\Processor(_Total)\% Processor Time>50"
 logman create cfg cfg_log -reg "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\\"
 logman create cfg cfg_log -mgt "root\cimv2:SELECT * FROM Win32_OperatingSystem"
 logman query providers
 logman query providers Microsoft-Windows-Diagnostics-Networking
 logman start process_trace -p Microsoft-Windows-Kernel-Process 0x10 win:Informational -ets
 logman start usermode_trace -p "Service Control Manager Trace" -ul -ets
 logman query usermode_trace -p "Service Control Manager Trace" -ul -ets
 logman stop usermode_trace -p "Service Control Manager Trace" -ul -ets
 logman start process_trace -p Microsoft-Windows-Kernel-Process -mode newfile -max 1 -o output%d.etl -ets
 logman start "NT Kernel Logger" -o log.etl -ets
 logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process,thread) -ets

Return Code: 1

relog

Thu, 07 Jul 2022 23:48:55 +0000

Performance Relogging Utility

relog

C:\Windows\system32\relog.exe /?

Output:


Microsoft r Relog.exe (10.0.19041.1741)

Relog creates new performance logs from data in existing performance logs by
changing the sampling rate and/or converting the file format. Supports all
performance log formats, including Windows NT 4.0 compressed logs.

Usage:
C:\Windows\system32\relog.exe <filename [filename ...]>
 [options]

Parameters:
 <filename [filename ...]> Performance file to relog.

Options:
 -? Displays context sensitive help.
 -a Append output to the existing binary file.
 -c <path [path ...]> Counters to filter from the input log.
 -cf <filename> File listing performance counters to filter
 from the input log. Default is all counters
 in the original log file.
 -f <CSV|TSV|BIN|SQL> Output file format.
 -t <value> Only write every nth record into the output
 file. Default is to write every record.
 -o Output file path or SQL database.
 -b <M/d/yyyy h:mm:ss[AM|PM]> Begin time for the first record to write into
 the output file.
 -e <M/d/yyyy h:mm:ss[AM|PM]> End time for the last record to write into
 the output file.
 -config <filename> Settings file containing command options.
 -q List performance counters in the input file.
 -y Answer yes to all questions without prompting.

Examples:
 relog logfile.csv -c "\Processor(_Total)\% Processor Time" -o logfile.blg
 relog logfile.blg -cf counters.txt -f bin
 relog logfile.blg -f csv -o logfile.csv -t 2
 relog logfile.blg -q -o counters.txt

Return Code: 0

tracerpt

Thu, 07 Jul 2022 23:48:55 +0000

Event Trace Report Tool

tracerpt

C:\Windows\system32\tracerpt.exe /?

Output:


Microsoft r TraceRpt.Exe (10.0.19041.1741)

Usage:
 C:\Windows\system32\tracerpt.exe <[-l] <value [value [...]]>|-rt <session_name [session_name [...]]>> [options]

Options:
 -? Displays context sensitive help.
 -config <filename> Settings file containing command options.
 -y Answer yes to all questions without prompting.
 -f <XML|HTML> Report format.
 -of <CSV|EVTX|XML> Dump format, the default is XML.
 -en <ANSI|Unicode> Output file encoding. Only allowed with CSV
 output format.
 -df <filename> Microsoft specific counting/reporting schema
 file.
 -import <filename [filename [...]]> Event Schema import file.
 -int <filename> Dump interpreted event structure into
 specified file.
 -rts Report raw timestamp in event trace header.
 Can only be used with -o, not -report or
 -summary.
 -tmf <filename> Trace Message Format definition file
 -tp <value> TMF file search path. Multiple paths can be
 used, separated with ';'.
 -i <value> Specifies the provider image path. The
 matching PDB will be located in the Symbol
 Server. Multiple paths can be used, separated
 with ';'.
 -pdb <value> Specifies the symbol server path. Multiple
 paths can be used, separated with ';'.
 -gmt Convert WPP payload timestamps to GMT time
 -rl <value> System Report Level from 1 to 5, the default
 value is 1.
 -summary [filename] Summary report text file. Default is
 summary.txt.
 -o [filename] Text output file. Default is dumpfile.xml.
 -report [filename] Text output report file. Default is
 workload.xml.
 -lr Less restrictive; use best effort for events
 not matching event schema.
 -export [filename] Event Schema export file. Default is
 schema.man.
 [-l] <value [value [...]]> Event Trace log file to process.
 -rt <session_name [session_name [...]]> Real-time Event Trace Session data
 source.

Examples:
 tracerpt logfile1.etl logfile2.etl -o logdump.xml -of XML
 tracerpt logfile.etl -o logdmp.xml -of XML -lr -summary logdmp.txt -report logrpt.xml
 tracerpt logfile1.etl logfile2.etl -o -report
 tracerpt logfile.etl counterfile.blg -report logrpt.xml -df schema.xml
 tracerpt -rt "NT Kernel Logger" -o logfile.csv -of CSV

Return Code: 1

typeperf

Thu, 07 Jul 2022 23:48:55 +0000

Command line performance monitor

typeperf

C:\Windows\system32\typeperf.exe /?

Output:


Microsoft r TypePerf.exe (10.0.19041.1741)

Typeperf writes performance data to the command window or to a log file. To
stop Typeperf, press CTRL+C.

Usage:
C:\Windows\system32\typeperf.exe { <counter [counter ...]>
 | -cf <filename>
 | -q [object]
 | -qx [object]
 } [options]

Parameters:
 <counter [counter ...]> Performance counters to monitor.

Options:
 -? Displays context sensitive help.
 -f <CSV|TSV|BIN|SQL> Output file format. Default is CSV.
 -cf <filename> File containing performance counters to
 monitor, one per line.
 -si <[[hh:]mm:]ss> Time between samples. Default is 1 second.
 -o <filename> Path of output file or SQL database. Default
 is STDOUT.
 -q [object] List installed counters (no instances). To
 list counters for one object, include the
 object name, such as Processor.
 -qx [object] List installed counters with instances. To
 list counters for one object, include the
 object name, such as Processor.
 -sc <samples> Number of samples to collect. Default is to
 sample until CTRL+C.
 -config <filename> Settings file containing command options.
 -s <computer_name> Server to monitor if no server is specified
 in the counter path.
 -y Answer yes to all questions without prompting.

Note:
 Counter is the full name of a performance counter in
 "\\<Computer>\<Object>(<Instance>)\<Counter>" format,
 such as "\\Server1\Processor(0)\% User Time".

Examples:
 typeperf "\Processor(_Total)\% Processor Time"
 typeperf -cf counters.txt -si 5 -sc 50 -f TSV -o domain2.tsv
 typeperf -qx PhysicalDisk -o counters.txt

Return Code: 0

gpupdate

Thu, 07 Jul 2022 23:48:49 +0000

Microsoftr Group Policy Update Utility

gpupdate

C:\Windows\system32\gpupdate.exe /?

Output:

Description: Updates multiple Group Policy settings.

Syntax: Gpupdate [/Target:{Computer | User}] [/Force] [/Wait:<value>]
 [/Logoff] [/Boot] [/Sync]

Parameters:

Value Description
/Target:{Computer | User} Specifies that only User or only Computer
 policy settings are updated. By default,
 both User and Computer policy settings are
 updated.

/Force Reapplies all policy settings. By default,
 only policy settings that have changed are
 applied.

/Wait:{value} Sets the number of seconds to wait for policy
 processing to finish. The default is 600
 seconds. The value '0' means not to wait.
 The value '-1' means to wait indefinitely.
 When the time limit is exceeded, the command
 prompt returns, but policy processing
 continues.

/Logoff Causes a logoff after the Group Policy settings
 have been updated. This is required for
 those Group Policy client-side extensions
 that do not process policy on a background
 update cycle but do process policy when a
 user logs on. Examples include user-targeted
 Software Installation and Folder Redirection.
 This option has no effect if there are no
 extensions called that require a logoff.

/Boot Causes a computer restart after the Group Policy settings
 are applied. This is required for those
 Group Policy client-side extensions that do
 not process policy on a background update cycle
 but do process policy at computer startup.
 Examples include computer-targeted Software
 Installation. This option has no effect if
 there are no extensions called that require
 a restart.

/Sync Causes the next foreground policy application to
 be done synchronously. Foreground policy
 applications occur at computer start up and user
 logon. You can specify this for the user,
 computer or both using the /Target parameter.
 The /Force and /Wait parameters will be ignored
 if specified.

Return Code: 4294967295

wecutil

Thu, 07 Jul 2022 23:48:49 +0000

Event Collector Command Line Utility

wecutil

C:\Windows\system32\wecutil.exe /?

Output:

Windows Event Collector Utility

Enables you to create and manage subscriptions to events forwarded from remote
event sources that support WS-Management protocol.

Usage:

You can use either the short (i.e. es, /f) or long (i.e. enum-subscription, /format)
version of the command and option names. Commands, options and option values are
case-insensitive.

(ALL UPPER-CASE = VARIABLE)

wecutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]

Commands:

es (enum-subscription) List existent subscriptions.
gs (get-subscription) Get subscription configuration.
gr (get-subscriptionruntimestatus) Get subscription runtime status.
ss (set-subscription) Set subscription configuration.
cs (create-subscription) Create new subscription.
ds (delete-subscription) Delete subscription.
rs (retry-subscription) Retry subscription.
qc (quick-config) Configure Windows Event Collector service.

Common options:

/h|? (help)
Get general help for the wecutil program.

wecutil { -help | -h | -? }

For arguments and options, see usage of specific commands:

wecutil COMMAND -?

Return Code: 0

defrag

Thu, 07 Jul 2022 23:48:48 +0000

Disk Defragmenter Module

defrag

C:\Windows\system32\Defrag.exe /?

Output:


Defrag <Volumes> <Operations> [<Options>]

Volumes:
 /C | /AllVolumes On each volume run only the preferred operations from
 the given list of operations.
 /E | /VolumesExcept <volume paths>
 Perform all the given operations on each volume except.
 those specified. If the exception list is empty, this
 behaves as /AllVolumes.
 volume paths Specifies the drive letter followed by a colon, mount point
 or volume name. More than one volume can be specified. Run
 all the given operations on each specified volume..

Operations:
 /A | /Analyze Perform analysis.
 /B | /BootOptimize Perform boot optimization to increase boot performance.
 /D | /Defrag Perform traditional defrag (this is the default). On a tiered
 volume, traditional defrag is performed only on the Capacity
 tier.
 /G | /TierOptimize On tiered volumes, optimize files to reside on the appropriate
 storage tier.
 /K | /SlabConsolidate On thinly provisioned volumes, perform slab consolidation to
 increase slab usage efficiency.
 /L | /Retrim On thinly provisioned volumes, perform retrim to release free
 slabs. On SSDs perform retrim to improve write performance.
 /O | /Optimize Perform the proper optimization for each media type.
 /T | /TrackProgress Track progress of a running operation for a given volume. An
 instance can show progress only for a single volume. To see
 progress for another volume launch another instance.
 /U | /PrintProgress Print the progress of the operation on the screen.
 /V | /Verbose Print verbose output containing the fragmentation statistics.
 /X | /FreespaceConsolidate
 Perform free space consolidation, moves free space towards
 the end of the volume (even on thin provisioned volumes). On
 tiered volumes consolidation is performed only on the Capacity
 tier.

Options:
 /H | /NormalPriority Run the operation at normal priority (default is low).
 /I | /MaxRuntime n Available only with TierOptimize. Tier optimization would
 run for at most n seconds on each volume.
 /LayoutFile <file path>
 Available only with BootOptimize. This file contains the list
 of files to be optimized. The default location is
 %windir%\Prefetch\layout.ini.
 /M | /MultiThread [n] Run the operation on each volume in parallel in the background.
 For TierOptimize, at most n threads optimize the storage tiers
 in parallel. Default value of n is 8. All other optimizations
 ignore n.
 /OnlyPreferred When volumes are specified explicitly, defrag performs all
 the given operations on each specified volume. This switch
 lets defrag run only the preferred operations, from the
 given list of operations, on each specified volume.

Examples:
 Defrag C: /U /V
 Defrag C: D: /TierOptimize /MultiThread
 Defrag C:\mountpoint /Analysis /U
 Defrag /C /H /V

Return Code: 0

auditpol

Thu, 07 Jul 2022 23:48:47 +0000

Audit Policy Program

auditpol

C:\Windows\system32\auditpol.exe /?

Output:

Usage: AuditPol command [<sub-command><options>]


Commands (only one command permitted per execution)
 /? Help (context-sensitive)
 /get Displays the current audit policy.
 /set Sets the audit policy.
 /list Displays selectable policy elements.
 /backup Saves the audit policy to a file.
 /restore Restores the audit policy from a file.
 /clear Clears the audit policy.
 /remove Removes the per-user audit policy for a user account.
 /resourceSACL Configure global resource SACLs


Use AuditPol <command> /? for details on each command

Return Code: 0

auditpol get

C:\Windows\system32\auditpol.exe /get /?

Output:

Usage: AuditPol /get [/user[:<username>|<{sid}>]]
 [/category:*|<name>|<{guid}>[,:<name>|<{guid}>...]]
 [/subcategory:<name>|<{guid}>[,:<name>|<{guid}>...]]
 [/option:<option name>]
 [/sd]
 [/r]


This command displays the current audit policy.


Commands
 /? Help (context-sensitive)
 /user The security principal for whom the per-user audit
 policy is queried. Either the /category or /subcategory
 option must be specified. The user may be specified as
 a SID or name. If no user account is specified, then
 the system audit policy is queried.
 /category One or more audit categories specified by GUID or name.
 An asterisk ("*") may be used to indicate that all audit
 categories should be queried.
 /subcategory One or more audit subcategories specified by GUID or
 name.
 /sd Retrieves the security descriptor used to delegate
 access to the audit policy.
 /option Retrieve existing policy for CrashOnAuditFail,
 FullPrivilegeAuditing, AuditBaseObjects or
 AuditBaseDirectories.
 /r Display the output in report (CSV) format.


Sample usage:
 auditpol /get /user:domain\user /Category:"Detailed Tracking","Object Access"
 auditpol /get /Subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /r
 auditpol /get /option:CrashOnAuditFail
 auditpol /get /user:{S-1-5-21-397123417-1234567} /Category:"System"
 auditpol /get /sd

Return Code: 0

auditpol set

C:\Windows\system32\auditpol.exe /set /?

Output:

Usage: AuditPol /set
 [/user[:<username>|<{sid}>][/include][/exclude]]
 [/category:<name>|<{guid}>[,:<name>|<{guid}>...]]
 [/success:<enable>|<disable>][/failure:<enable>|<disable>]
 [/subcategory:<name>|<{guid}>[,:<name>|<{guid}>...]]
 [/success:<enable>|<disable>][/failure:<enable>|<disable>]
 [/option:<option name> /value:<enable>|<disable>]


This command sets the current audit policy.


Commands
 /? Help (context-sensitive)
 /user The security principal for whom per-user audit policy
 specified by the category/subcategory is set. Either
 the category or subcategory option must be specified,
 as a SID or name.
 /include Specified with /user; indicates that user's per-user
 policy will cause audit to be generated even if not
 specified by the system audit policy. This setting is
 the default and is automatically applied if neither
 the /include nor /exclude options are explicitly
 specified.
 /exclude Specified with /user; indicates that the user's per-user
 policy will cause audit to be suppressed regardless of
 the system audit policy. This setting is not honored for
 users who are members of the Administrators local group.
 /category One or more audit categories specified by GUID or name.
 If no user is specified, the system policy is set.
 /subcategory One or more audit subcategories specified by GUID or
 name. If no user is specified, system policy is set.
 /success Specifies success auditing. This setting is the default
 and is automatically applied if neither the /success nor
 /failure options are explicitly specified. This setting
 must be used with a parameter indicating whether to
 enable or disable the setting.
 /failure Specifies failure auditing. This setting must be used with
 a parameter indicating whether to enable or disable the
 setting.
 /option Set the audit policy for CrashOnAuditFail,
 FullPrivilegeAuditing, AuditBaseObjects or
 AuditBaseDirectories.
 /sd Sets the security descriptor used to delegate access
 to the audit policy. The security descriptor must be
 specified using SDDL. The security descriptor must have a
 DACL.


Example:
 auditpol /set /user:domain\user /Category:"System" /success:enable /include
 auditpol /set /subcategory:{0cce9212-69ae-11d9-bed3-505054503030} /failure:disable
 auditpol /set /option:CrashOnAuditFail /value:enable
 auditpol /set /sd:D:(A;;DCSWRPDTRC;;;BA)(A;;DCSWRPDTRC;;;SY)
The command was successfully executed.

Return Code: 0

auditpol list

C:\Windows\system32\auditpol.exe /list /?

Output:

Usage: AuditPol /list
 [/user|/category|/subcategory[:<categoryname>|<{guid}>|*]
 [/v] [/r]


This command lists audit policy categories, subcategories, or lists users for
whom per-user audit policy is defined.


Commands
 /? Help (context-sensitive)
 /user Retrieves all users for whom per-user audit policy
 has been defined. If used with the /v option, the
 sid of the user is also displayed.
 /category Displays the names of categories understood by the
 system. If used with the /v option, the category
 GUID is also displayed.
 /subcategory Displays the names of subcategories understood by the
 system, for subcategories in a specified category.
 The subcategory GUIDs are also displayed if the /v
 option is used.


Example:
 auditpol /list /user
 auditpol /list /category /v
 auditpol /list /subcategory:"Detailed Tracking","Object Access"

Return Code: 0

auditpol backup

C:\Windows\system32\auditpol.exe /backup /?

Output:

Usage: AuditPol /backup /file:<filename>


This command backs up system audit policy settings and per-user audit policy
settings for all users and all auditing options into a file. The backup will
be written to a CSV-formatted text file.


Options
 /? Help (context-sensitive).
 /file Specifies the name of the file to which the audit policy
 will be backed-up.


Example:
 auditpol /backup /file:c:\auditpolicy.csv
The command was successfully executed.

Return Code: 0

auditpol restore

C:\Windows\system32\auditpol.exe /restore /?

Output:

Usage: AuditPol /restore /file:<filename>


This command restores system audit policy settings, per-user audit policy
settings for all users and all auditing options from a file created with the
/backup command.


Options
 /? Help (context-sensitive).
 /file Specifies the file where the audit policy should be
 read from. The file must have been created by the
 /backup option or must be syntactically consistent
 with that file format.


Example:
 auditpol /restore /file:c:\auditpolicy.csv
The command was successfully executed.

Return Code: 0

auditpol clear

C:\Windows\system32\auditpol.exe /clear /?

Output:

Usage: AuditPol /clear [/y]
This command deletes per-user audit policy for all users, resets system
audit policy for all subcategories and sets all the auditing options to disabled.


Options
 /? Help (context-sensitive).
 /y Suppresses the prompt to confirm if all the audit policy
 should be cleared.


Example:
 auditpol /clear
 auditpol /clear /y
The command was successfully executed.

Return Code: 0

auditpol remove

C:\Windows\system32\auditpol.exe /remove /?

Output:

Usage: AuditPol /remove [/user[:<username>|<{sid}>]]
 [/allusers]


This command removes per-user audit policy for a specified account.


Options
 /? Help (context-sensitive).
 /user Specifies the SID or user name for the user for whom
 per-user audit policy is to be deleted
 /allusers Deletes per-user audit policy for all users.


Example:
 auditpol /remove /user:{S-1-5-21-397123417-1234567}
 auditpol /remove /allusers
The command was successfully executed.

Return Code: 0

auditpol resourceSACL

C:\Windows\system32\auditpol.exe /resourceSACL /?

Output:

Usage: AuditPol /resourceSACL
 [/set /type:<resource> [/success] [/failure] /user:<user>
 [/access:<access flags>] [/condition:<expression>]]
 [/remove /type:<resource> /user:<user> [/type:<resource>]]
 [/clear [/type:<resource>]]
 [/view [/user:<user>] [/type:<resource>]]


This command configures settings for global object access auditing. The
corresponding object access subcategory needs to be enabled for the events
to be generated by the system. Type auditpol /set /? for more information.


Commands
 /? Displays Help for the command.
 /set Adds a new entry to or updates an existing entry in the
 resource system access control list for the resource type
 specified.
 /remove Removes all entries for the given user from the global
 object access auditing list specified by the resource
 type.
 /clear Removes all entries from the global object access auditing
 list for the specified resource type.
 /view Lists the global object access auditing entries for the
 specified resource type and user. Specifying a user is
 optional.


Arguments


/type The resource for which object access auditing is being
 configured. The supported argument values are File and
 Key. Note that these values are case sensitive.
 File: Directories and files.
 Key: Registry keys.
/success Specifies success auditing.
/failure Specifies failure auditing.
/user Specifies a user in one of the following forms:
 - DomainName\Account (such as DOM\Administrators)
 - StandaloneServer\Group
 - Account (see LookupAccountName API)
 - {S-1-x-x-x-x}. x is expressed in decimal, and the entire
 SID must be enclosed in curly braces.
 For example: {S-1-5-21-5624481-130208933-164394174-1001}
 Warning: If SID form is used, no check is done to verify
 the existence of this account.
/access Specifies a permission mask that can be specified in one
 of two forms:
 - A sequence of simple rights:
 Generic access rights:
 GA - GENERIC ALL
 GR - GENERIC READ
 GW - GENERIC WRITE
 GX - GENERIC EXECUTE
 Access rights for files:
 FA - FILE ALL ACCESS
 FR - FILE GENERIC READ
 FW - FILE GENERIC WRITE
 FX - FILE GENERIC EXECUTE
 Access rights for registry keys:
 KA - KEY ALL ACCESS
 KR - KEY READ
 KW - KEY WRITE
 KX - KEY EXECUTE
 For example: '/access:FRFW' will enable audit events
 for read and write operations.
 - A hex value representing the access mask (such as
 0x1200a9).
 This is useful when using resource-specific bit masks
 that are not part of the SDDL standard. If omitted,
 Full access is used.
/condition Appends an attribute based expression like the following:
 Document sensitivity is HBI ("High")
 "(@Resource.Sensitivity == \"High\")"



Examples:


 auditpol /resourceSACL /set /type:Key /user:MYDOMAIN\myuser /success
 auditpol /resourceSACL /set /type:File /user:MYDOMAIN\myuser /success
 /failure /access:FRFW
 auditpol /resourceSACL /set /type:File /user:everyone /success
 /failure /access:FRFW /condition:"(@Resource.Sensitivity == \"High\")"
 auditpol /resourceSACL /type:File /clear
 auditpol /resourceSACL /remove /type:File
 /user:{S-1-5-21-56248481-1302087933-1644394174-1001}
 auditpol /resourceSACL /type:File /view
 auditpol /resourceSACL /type:File /view /user:MYDOMAIN\myuser
The command was successfully executed.

Return Code: 0

chcp

Thu, 07 Jul 2022 23:48:47 +0000

Change CodePage Utility

chcp

C:\Windows\system32\chcp.com /?

Output:

Displays or sets the active code page number.

CHCP [nnn]

 nnn Specifies a code page number.

Type CHCP without a parameter to display the active code page number.

Return Code: 0

example


c:\example>chcp
Active code page: 437

c:\example>chcp 65001
Active code page: 65001

c:\example>chcp 932
Active code page: 932

code page

Click here for a list of code pages.

Identifier	.NET Name	Additional information
437	IBM437	OEM United States
932	shift_jis	ANSI/OEM Japanese; Japanese (Shift-JIS)
1252	windows-1252	ANSI Latin 1; Western European (Windows)
10001	x-mac-japanese	Japanese (Mac)
20290	IBM290	IBM EBCDIC Japanese Katakana Extended
20932	EUC-JP	Japanese (JIS 0208-1990 and 0212-1990)
50220	iso-2022-jp	ISO 2022 Japanese with no halfwidth Katakana; Japanese (JIS)
50221	csISO2022JP	ISO 2022 Japanese with halfwidth Katakana; Japanese (JIS-Allow 1 byte Kana)
50222	iso-2022-jp	ISO 2022 Japanese JIS X 0201-1989; Japanese (JIS-Allow 1 byte Kana - SO/SI)
50930		EBCDIC Japanese (Katakana) Extended
50931		EBCDIC US-Canada and Japanese
50939		EBCDIC Japanese (Latin) Extended and Japanese
51932	euc-jp	EUC Japanese
65001	utf-8	Unicode (UTF-8)

cleanmgr

Thu, 07 Jul 2022 23:48:47 +0000

Disk Space Cleanup Manager for Windows

Cleanmgr

C:\Windows\system32\Cleanmgr.exe /?

Output:

---------------------------
USAGE
---------------------------
cleanmgr [/SAGESET:n | /SAGERUN:n | TUNEUP:n | /LOWDISK | /VERYLOWDISK | /SETUP | /AUTOCLEAN]
---------------------------
OK
---------------------------

Return Code: 1

curl

Thu, 07 Jul 2022 23:48:47 +0000

The curl executable

curl

C:\Windows\system32\curl.exe –version

Output:

curl 7.83.1 (Windows) libcurl/7.83.1 Schannel
Release-Date: 2022-05-13
Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp
Features: AsynchDNS HSTS IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI UnixSockets

Return Code: 0

curl

C:\Windows\system32\curl.exe –help all

Output:

Usage: curl [options...] <url>
 --abstract-unix-socket <path> Connect via abstract Unix domain socket
 --alt-svc <file name> Enable alt-svc with this cache file
 --anyauth Pick any authentication method
 -a, --append Append to target file when uploading
 --aws-sigv4 <provider1[:provider2[:region[:service]]]> Use AWS V4 signature authentication
 --basic Use HTTP Basic Authentication
 --cacert <file> CA certificate to verify peer against
 --capath <dir> CA directory to verify peer against
 -E, --cert <certificate[:password]> Client certificate file and password
 --cert-status Verify the status of the server cert via OCSP-staple
 --cert-type <type> Certificate type (DER/PEM/ENG/P12)
 --ciphers <list of ciphers> SSL ciphers to use
 --compressed Request compressed response
 --compressed-ssh Enable SSH compression
 -K, --config <file> Read config from a file
 --connect-timeout <fractional seconds> Maximum time allowed for connection
 --connect-to <HOST1:PORT1:HOST2:PORT2> Connect to host
 -C, --continue-at <offset> Resumed transfer offset
 -b, --cookie <data|filename> Send cookies from string/file
 -c, --cookie-jar <filename> Write cookies to <filename> after operation
 --create-dirs Create necessary local directory hierarchy
 --create-file-mode <mode> File mode for created files
 --crlf Convert LF to CRLF in upload
 --crlfile <file> Use this CRL list
 --curves <algorithm list> (EC) TLS key exchange algorithm(s) to request
 -d, --data <data> HTTP POST data
 --data-ascii <data> HTTP POST ASCII data
 --data-binary <data> HTTP POST binary data
 --data-raw <data> HTTP POST data, '@' allowed
 --data-urlencode <data> HTTP POST data URL encoded
 --delegation <LEVEL> GSS-API delegation permission
 --digest Use HTTP Digest Authentication
 -q, --disable Disable .curlrc
 --disable-eprt Inhibit using EPRT or LPRT
 --disable-epsv Inhibit using EPSV
 --disallow-username-in-url Disallow username in URL
 --dns-interface <interface> Interface to use for DNS requests
 --dns-ipv4-addr <address> IPv4 address to use for DNS requests
 --dns-ipv6-addr <address> IPv6 address to use for DNS requests
 --dns-servers <addresses> DNS server addrs to use
 --doh-cert-status Verify the status of the DoH server cert via OCSP-staple
 --doh-insecure Allow insecure DoH server connections
 --doh-url <URL> Resolve host names over DoH
 -D, --dump-header <filename> Write the received headers to <filename>
 --egd-file <file> EGD socket path for random data
 --engine <name> Crypto engine to use
 --etag-compare <file> Pass an ETag from a file as a custom header
 --etag-save <file> Parse ETag from a request and save it to a file
 --expect100-timeout <seconds> How long to wait for 100-continue
 -f, --fail Fail fast with no output on HTTP errors
 --fail-early Fail on first transfer error, do not continue
 --fail-with-body Fail on HTTP errors but save the body
 --false-start Enable TLS False Start
 -F, --form <name=content> Specify multipart MIME data
 --form-escape Escape multipart form field/file names using backslash
 --form-string <name=string> Specify multipart MIME data
 --ftp-account <data> Account data string
 --ftp-alternative-to-user <command> String to replace USER [name]
 --ftp-create-dirs Create the remote dirs if not present
 --ftp-method <method> Control CWD usage
 --ftp-pasv Use PASV/EPSV instead of PORT
 -P, --ftp-port <address> Use PORT instead of PASV
 --ftp-pret Send PRET before PASV
 --ftp-skip-pasv-ip Skip the IP address for PASV
 --ftp-ssl-ccc Send CCC after authenticating
 --ftp-ssl-ccc-mode <active/passive> Set CCC mode
 --ftp-ssl-control Require SSL/TLS for FTP login, clear for transfer
 -G, --get Put the post data in the URL and use GET
 -g, --globoff Disable URL sequences and ranges using {} and []
 --happy-eyeballs-timeout-ms <milliseconds> Time for IPv6 before trying IPv4
 --haproxy-protocol Send HAProxy PROXY protocol v1 header
 -I, --head Show document info only
 -H, --header <header/@file> Pass custom header(s) to server
 -h, --help <category> Get help for commands
 --hostpubmd5 <md5> Acceptable MD5 hash of the host public key
 --hostpubsha256 <sha256> Acceptable SHA256 hash of the host public key
 --hsts <file name> Enable HSTS with this cache file
 --http0.9 Allow HTTP 0.9 responses
 -0, --http1.0 Use HTTP 1.0
 --http1.1 Use HTTP 1.1
 --http2 Use HTTP 2
 --http2-prior-knowledge Use HTTP 2 without HTTP/1.1 Upgrade
 --http3 Use HTTP v3
 --ignore-content-length Ignore the size of the remote resource
 -i, --include Include protocol response headers in the output
 -k, --insecure Allow insecure server connections
 --interface <name> Use network INTERFACE (or address)
 -4, --ipv4 Resolve names to IPv4 addresses
 -6, --ipv6 Resolve names to IPv6 addresses
 --json <data> HTTP POST JSON
 -j, --junk-session-cookies Ignore session cookies read from file
 --keepalive-time <seconds> Interval time for keepalive probes
 --key <key> Private key file name
 --key-type <type> Private key file type (DER/PEM/ENG)
 --krb <level> Enable Kerberos with security <level>
 --libcurl <file> Dump libcurl equivalent code of this command line
 --limit-rate <speed> Limit transfer speed to RATE
 -l, --list-only List only mode
 --local-port <num/range> Force use of RANGE for local port numbers
 -L, --location Follow redirects
 --location-trusted Like --location, and send auth to other hosts
 --login-options <options> Server login options
 --mail-auth <address> Originator address of the original email
 --mail-from <address> Mail from this address
 --mail-rcpt <address> Mail to this address
 --mail-rcpt-allowfails Allow RCPT TO command to fail for some recipients
 -M, --manual Display the full manual
 --max-filesize <bytes> Maximum file size to download
 --max-redirs <num> Maximum number of redirects allowed
 -m, --max-time <fractional seconds> Maximum time allowed for transfer
 --metalink Process given URLs as metalink XML file
 --negotiate Use HTTP Negotiate (SPNEGO) authentication
 -n, --netrc Must read .netrc for user name and password
 --netrc-file <filename> Specify FILE for netrc
 --netrc-optional Use either .netrc or URL
 -:, --next Make next URL use its separate set of options
 --no-alpn Disable the ALPN TLS extension
 -N, --no-buffer Disable buffering of the output stream
 --no-clobber Do not overwrite files that already exist
 --no-keepalive Disable TCP keepalive on the connection
 --no-npn Disable the NPN TLS extension
 --no-progress-meter Do not show the progress meter
 --no-sessionid Disable SSL session-ID reusing
 --noproxy <no-proxy-list> List of hosts which do not use proxy
 --ntlm Use HTTP NTLM authentication
 --ntlm-wb Use HTTP NTLM authentication with winbind
 --oauth2-bearer <token> OAuth 2 Bearer Token
 -o, --output <file> Write to file instead of stdout
 --output-dir <dir> Directory to save files in
 -Z, --parallel Perform transfers in parallel
 --parallel-immediate Do not wait for multiplexing (with --parallel)
 --parallel-max <num> Maximum concurrency for parallel transfers
 --pass <phrase> Pass phrase for the private key
 --path-as-is Do not squash .. sequences in URL path
 --pinnedpubkey <hashes> FILE/HASHES Public key to verify peer against
 --post301 Do not switch to GET after following a 301
 --post302 Do not switch to GET after following a 302
 --post303 Do not switch to GET after following a 303
 --preproxy [protocol://]host[:port] Use this proxy first
 -#, --progress-bar Display transfer progress as a bar
 --proto <protocols> Enable/disable PROTOCOLS
 --proto-default <protocol> Use PROTOCOL for any URL missing a scheme
 --proto-redir <protocols> Enable/disable PROTOCOLS on redirect
 -x, --proxy [protocol://]host[:port] Use this proxy
 --proxy-anyauth Pick any proxy authentication method
 --proxy-basic Use Basic authentication on the proxy
 --proxy-cacert <file> CA certificate to verify peer against for proxy
 --proxy-capath <dir> CA directory to verify peer against for proxy
 --proxy-cert <cert[:passwd]> Set client certificate for proxy
 --proxy-cert-type <type> Client certificate type for HTTPS proxy
 --proxy-ciphers <list> SSL ciphers to use for proxy
 --proxy-crlfile <file> Set a CRL list for proxy
 --proxy-digest Use Digest authentication on the proxy
 --proxy-header <header/@file> Pass custom header(s) to proxy
 --proxy-insecure Do HTTPS proxy connections without verifying the proxy
 --proxy-key <key> Private key for HTTPS proxy
 --proxy-key-type <type> Private key file type for proxy
 --proxy-negotiate Use HTTP Negotiate (SPNEGO) authentication on the proxy
 --proxy-ntlm Use NTLM authentication on the proxy
 --proxy-pass <phrase> Pass phrase for the private key for HTTPS proxy
 --proxy-pinnedpubkey <hashes> FILE/HASHES public key to verify proxy with
 --proxy-service-name <name> SPNEGO proxy service name
 --proxy-ssl-allow-beast Allow security flaw for interop for HTTPS proxy
 --proxy-ssl-auto-client-cert Use auto client certificate for proxy (Schannel)
 --proxy-tls13-ciphers <ciphersuite list> TLS 1.3 proxy cipher suites
 --proxy-tlsauthtype <type> TLS authentication type for HTTPS proxy
 --proxy-tlspassword <string> TLS password for HTTPS proxy
 --proxy-tlsuser <name> TLS username for HTTPS proxy
 --proxy-tlsv1 Use TLSv1 for HTTPS proxy
 -U, --proxy-user <user:password> Proxy user and password
 --proxy1.0 <host[:port]> Use HTTP/1.0 proxy on given port
 -p, --proxytunnel Operate through an HTTP proxy tunnel (using CONNECT)
 --pubkey <key> SSH Public key file name
 -Q, --quote <command> Send command(s) to server before transfer
 --random-file <file> File for reading random data from
 -r, --range <range> Retrieve only the bytes within RANGE
 --raw Do HTTP "raw"; no transfer decoding
 -e, --referer <URL> Referrer URL
 -J, --remote-header-name Use the header-provided filename
 -O, --remote-name Write output to a file named as the remote file
 --remote-name-all Use the remote file name for all URLs
 -R, --remote-time Set the remote file's time on the local output
 --remove-on-error Remove output file on errors
 -X, --request <method> Specify request method to use
 --request-target <path> Specify the target for this request
 --resolve <[+]host:port:addr[,addr]...> Resolve the host+port to this address
 --retry <num> Retry request if transient problems occur
 --retry-all-errors Retry all errors (use with --retry)
 --retry-connrefused Retry on connection refused (use with --retry)
 --retry-delay <seconds> Wait time between retries
 --retry-max-time <seconds> Retry only within this period
 --sasl-authzid <identity> Identity for SASL PLAIN authentication
 --sasl-ir Enable initial response in SASL authentication
 --service-name <name> SPNEGO service name
 -S, --show-error Show error even when -s is used
 -s, --silent Silent mode
 --socks4 <host[:port]> SOCKS4 proxy on given host + port
 --socks4a <host[:port]> SOCKS4a proxy on given host + port
 --socks5 <host[:port]> SOCKS5 proxy on given host + port
 --socks5-basic Enable username/password auth for SOCKS5 proxies
 --socks5-gssapi Enable GSS-API auth for SOCKS5 proxies
 --socks5-gssapi-nec Compatibility with NEC SOCKS5 server
 --socks5-gssapi-service <name> SOCKS5 proxy service name for GSS-API
 --socks5-hostname <host[:port]> SOCKS5 proxy, pass host name to proxy
 -Y, --speed-limit <speed> Stop transfers slower than this
 -y, --speed-time <seconds> Trigger 'speed-limit' abort after this time
 --ssl Try SSL/TLS
 --ssl-allow-beast Allow security flaw to improve interop
 --ssl-auto-client-cert Use auto client certificate (Schannel)
 --ssl-no-revoke Disable cert revocation checks (Schannel)
 --ssl-reqd Require SSL/TLS
 --ssl-revoke-best-effort Ignore missing/offline cert CRL dist points
 -2, --sslv2 Use SSLv2
 -3, --sslv3 Use SSLv3
 --stderr <file> Where to redirect stderr
 --styled-output Enable styled output for HTTP headers
 --suppress-connect-headers Suppress proxy CONNECT response headers
 --tcp-fastopen Use TCP Fast Open
 --tcp-nodelay Use the TCP_NODELAY option
 -t, --telnet-option <opt=val> Set telnet option
 --tftp-blksize <value> Set TFTP BLKSIZE option
 --tftp-no-options Do not send any TFTP options
 -z, --time-cond <time> Transfer based on a time condition
 --tls-max <VERSION> Set maximum allowed TLS version
 --tls13-ciphers <ciphersuite list> TLS 1.3 cipher suites to use
 --tlsauthtype <type> TLS authentication type
 --tlspassword <string> TLS password
 --tlsuser <name> TLS user name
 -1, --tlsv1 Use TLSv1.0 or greater
 --tlsv1.0 Use TLSv1.0 or greater
 --tlsv1.1 Use TLSv1.1 or greater
 --tlsv1.2 Use TLSv1.2 or greater
 --tlsv1.3 Use TLSv1.3 or greater
 --tr-encoding Request compressed transfer encoding
 --trace <file> Write a debug trace to FILE
 --trace-ascii <file> Like --trace, but without hex output
 --trace-time Add time stamps to trace/verbose output
 --unix-socket <path> Connect through this Unix domain socket
 -T, --upload-file <file> Transfer local FILE to destination
 --url <url> URL to work with
 -B, --use-ascii Use ASCII/text transfer
 -u, --user <user:password> Server user and password
 -A, --user-agent <name> Send User-Agent <name> to server
 -v, --verbose Make the operation more talkative
 -V, --version Show version number and quit
 -w, --write-out <format> Use output FORMAT after completion
 --xattr Store metadata in extended file attributes

Return Code: 0

doskey

Thu, 07 Jul 2022 23:48:47 +0000

Keyboard History Utility

doskey

C:\Windows\system32\doskey.exe /?

Output:

Edits command lines, recalls Windows commands, and creates macros.

DOSKEY [/REINSTALL] [/LISTSIZE=size] [/MACROS[:ALL | :exename]]
 [/HISTORY] [/INSERT | /OVERSTRIKE] [/EXENAME=exename] [/MACROFILE=filename]
 [macroname=[text]]

 /REINSTALL Installs a new copy of Doskey.
 /LISTSIZE=size Sets size of command history buffer.
 /MACROS Displays all Doskey macros.
 /MACROS:ALL Displays all Doskey macros for all executables which have
 Doskey macros.
 /MACROS:exename Displays all Doskey macros for the given executable.
 /HISTORY Displays all commands stored in memory.
 /INSERT Specifies that new text you type is inserted in old text.
 /OVERSTRIKE Specifies that new text overwrites old text.
 /EXENAME=exename Specifies the executable.
 /MACROFILE=filename Specifies a file of macros to install.
 macroname Specifies a name for a macro you create.
 text Specifies commands you want to record.

UP and DOWN ARROWS recall commands; ESC clears command line; F7 displays
command history; ALT+F7 clears command history; F8 searches command
history; F9 selects a command by number; ALT+F10 clears macro definitions.

The following are some special codes in Doskey macro definitions:
$T Command separator. Allows multiple commands in a macro.
$1-$9 Batch parameters. Equivalent to %1-%9 in batch programs.
$* Symbol replaced by everything following macro name on command line.

Return Code: 0

find

Thu, 07 Jul 2022 23:48:47 +0000

Find String (grep) Utility

find

C:\Windows\system32\find.exe /?

Output:

Searches for a text string in a file or files.

FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]

 /V Displays all lines NOT containing the specified string.
 /C Displays only the count of lines containing the string.
 /N Displays line numbers with the displayed lines.
 /I Ignores the case of characters when searching for the string.
 /OFF[LINE] Do not skip files with offline attribute set.
 "string" Specifies the text string to find.
 [drive:][path]filename
 Specifies a file or files to search.

If a path is not specified, FIND searches the text typed at the prompt
or piped from another command.

Return Code: 0

mode

Thu, 07 Jul 2022 23:48:47 +0000

DOS Device MODE Utility

mode

C:\Windows\system32\mode.com /?

Output:

Configures system devices.

Serial port: MODE COMm[:] [BAUD=b] [PARITY=p] [DATA=d] [STOP=s]
 [to=on|off] [xon=on|off] [odsr=on|off]
 [octs=on|off] [dtr=on|off|hs]
 [rts=on|off|hs|tg] [idsr=on|off]

Device Status: MODE [device] [/STATUS]

Redirect printing: MODE LPTn[:]=COMm[:]

Select code page: MODE CON[:] CP SELECT=yyy

Code page status: MODE CON[:] CP [/STATUS]

Display mode: MODE CON[:] [COLS=c] [LINES=n]

Typematic rate: MODE CON[:] [RATE=r DELAY=d]

Return Code: 0

net1

Thu, 07 Jul 2022 23:48:47 +0000

Net Command

net1

C:\Windows\system32\net1.exe /?

STDERR:

The syntax of this command is:

NET
 [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
 HELPMSG | LOCALGROUP | PAUSE | SESSION | SHARE | START |
 STATISTICS | STOP | TIME | USE | USER | VIEW ]

Return Code: 1

print

Thu, 07 Jul 2022 23:48:47 +0000

Print Utility

print

C:\Windows\system32\print.exe /?

Output:

Prints a text file.

PRINT [/D:device] [[drive:][path]filename[...]]

 /D:device Specifies a print device.

Return Code: 0

replace

Thu, 07 Jul 2022 23:48:47 +0000

Replace File Utility

replace

C:\Windows\system32\replace.exe /?

Output:

Replaces files.

REPLACE [drive1:][path1]filename [drive2:][path2] [/A] [/P] [/R] [/W]
REPLACE [drive1:][path1]filename [drive2:][path2] [/P] [/R] [/S] [/W] [/U]

 [drive1:][path1]filename Specifies the source file or files.
 [drive2:][path2] Specifies the directory where files are to be
 replaced.
 /A Adds new files to destination directory. Cannot
 use with /S or /U switches.
 /P Prompts for confirmation before replacing a file or
 adding a source file.
 /R Replaces read-only files as well as unprotected
 files.
 /S Replaces files in all subdirectories of the
 destination directory. Cannot use with the /A
 switch.
 /W Waits for you to insert a disk before beginning.
 /U Replaces (updates) only files that are older than
 source files. Cannot use with the /A switch.

Return Code: 0

subst

Thu, 07 Jul 2022 23:48:47 +0000

Subst Utility

subst

C:\Windows\system32\subst.exe /?

Output:

Associates a path with a drive letter.

SUBST [drive1: [drive2:]path]
SUBST drive1: /D

 drive1: Specifies a virtual drive to which you want to assign a path.
 [drive2:]path Specifies a physical drive and path you want to assign to
 a virtual drive.
 /D Deletes a substituted (virtual) drive.

Type SUBST with no parameters to display a list of current virtual drives.

Return Code: 0

tar

Thu, 07 Jul 2022 23:48:47 +0000

bsdtar archive tool

tar

C:\Windows\system32\tar.exe –help

Output:

tar.exe(bsdtar): manipulate archive files
First option must be a mode specifier:
 -c Create -r Add/Replace -t List -u Update -x Extract
Common Options:
 -b # Use # 512-byte records per I/O block
 -f <filename> Location of archive (default \\.\tape0)
 -v Verbose
 -w Interactive
Create: tar.exe -c [options] [<file> | <dir> | @<archive> | -C <dir> ]
 <file>, <dir> add these items to archive
 -z, -j, -J, --lzma Compress archive with gzip/bzip2/xz/lzma
 --format {ustar|pax|cpio|shar} Select archive format
 --exclude <pattern> Skip files that match pattern
 -C <dir> Change to <dir> before processing remaining files
 @<archive> Add entries from <archive> to output
List: tar.exe -t [options] [<patterns>]
 <patterns> If specified, list only entries that match
Extract: tar.exe -x [options] [<patterns>]
 <patterns> If specified, extract only entries that match
 -k Keep (don't overwrite) existing files
 -m Don't restore modification times
 -O Write entries to stdout, don't restore to disk
 -p Restore permissions (including ACLs, owner, file flags)
bsdtar 3.5.2 - libarchive 3.5.2 zlib/1.2.5.f-ipp

Return Code: 0

tree

Thu, 07 Jul 2022 23:48:47 +0000

Tree Walk Utility

tree

C:\Windows\system32\tree.com /?

Output:

Graphically displays the folder structure of a drive or path.

TREE [drive:][path] [/F] [/A]

 /F Display the names of the files in each folder.
 /A Use ASCII instead of extended characters.

Return Code: 0

cidiag

Thu, 07 Jul 2022 23:48:46 +0000

CodeIntegrity Diagnostic Tool

cidiag

C:\Windows\system32\CIDiag.exe /?

Output:

Usage: "CIDiag.exe /start", "CIDiag.exe /stop <outputpath>", or "CIDiag.exe /stop /nologs <outputpath>"

Return Code: 1

mbr2gpt

Thu, 07 Jul 2022 23:48:20 +0000

mbr2gpt

C:\Windows\system32\MBR2GPT.EXE /?

Output:


Converts a disk from MBR to GPT partitioning without modifying or deleting data on the disk.

MBR2GPT.exe /validate|convert [/disk:<diskNumber>] [/logs:<logDirectory>] [/map:<source>=<destination>] [/allowFullOS]

Where:

 /validate
 - Validates that the selected disk can be converted
 without performing the actual conversion.

 /convert
 - Validates that the selected disk can be converted
 and performs the actual conversion.

 /disk:<diskNumber>
 - Specifies the disk number of the disk to be processed.
 If not specified, the system disk is processed.

 /logs:<logDirectory>
 - Specifies the directory for logging. By default logs
 are created in the %windir% directory.

 /map:<source>=<destination>
 - Specifies the GPT partition type to be used for a
 given MBR partition type not recognized by Windows.
 Multiple /map switches are allowed.

 /allowFullOS
 - Allows the tool to be used from the full Windows
 environment. By default, this tool can only be used
 from the Windows Preinstallation Environment.

Return Code: 0

schtasks

Thu, 07 Jul 2022 23:48:17 +0000

Task Scheduler Configuration Tool

schtasks

C:\Windows\system32\schtasks.exe /?

Output:


SCHTASKS /parameter [arguments]

Description:
 Enables an administrator to create, delete, query, change, run and
 end scheduled tasks on a local or remote system.

Parameter List:
 /Create Creates a new scheduled task.

 /Delete Deletes the scheduled task(s).

 /Query Displays all scheduled tasks.

 /Change Changes the properties of scheduled task.

 /Run Runs the scheduled task on demand.

 /End Stops the currently running scheduled task.

 /ShowSid Shows the security identifier corresponding to a scheduled task name.

 /? Displays this help message.

Examples:
 SCHTASKS
 SCHTASKS /?
 SCHTASKS /Run /?
 SCHTASKS /End /?
 SCHTASKS /Create /?
 SCHTASKS /Delete /?
 SCHTASKS /Query /?
 SCHTASKS /Change /?
 SCHTASKS /ShowSid /?

Return Code: 0

cscript

Thu, 07 Jul 2022 23:48:16 +0000

Microsoft r Console Based Script Host

cscript

C:\Windows\system32\cscript.exe /?

Output:

Microsoft (R) Windows Script Host Version 5.812
Copyright (C) Microsoft Corporation. All rights reserved.

Usage: CScript scriptname.extension [option...] [arguments...]

Options:
 //B Batch mode: Suppresses script errors and prompts from displaying
 //D Enable Active Debugging
 //E:engine Use engine for executing script
 //H:CScript Changes the default script host to CScript.exe
 //H:WScript Changes the default script host to WScript.exe (default)
 //I Interactive mode (default, opposite of //B)
 //Job:xxxx Execute a WSF job
 //Logo Display logo (default)
 //Nologo Prevent logo display: No banner will be shown at execution time
 //S Save current command line options for this user
 //T:nn Time out in seconds: Maximum time a script is permitted to run
 //X Execute script in debugger
 //U Use Unicode for redirected I/O from the console

Return Code: 0

rasautou

Thu, 07 Jul 2022 23:48:16 +0000

Remote Access Dialer

rasautou

C:\Windows\system32\rasautou.exe -?

Output:

Usage: rasautou [-f phonebook] [-a address] [-e entry] [-s]

Return Code: 1

rasdial

Thu, 07 Jul 2022 23:48:16 +0000

Remote Access Command Line Dial UI

rasdial

C:\Windows\system32\rasdial.exe /?

Output:

USAGE:
 C:\Windows\system32\rasdial.exe entryname [username [password|*]] [/DOMAIN:domain]
 [/PHONE:phonenumber] [/CALLBACK:callbacknumber]
 [/PHONEBOOK:phonebookfile] [/PREFIXSUFFIX]

 C:\Windows\system32\rasdial.exe [entryname] /DISCONNECT

 C:\Windows\system32\rasdial.exe

 Please refer to our privacy statement at
 'https://go.microsoft.com/fwlink/?LinkId=521839'

Return Code: 0

wscript

Thu, 07 Jul 2022 23:48:16 +0000

Microsoft r Windows Based Script Host

wscript

C:\Windows\system32\wscript.exe /?

Output:

---------------------------
Windows Script Host
---------------------------
Usage: WScript scriptname.extension [option...] [arguments...]

Options:
 //B Batch mode: Suppresses script errors and prompts from displaying
 //D Enable Active Debugging
 //E:engine Use engine for executing script
 //H:CScript Changes the default script host to CScript.exe
 //H:WScript Changes the default script host to WScript.exe (default)
 //I Interactive mode (default, opposite of //B)
 //Job:xxxx Execute a WSF job
 //Logo Display logo (default)
 //Nologo Prevent logo display: No banner will be shown at execution time
 //S Save current command line options for this user
 //T:nn Time out in seconds: Maximum time a script is permitted to run
 //X Execute script in debugger
---------------------------
OK
---------------------------

Return Code: 1

pnpunattend

Thu, 07 Jul 2022 23:48:14 +0000

PnP unattend action

pnpunattend

C:\Windows\system32\PnPUnattend.exe /?

Output:

DESCRIPTION:
AuditSystem, Unattend online driver install

USAGE:
 PnPUnattend.exe [auditSystem | /help /? /h] [/s] [/L]
 auditSystem Online driver install.
 /help /? /h This help.
 /s Search without installing.
 /L Print Logging information to the command line.

Return Code: 87

pnputil

Thu, 07 Jul 2022 23:48:14 +0000

Microsoft PnP Utility - Tool to add, delete, export, and enumerate driver packages.

pnputil

C:\Windows\system32\pnputil.exe /?

Output:

Microsoft PnP Utility

PNPUTIL [/add-driver <...> | /delete-driver <...> |
 /export-driver <...> | /enum-drivers |
 /enum-devices [<...>] | /enum-interfaces [<...>] |
 /disable-device <...> | /enable-device <...> |
 /restart-device <...> | /remove-device <...> |
 /scan-devices [<...>] | /?]

Commands:

 /add-driver <filename.inf | *.inf> [/subdirs] [/install] [/reboot]

 Add driver package(s) into the driver store.
 /subdirs - traverse sub directories for driver packages.
 /install - install/update drivers on any matching devices.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Add driver package:
 pnputil /add-driver x:\driver.inf
 Add multiple driver packages:
 pnputil /add-driver c:\oem\*.inf
 Add and install driver package:
 pnputil /add-driver device.inf /install

 /delete-driver <oem#.inf> [/uninstall] [/force] [/reboot]

 Delete driver package from the driver store.
 /uninstall - uninstall driver package from any devices using it.
 /force - delete driver package even when it is in use by devices.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Delete driver package:
 pnputil /delete-driver oem0.inf
 Force delete driver package:
 pnputil /delete-driver oem1.inf /force

 /export-driver <oem#.inf | *> <target directory>

 Export driver package(s) from the driver store into a target directory.

 Examples:
 Export driver package:
 pnputil /export-driver oem6.inf .
 Export all driver packages:
 pnputil /export-driver * c:\backup

 /enum-drivers

 Enumerate all 3rd party driver packages in the driver store.

 Examples:
 Enumerate all OEM driver packages:
 pnputil /enum-drivers

 /disable-device <instance ID> [/reboot]

 Disable devices on the system.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Disable device:
 pnputil /disable-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

 /enable-device <instance ID> [/reboot]

 Enable devices on the system.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Enable device:
 pnputil /enable-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

 /restart-device <instance ID> [/reboot]

 Restart devices on the system.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Restart device:
 pnputil /restart-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

 /remove-device <instance ID> [/subtree] [/reboot]

 Attempt to remove a device from the system.
 /subtree - remove entire device subtree, including any child devices.
 /reboot - reboot system if needed to complete the operation.

 Examples:
 Remove device:
 pnputil /remove-device "USB\VID_045E&PID_00DB\6&870CE29&0&1"

 /scan-devices [/instanceid <instance ID>] [/async]

 Scan the system for any device hardware changes.
 /instanceid <instance ID> - scan device subtree for changes.
 /async - scan for changes asynchronously.

 Examples:
 Scan devices:
 pnputil /scan-devices

 /enum-devices [/connected | /disconnected] [/instanceid <instance ID>]
 [/class <name | GUID>] [/problem [<code>]] [/ids] [/relations]
 [/drivers]

 Enumerate all devices on the system.
 /connected | /disconnected - filter by connected devices or
 filter by disconnected devices.
 /instanceid <instance ID> - filter by device instance ID.
 /class <name | GUID> - filter by device class name or GUID.
 /problem [<code>] - filter by devices with problems or
 filter by specific problem code.
 /ids - display hardware IDs and compatible IDs.
 /relations - display parent and child device relations.
 /drivers - display matching and installed drivers.

 Examples:
 Enumerate only connected devices on the system:
 pnputil /enum-devices /connected
 Enumerate device with specific instance ID:
 pnputil /enum-devices /instanceid "ACPI\PNP0A08\1"
 Enumerate all devices with specific class:
 pnputil /enum-devices /class Display
 pnputil /enum-devices /class {4d36e97d-e325-11ce-bfc1-08002be10318}
 Enumerate all devices with specific problem code:
 pnputil /enum-devices /problem 28
 pnputil /enum-devices /problem 0xA
 Enumerate all devices with problems and display hardware/compatible IDs:
 pnputil /enum-devices /problem /ids

 /enum-interfaces [/enabled | /disabled] [/class <GUID>]

 Enumerate all device interfaces on the system.
 /enabled | /disabled - filter by enabled interfaces or
 filter by disabled interfaces.
 /class <GUID> - filter by interface class GUID.

 Examples:
 Enumerate only enabled interfaces on the system:
 pnputil /enum-interfaces /enabled
 Enumerate all interfaces with specific interface class GUID:
 pnputil /enum-interfaces /class {884b96c3-56ef-11d1-bc8c-00a0c91405dd}

 /?

 Show usage screen.

Return Code: 0

djoin

Thu, 07 Jul 2022 23:48:13 +0000

Unattended Setup Generic Command For Domain Join

djoin

C:\Windows\system32\djoin.exe /?

Output:

Usage: djoin.exe [/OPTIONS]

 /PROVISION - Provision a computer account in the domain
 /DOMAIN <Name> - <Name> of the domain to join
 /MACHINE <Name> - Host <Name> of the computer joining the domain
 /MACHINEOU <OU> - Optional <OU> where the account is created
 /DCNAME <DC> - Optional <DC> to target for account creation
 /REUSE - Reuse any existing account (password will be reset)
 /SAVEFILE <FilePath> - Save provisioning data to a file at <FilePath>
 /NOSEARCH - Skip account conflict detection, requires DCNAME (faster)
 /DOWNLEVEL - Support using a Windows Server 2008 DC or earlier
 /PRINTBLOB - Return base64 encoded metadata blob for an answer file
 /DEFPWD - Use default machine account password (not recommended)
 /ROOTCACERTS - Opt. include root Certificate Authority certificates.
 /CERTTEMPLATE <Name> - Optional <Name> of machine certificate template.
 Includes root Certificate Authority certificates.
 /POLICYNAMES <Name(s)> - Opt. semicolon-separated list of policy names.
 Each name is the displayName of the GPO in AD.
 /POLICYPATHS <Path(s)> - Opt. semicolon-separated list of policy paths.
 Each path is a path to a registry policy file.
 /NETBIOS <Name> - Opt. Netbios <Name> of the computer joining the domain.
 /PSITE <Name> - Opt. <Name> of persistent site to put the computer joining
 the domain in.
 /DSITE <Name> - Opt. <Name> of dynamic site to initially put the computer
 joining the domain in.
 /PRIMARYDNS <Name> - Opt. <Name> of primary DNS domain of the computer
 joining the domain.

 /REQUESTODJ - Request offline domain join at next boot
 /LOADFILE <FilePath> - <FilePath> specified previously via /SAVEFILE
 /WINDOWSPATH <Path> - <Path> to the Windows directory in an offline image
 /LOCALOS - Allows /WINDOWSPATH to specify the locally running OS.
 This command must be run as a local Administrator.
 This option requires a reboot for changes to be applied.

Examples:

To provision a computer account in the domain:
djoin.exe /PROVISION /DOMAIN <DomainName> /MACHINE <MachineName>
 /SAVEFILE <FilePath>
 Note: Other parameters are optional

To request the local machine to perform an offline domain join:
djoin.exe /REQUESTODJ /LOADFILE <FilePath> /WINDOWSPATH <Path>
 Note: Other parameters are optional

Return Code: 0

reagentc

Thu, 07 Jul 2022 23:48:10 +0000

Microsoft Windows Recovery Agent

reagentc

C:\Windows\system32\ReAgentc.exe /?

Output:


Configures the Windows Recovery Environment (Windows RE) and system reset.

REAGENTC.EXE <command> <arguments>

The following commands can be specified:

 /info - Displays Windows RE and system reset configuration
 information.
 /setreimage - Sets the location of the custom Windows RE image.
 /enable - Enables Windows RE.
 /disable - Disables Windows RE.
 /boottore - Configures the system to start Windows RE next time the
 system starts up.
 /setbootshelllink - Adds an entry to the Reset and Restore page in the boot
 menu.

For more information about these commands and their arguments, type
REAGENTC.EXE <command> /?.

 Examples:
 REAGENTC.EXE /setreimage /?
 REAGENTC.EXE /disable /?

REAGENTC.EXE: Operation Successful.

Return Code: 0

dism

Thu, 07 Jul 2022 23:48:08 +0000

Dism Image Servicing Utility

dism

C:\Windows\system32\Dism.exe /?

Output:


Deployment Image Servicing and Management tool
Version: 10.0.19041.844


DISM.exe [dism_options] {Imaging_command} [<Imaging_arguments>]
DISM.exe {/Image:<path_to_offline_image> | /Online} [dism_options]
 {servicing_command} [<servicing_arguments>]

DESCRIPTION:

 DISM enumerates, installs, uninstalls, configures, and updates features
 and packages in Windows images. The commands that are available depend
 on the image being serviced and whether the image is offline or running.


GENERIC IMAGING COMMANDS:

 /Split-Image - Splits an existing .wim file into multiple
 read-only split WIM (SWM) files.
 /Apply-Image - Applies an image.
 /Get-MountedImageInfo - Displays information about mounted WIM and VHD
 images.
 /Get-ImageInfo - Displays information about images in a WIM, a VHD
 or a FFU file.
 /Commit-Image - Saves changes to a mounted WIM or VHD image.
 /Unmount-Image - Unmounts a mounted WIM or VHD image.
 /Mount-Image - Mounts an image from a WIM or VHD file.
 /Remount-Image - Recovers an orphaned image mount directory.
 /Cleanup-Mountpoints - Deletes resources associated with corrupted
 mounted images.

WIM COMMANDS:

 /Apply-CustomDataImage - Dehydrates files contained in the custom data image.
 /Capture-CustomImage - Captures customizations into a delta WIM file on a
 WIMBoot system. Captured directories include all
 subfolders and data.
 /Get-WIMBootEntry - Displays WIMBoot configuration entries for the
 specified disk volume.
 /Update-WIMBootEntry - Updates WIMBoot configuration entry for the
 specified disk volume.
 /List-Image - Displays a list of the files and folders in a
 specified image.
 /Delete-Image - Deletes the specified volume image from a WIM file
 that has multiple volume images.
 /Export-Image - Exports a copy of the specified image to another
 file.
 /Append-Image - Adds another image to a WIM file.
 /Capture-Image - Captures an image of a drive into a new WIM file.
 Captured directories include all subfolders and
 data.
 /Get-MountedWimInfo - Displays information about mounted WIM images.
 /Get-WimInfo - Displays information about images in a WIM file.
 /Commit-Wim - Saves changes to a mounted WIM image.
 /Unmount-Wim - Unmounts a mounted WIM image.
 /Mount-Wim - Mounts an image from a WIM file.
 /Remount-Wim - Recovers an orphaned WIM mount directory.
 /Cleanup-Wim - Deletes resources associated with mounted WIM
 images that are corrupted.

FFU COMMANDS:

 /Capture-Ffu - Captures a physical disk image into a new FFU file.
 /Apply-Ffu - Applies an .ffu image.
 /Split-Ffu - Splits an existing .ffu file into multiple read-only
 split FFU files.
 /Optimize-Ffu - Optimizes a FFU file so that it can be applied to storage
 of a different size.

IMAGE SPECIFICATIONS:

 /Online - Targets the running operating system.
 /Image - Specifies the path to the root directory of an
 offline Windows image.

DISM OPTIONS:

 /English - Displays command line output in English.
 /Format - Specifies the report output format.
 /WinDir - Specifies the path to the Windows directory.
 /SysDriveDir - Specifies the path to the system-loader file named
 BootMgr.
 /LogPath - Specifies the logfile path.
 /LogLevel - Specifies the output level shown in the log (1-4).
 /NoRestart - Suppresses automatic reboots and reboot prompts.
 /Quiet - Suppresses all output except for error messages.
 /ScratchDir - Specifies the path to a scratch directory.

For more information about these DISM options and their arguments, specify an
option immediately before /?.

 Examples:
 DISM.exe /Mount-Wim /?
 DISM.exe /ScratchDir /?
 DISM.exe /Image:C:\test\offline /?
 DISM.exe /Online /?

Return Code: 0

sxstrace

Thu, 07 Jul 2022 23:48:05 +0000

Sxs Tracing Tool

sxstrace

C:\Windows\system32\sxstrace.exe /?

Output:

WinSxs Tracing Utility.
Usage: SxsTrace [Options]
Options:
 Trace -logfile:FileName [-nostop]
 Enabling tracing for sxs.
 Tracing log is saved to FileName.
 If -nostop is specified, will not prompt to stop tracing.
 Parse -logfile:FileName -outfile:ParsedFile [-filter:AppName]
 Translate the raw trace file into a human readable format and save the result to ParsedFile.
 Use -filter option to filter the output.
 Stoptrace
 Stop the trace if it is not stopped before.
Example: SxsTrace Trace -logfile:SxsTrace.etl
 SxsTrace Parse -logfile:SxsTrace.etl -outfile:SxsTrace.txt

Return Code: 1

fltmc

Thu, 07 Jul 2022 23:48:02 +0000

Filter Manager Control Program

fltmc

C:\Windows\system32\fltMC.exe help

Output:

Valid commands:
 load Loads a Filter driver
 unload Unloads a Filter driver
 filters Lists the Filters currently registered in the system
 instances Lists the Instances for a Filter or Volume currently
 registered in the system
 volumes Lists all volumes/RDRs in the system
 attach Creates a Filter Instance to a Volume
 detach Removes a Filter Instance from a Volume

 Use fltmc help [ command ] for help on a specific command

Return Code: 0

wpr

Thu, 07 Jul 2022 23:47:59 +0000

Microsoft Windows Performance Recorder

wpr

C:\Windows\system32\wpr.exe -help

Output:


Microsoft Windows Performance Recorder Version 10.0.19041 (CoreSystem)
Copyright (c) 2019 Microsoft Corporation. All rights reserved.

 Usage: wpr options ...

 -help - Provide command line help information
 -profiles - Enumerates the profile names and descriptions from a profile file
 -purgecache - Purges the dynamic symbols cache
 -start - Starts one or more profiles
 -marker - Fires an event marker
 -markerflush - Fires an event marker and flushes the working set
 -status - Displays status on active recording (if any)
 -profiledetails - Displays the detailed information about a set of profiles
 -providers - Displays detailed information about providers
 -cancel - Cancels recording initiated via WPR (if any)
 -stop - Stops recording initiated via WPR (if any) and saves
 -flush - Flushes logging sessions initiated through WPR (if any)
 -log - Configure debug logging to the event log
 -disablepagingexecutive - Change the Disable Paging Executive settings
 -heaptracingconfig - Change heap tracing settings for a process
 -snapshotconfig - Change snapshot settings for a process
 -capturestateondemand - Capture states for the configured providers in the current recording
 -pmcsources - Query the list of hardware counters available on the system
 -setprofint - Set sampled profile interval
 -profint - Query the current profile interval
 -resetprofint - Restores the default profile interval values
 -boottrace - Configures the registry entries for autologger/globallogger sessions
 -enableperiodicsnapshot - Enable Periodic Snapshot for the specified interval and given process id
 -disableperiodicsnapshot - Disable Periodic Snapshot for all process
 -singlesnapshot - On demand Snapshot for the specified process
 -instancename - Specifies a name to uniquely identify the tracing instance.
 Useful when managing multiple concurrent wpr sessions. Must be last parameter.

Return Code: 0

convertvhd

Thu, 07 Jul 2022 23:47:51 +0000

VHD Conversion Tool

convertvhd

C:\Windows\system32\convertvhd.exe /?

Output:

VHD Conversion Tool [Version 1.00]
Copyright (C) 2017 Microsoft Corporation. All rights reserved.

STDERR:

onecore\vm\dv\storage\vhd\btt\tools\convertvhdmodule.cpp(112)\convertvhd.exe!XXXXXXXXXXXXXXXX: (caller: XXXXXXXXXXXXXXXX) Exception(1) tid(XXXX) 80070057 The parameter is incorrect.
 Msg:[

USAGE:
convertvhd.exe -source <filepath> -destination <filepath> [-btt] [-toPMem]
convertvhd.exe -sourceToken <file handle> -destinationToken <file handle> [-btt] [-toPMem]

]
onecore\vm\common\vml\VmModules.h(1492)\convertvhd.exe!XXXXXXXXXXXXXXXX: (caller: XXXXXXXXXXXXXXXX) LogHr(1) tid(XXXX) 80070057 The parameter is incorrect.
 Msg:[onecore\vm\dv\storage\vhd\btt\tools\convertvhdmodule.cpp(112)\convertvhd.exe!XXXXXXXXXXXXXXXX: (caller: XXXXXXXXXXXXXXXX) Exception(1) tid(XXXX) 80070057 The parameter is incorrect.
 Msg:[

USAGE:
convertvhd.exe -source <filepath> -destination <filepath> [-btt] [-toPMem]
convertvhd.exe -sourceToken <file handle> -destinationToken <file handle> [-btt] [-toPMem]

]
]

Return Code: 1

wevtutil

Thu, 07 Jul 2022 23:47:49 +0000

Eventing Command Line Utility

wevtutil

C:\Windows\system32\wevtutil.exe /?

Output:

Windows Events Command Line Utility.

Enables you to retrieve information about event logs and publishers, install
and uninstall event manifests, run queries, and export, archive, and clear logs.

Usage:

You can use either the short (for example, ep /uni) or long (for example,
enum-publishers /unicode) version of the command and option names. Commands,
options and option values are not case-sensitive.

Variables are noted in all upper-case.

wevtutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]

Commands:

el | enum-logs List log names.
gl | get-log Get log configuration information.
sl | set-log Modify configuration of a log.
ep | enum-publishers List event publishers.
gp | get-publisher Get publisher configuration information.
im | install-manifest Install event publishers and logs from manifest.
um | uninstall-manifest Uninstall event publishers and logs from manifest.
qe | query-events Query events from a log or log file.
gli | get-log-info Get log status information.
epl | export-log Export a log.
al | archive-log Archive an exported log.
cl | clear-log Clear a log.

Common options:

/{r | remote}:VALUE
If specified, run the command on a remote computer. VALUE is the remote computer
name. Options /im and /um do not support remote operations.

/{u | username}:VALUE
Specify a different user to log on to the remote computer. VALUE is a user name
in the form domain\user or user. Only applicable when option /r is specified.

/{p | password}:VALUE
Password for the specified user. If not specified, or if VALUE is "*", the user
will be prompted to enter a password. Only applicable when the /u option is
specified.

/{a | authentication}:[Default|Negotiate|Kerberos|NTLM]
Authentication type for connecting to remote computer. The default is Negotiate.

/{uni | unicode}:[true|false]
Display output in Unicode. If true, then output is in Unicode.

To learn more about a specific command, type the following:

wevtutil COMMAND /?

Return Code: 0

cmd

Thu, 07 Jul 2022 23:47:48 +0000

Windows Command Processor

cmd

C:\Windows\system32\cmd.exe /?

Output:

Starts a new instance of the Windows command interpreter

CMD [/A | /U] [/Q] [/D] [/E:ON | /E:OFF] [/F:ON | /F:OFF] [/V:ON | /V:OFF]
 [[/S] [/C | /K] string]

/C Carries out the command specified by string and then terminates
/K Carries out the command specified by string but remains
/S Modifies the treatment of string after /C or /K (see below)
/Q Turns echo off
/D Disable execution of AutoRun commands from registry (see below)
/A Causes the output of internal commands to a pipe or file to be ANSI
/U Causes the output of internal commands to a pipe or file to be
 Unicode
/T:fg Sets the foreground/background colors (see COLOR /? for more info)
/E:ON Enable command extensions (see below)
/E:OFF Disable command extensions (see below)
/F:ON Enable file and directory name completion characters (see below)
/F:OFF Disable file and directory name completion characters (see below)
/V:ON Enable delayed environment variable expansion using ! as the
 delimiter. For example, /V:ON would allow !var! to expand the
 variable var at execution time. The var syntax expands variables
 at input time, which is quite a different thing when inside of a FOR
 loop.
/V:OFF Disable delayed environment expansion.

Note that multiple commands separated by the command separator '&&'
are accepted for string if surrounded by quotes. Also, for compatibility
reasons, /X is the same as /E:ON, /Y is the same as /E:OFF and /R is the
same as /C. Any other switches are ignored.

If /C or /K is specified, then the remainder of the command line after
the switch is processed as a command line, where the following logic is
used to process quote (") characters:

 1. If all of the following conditions are met, then quote characters
 on the command line are preserved:

 - no /S switch
 - exactly two quote characters
 - no special characters between the two quote characters,
 where special is one of: &<>()@^|
 - there are one or more whitespace characters between the
 two quote characters
 - the string between the two quote characters is the name
 of an executable file.

 2. Otherwise, old behavior is to see if the first character is
 a quote character and if so, strip the leading character and
 remove the last quote character on the command line, preserving
 any text after the last quote character.

If /D was NOT specified on the command line, then when CMD.EXE starts, it
looks for the following REG_SZ/REG_EXPAND_SZ registry variables, and if
either or both are present, they are executed first.

 HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun

 and/or

 HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun

Command Extensions are enabled by default. You may also disable
extensions for a particular invocation by using the /E:OFF switch. You
can enable or disable extensions for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:

 HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions

 and/or

 HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions

to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.

In a batch file, the SETLOCAL ENABLEEXTENSIONS or DISABLEEXTENSIONS arguments
takes precedence over the /E:ON or /E:OFF switch. See SETLOCAL /? for details.

The command extensions involve changes and/or additions to the following
commands:

 DEL or ERASE
 COLOR
 CD or CHDIR
 MD or MKDIR
 PROMPT
 PUSHD
 POPD
 SET
 SETLOCAL
 ENDLOCAL
 IF
 FOR
 CALL
 SHIFT
 GOTO
 START (also includes changes to external command invocation)
 ASSOC
 FTYPE

To get specific details, type commandname /? to view the specifics.

Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable delayed expansion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:

 HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion

 and/or

 HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion

to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.

In a batch file the SETLOCAL ENABLEDELAYEDEXPANSION or DISABLEDELAYEDEXPANSION
arguments takes precedence over the /V:ON or /V:OFF switch. See SETLOCAL /?
for details.

If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.

You can enable or disable file name completion for a particular
invocation of CMD.EXE with the /F:ON or /F:OFF switch. You can enable
or disable completion for all invocations of CMD.EXE on a machine and/or
user logon session by setting either or both of the following REG_DWORD
values in the registry using REGEDIT.EXE:

 HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar
 HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar

 and/or

 HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
 HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar

with the hex value of a control character to use for a particular
function (e.g. 0x4 is Ctrl-D and 0x6 is Ctrl-F). The user specific
settings take precedence over the machine settings. The command line
switches take precedence over the registry settings.

If completion is enabled with the /F:ON switch, the two control
characters used are Ctrl-D for directory name completion and Ctrl-F for
file name completion. To disable a particular completion character in
the registry, use the value for space (0x20) as it is not a valid
control character.

Completion is invoked when you type either of the two control
characters. The completion function takes the path string to the left
of the cursor appends a wild card character to it if none is already
present and builds up a list of paths that match. It then displays the
first matching path. If no paths match, it just beeps and leaves the
display alone. Thereafter, repeated pressing of the same control
character will cycle through the list of matching paths. Pressing the
Shift key with the control character will move through the list
backwards. If you edit the line in any way and press the control
character again, the saved list of matching paths is discarded and a new
one generated. The same occurs if you switch between file and directory
name completion. The only difference between the two control characters
is the file completion character matches both file and directory names,
while the directory completion character only matches directory names.
If file completion is used on any of the built in directory commands
(CD, MD or RD) then directory completion is assumed.

The completion code deals correctly with file names that contain spaces
or other special characters by placing quotes around the matching path.
Also, if you back up, then invoke completion from within a line, the
text to the right of the cursor at the point completion was invoked is
discarded.

The special characters that require quotes are:
 <space>
 &()[]{}^=;!'+,`~

Return Code: 1

disksnapshot

Thu, 07 Jul 2022 23:47:48 +0000

DiskSnapshot.exe

disksnapshot

C:\Windows\system32\DiskSnapshot.exe -h

STDERR:

DiskSnapshot.exe [options]
 -c write detail data to console
 -i write detail data to console (same as -c)
 -s (deprecated) summary data to console
 -u process large volumes (no limit)
 -j [config] specifies an alternate config file
 -v [volume][path] specifies volume(+path) to process, e.g. "d:" or "d:\foo"
 -d [input-file] print encoded versions of the strings in the input file, for decoding purposes
 -e prints out escalation keywords
 -k calculate checksums for files, used to investigate duplicated on-disk content (c arg required).
 -o [output-file] write detail data to a file

Return Code: 0

tttracer

Thu, 07 Jul 2022 23:47:44 +0000

Time Travel Debugging Tracer Tool

tttracer

C:\Windows\system32\tttracer.exe -?

Output:

MICROSOFT TIME TRAVEL DEBUGGING (TTD)

Time Travel Debugging (TTD) command line utility is not meant for use in custom software or
automation. TTD is included with this version of Windows to improve diagnostics gathering and is not
intended for direct use as a stand-alone solution.

DISCLAIMER OF WARRANTY. THE SOFTWARE IS LICENSED "AS IS." YOU BEAR THE RISK OF USING IT. MICROSOFT
GIVES NO EXPRESS WARRANTIES, GUARANTEES, OR CONDITIONS. TO THE EXTENT PERMITTED UNDER APPLICABLE LAWS,
MICROSOFT EXCLUDES ALL IMPLIED WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
AND NON-INFRINGEMENT.

1. DATA COLLECTION. The software may collect information about you and your use of the software and send
 that to Microsoft. Microsoft may use this information to provide services and improve Microsoft's
 products and services. Your opt-out rights, if any, are described in the product documentation. Some
 features in the software may enable collection of data from users of your applications that access or
 use the software. If you use these features to enable data collection in your applications, you must
 comply with applicable law, including getting any required user consent, and maintain a prominent
 privacy policy that accurately informs users about how you use, collect, and share their data. You can
 learn more about Microsoft's data collection and use in the product documentation and the Microsoft
 Privacy Statement at https://go.microsoft.com/fwlink/?LinkId=521839. You agree to comply with all
 applicable provisions of the Microsoft Privacy Statement.

2. SCOPE OF LICENSE. The software is licensed, not sold. Microsoft reserves all other rights. Unless
 applicable law gives you more rights despite this limitation, you will not (and have no right to):
 a) work around any technical limitations in the software that only allow you to use it in certain ways;
 b) reverse engineer, decompile or disassemble the software;
 c) remove, minimize, block, or modify any notices of Microsoft or its suppliers in the software;
 d) use the software for commercial, non-profit, or revenue-generating activities;
 e) use the software in any way that is against the law or to create or propagate malware; or
 f) share, publish, distribute, or lend the software, provide the software as a stand-alone hosted
 solution for others to use, or transfer the software or this agreement to any third party.

3. SUPPORT SERVICES. Microsoft is not obligated under this agreement to provide any support services
 for the software. Any support provided is "as is", "with all faults", and without warranty of any kind.

Return Code: 2147500033

tpmtool

Thu, 07 Jul 2022 23:47:18 +0000

tpmtool

C:\Windows\system32\TpmTool.exe /?

Output:

Description:
 This utility can be used to get information about the Trusted Platform Module (TPM).
 For up-to-date documentation, please go to https://aka.ms/tpmtool

Syntax:
 tpmtool [parameter] [<arguments>]

Parameters:
 GETDEVICEINFORMATION Displays the basic information of the TPM.

 GATHERLOGS [OUTPUT DIRECTORY PATH] Collects TPM logs and places them in the specified directory.
 If path is not specified, will default to current directory.

 DRIVERTRACING [START / STOP] Start / stop collecting driver traces.

 PARSETTCGLOGS [-VALIDATE] Displays the parsed TCG logs, and optionally validates all PCRs.

 /? Displays this help message.

Examples:
 tpmtool /?

 tpmtool getdeviceinformation

 tpmtool gatherlogs C:\Users\Public

 tpmtool drivertracing start

 tpmtool drivertracing stop

 tpmtool parsetcglogs

 tpmtool parsetcglogs -validate

Return Code: 0

bcdboot

Thu, 07 Jul 2022 23:47:14 +0000

Bcdboot utility

bcdboot

C:\Windows\system32\bcdboot.exe /?

Output:


Bcdboot - Bcd boot file creation and repair tool.

The bcdboot.exe command-line tool is used to copy critical boot files to the
system partition and to create a new system BCD store.

bcdboot <source> [/l <locale>] [/s <volume-letter> [/f <firmware>]] [/v]
 [/vbcd] [/m [{OS Loader ID}]] [/addlast] [/p] [/c]

 source Specifies the location of the windows system root.

 /l Specifies an optional locale parameter to use when
 initializing the BCD store. The default is US English.

 /s Specifies an optional volume letter parameter to designate
 the target system partition where boot environment files are
 copied. The default is the system partition identified by
 the firmware.

 /v Enables verbose mode.

 /vbcd Enables BCD logging.

 /m If an OS loader GUID is provided, this option merges the
 given loader object with the system template to produce a
 bootable entry. Otherwise, only global objects are merged.

 /d Specifies that the existing default windows boot entry
 should be preserved.

 /f Used with the /s command, specifies the firmware type of the
 target system partition. Options for <firmware> are 'UEFI',
 'BIOS', or 'ALL'.

 /addlast Specifies that the windows boot manager firmware entry
 should be added last. The default behavior is to add it
 first.

 /bcdclean Clean the BCD Store. By default, simply removes any duplicate
 entries in the BCD. Can be followed by 'full'. In this case,
 each entry is scanned. If the corresponding device for that entry
 does not exist, the entry is deleted.

 /p Specifies that the windows boot manager firmware entry
 position should be preserved. If entry does not exist,
 new entry will be added in the first position.

 /c Specifies that any existing objects described by the template
 should not be migrated.

Examples: bcdboot c:\windows /l en-us
 bcdboot c:\windows /s h:
 bcdboot c:\windows /s h: /f UEFI
 bcdboot c:\windows /m {d58d10c6-df53-11dc-878f-00064f4f4e08}
 bcdboot c:\windows /d /addlast
 bcdboot c:\windows /p

Return Code: 87

bdehdcfg

Sat, 07 Dec 2019 09:10:13 +0000

BitLocker Drive Encryption: Drive Preparation Tool

bdehdcfg

C:\Windows\system32\BdeHdCfg.exe /?

Output:

BitLocker Drive Preparation Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Usage:

BdeHdCfg[.exe]
 [-driveinfo]
 [-target {default | unallocated |
 TargetDriveLetter {shrink | merge}}]
 [-newdriveletter DriveLetter]
 [-size SizeInMegabytes]
 [-quiet] [-restart] [{-? | /?}]

Description:
 This command prepares your hard drive for BitLocker Drive Encryption.

 Command line parameters are not case-sensitive.

Parameters:
 -driveinfo
 Displays information about valid target drives.

 -target
 Specifies the target and operation.

 Specify 'shrink' to create a new active partition.
 Specify 'merge' to make an existing partition active.
 Specify 'unallocated' to use unformatted space on disk.
 Specify 'default' for the target to be chosen automatically.

 Examples: -target D: merge
 -target C: shrink
 -target unallocated
 -target default

 -newdriveletter
 Specifies the desired drive letter for the new drive. This option is
 only valid when a new drive is created.

 Example: -newdriveletter S:

 -size
 Specifies the desired size of the new drive. This option is only valid
 when a new drive is created.

 If not specified, the Drive Preparation Tool assumes the required
 minimum size of 550 megabytes.

 Example: -size 700

 -quiet
 Specifies operation in quiet mode. No output from the drive preparation
 tool is displayed.

 -restart
 Enables an automatic restart after drive preparation.

 You must restart your computer before enabling BitLocker.

 -? or /?
 Displays help for this command.

Examples:
 BdeHdCfg -target c: shrink -newdriveletter x: -size 550 -quiet -restart
 BdeHdCfg -target d: merge -quiet -restart
 BdeHdCfg -target unallocated -newdriveletter s:
 BdeHdCfg -target default

Return Code: 0

manage-bde

Sat, 07 Dec 2019 09:10:10 +0000

BitLocker Drive Encryption: Configuration Tool

manage-bde

C:\Windows\system32\manage-bde.exe /?

Output:

BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

manage-bde[.exe] -parameter [arguments]

Description:
 Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
 -status Provides information about BitLocker-capable volumes.
 -on Encrypts the volume and turns BitLocker protection on.
 -off Decrypts the volume and turns BitLocker protection off.
 -pause Pauses encryption, decryption, or free space wipe.
 -resume Resumes encryption, decryption, or free space wipe.
 -lock Prevents access to BitLocker-encrypted data.
 -unlock Allows access to BitLocker-encrypted data.
 -autounlock Manages automatic unlocking of data volumes.
 -protectors Manages protection methods for the encryption key.
 -SetIdentifier or -si
 Configures the identification field for a volume.
 -ForceRecovery or -fr
 Forces a BitLocker-protected OS to recover on restarts.
 -changepassword
 Modifies password for a data volume.
 -changepin Modifies PIN for a volume.
 -changekey Modifies startup key for a volume.
 -KeyPackage or -kp
 Generates a key package for a volume.
 -upgrade Upgrades the BitLocker version.
 -WipeFreeSpace or -w
 Wipes the free space on the volume.
 -ComputerName or -cn
 Runs on another computer. Examples: "ComputerX", "127.0.0.1"
 -? or /? Displays brief help. Example: "-ParameterSet -?"
 -Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
 manage-bde -status
 manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
 manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Return Code: 4294967295

repair-bde

Sat, 07 Dec 2019 09:10:10 +0000

BitLocker Drive Encryption: Repair Tool

repair-bde

C:\Windows\system32\repair-bde.exe /?

Output:

BitLocker Drive Encryption: Repair Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Usage:

repair-bde[.exe] InputVolume
 { OutputVolumeOrImage }
 { {-RecoveryPassword|-rp} NumericalPassword |
 {-RecoveryKey|-rk} PathToExternalKeyFile |
 {-Password|-pw} }
 [{-KeyPackage|-kp} PathToKeyPackage]
 [{-LogFile|-lf} PathToLogFile]
 [{-?|/?}]

Description:
 Attempts to repair or decrypt a damaged BitLocker-encrypted volume using the
 supplied recovery information. If BitLocker was in the process of encryption
 or decryption or had been suspended prior to volume failure a clear key will
 be present on the volume. Repair-bde attempts to use this clear key by
 default if another key is not specified.

 WARNING! To avoid additional data loss, you should have a spare hard drive
 available. Use this spare drive to store decrypted output or to back up the
 contents of the damaged volume.

Parameters:
 InputVolume
 The BitLocker-encrypted volume to repair.
 Example: "C:",
 "\\?\Volume{26a21bda-a627-11d7-9931-806e6f6e6963}".

 OutputVolumeOrImage
 The volume to store decrypted contents, or the file
 location to create an image file of the contents.
 Examples: "D:", "D:\imagefile.img".

 WARNING! All information on this output volume will be
 overwritten.

 -rk or -RecoveryKey
 Provide an external key to unlock the volume.
 Example: "F:\RecoveryKey.bek".

 -rp or -RecoveryPassword
 Provide a numerical password to unlock the volume.
 Example: "111111-222222-333333-...".

 -pw or -Password
 Provide a password to unlock the volume.

 -kp or -KeyPackage
 Optional. Provide a key package to unlock the volume.
 Example: "F:\ExportedKeyPackage"

 If this option is blank, the tool will look for the key package
 automatically. This option is needed only if required by the tool.

 -lf or -LogFile
 Optional. Provide a path to a file that will store progress
 information. Example: "F:\log.txt".

 -f or -Force
 Optional. When used, forces a volume to be dismounted even if
 it cannot be locked. This option is needed only if required by
 the tool.

 -? or /?
 Shows this screen.

Examples:
 repair-bde C: D: -rk F:\RecoveryKey.bek -Force
 repair-bde C: D: -rp 111111-222222-[...] -lf F:\log.txt
 repair-bde C: D: -kp F:\KeyPackage -rp 111111-222222-[...]
 repair-bde C: D:\imagefile.img -kp F:\KeyPackage -rk F:\RecoveryKey.bek
 repair-bde C: D: -pw

Return Code: 1

change

Sat, 07 Dec 2019 09:09:59 +0000

Remote Desktop Services Change Utility

change logon

C:\Windows\system32\change.exe logon /?

STDERR:

Enable, disable, or drain session logins.

CHANGE LOGON {/QUERY | /ENABLE | /DISABLE | /DRAIN | /DRAINUNTILRESTART}

 /QUERY Query current session login mode.
 /ENABLE Enable user login from sessions.
 /DISABLE Disable user login from sessions.
 /DRAIN Disable new user logons, but allow reconnections to existing sessions.
 /DRAINUNTILRESTART Disable new user logons until the server is restarted, but allow reconnections to existing sessions.

Return Code: 1

change port

C:\Windows\system32\change.exe port /?

STDERR:

List or change COM port mappings for DOS application compatibility.

CHANGE PORT [portx=porty | /D portx | /QUERY]

 portx=porty Map port x to port y.
 /D portx Delete mapping for port x.
 /QUERY Display current mapping ports.

Return Code: 1

change user

C:\Windows\system32\change.exe user /?

Output:

Change Install Mode.

CHANGE USER {/EXECUTE | /INSTALL | /QUERY}

 /EXECUTE Enable execute mode (default).
 /INSTALL Enable install mode.
 /QUERY Display current settings.

Return Code: 1

chglogon

Sat, 07 Dec 2019 09:09:59 +0000

Change Logon Utility

chglogon

C:\Windows\system32\chglogon.exe /?

STDERR:

Enable, disable, or drain session logins.

CHANGE LOGON {/QUERY | /ENABLE | /DISABLE | /DRAIN | /DRAINUNTILRESTART}

 /QUERY Query current session login mode.
 /ENABLE Enable user login from sessions.
 /DISABLE Disable user login from sessions.
 /DRAIN Disable new user logons, but allow reconnections to existing sessions.
 /DRAINUNTILRESTART Disable new user logons until the server is restarted, but allow reconnections to existing sessions.

Return Code: 0

chgport

Sat, 07 Dec 2019 09:09:59 +0000

Change port Utility

chgport

C:\Windows\system32\chgport.exe /?

STDERR:

List or change COM port mappings for DOS application compatibility.

CHANGE PORT [portx=porty | /D portx | /QUERY]

 portx=porty Map port x to port y.
 /D portx Delete mapping for port x.
 /QUERY Display current mapping ports.

Return Code: 0

chgusr

Sat, 07 Dec 2019 09:09:59 +0000

Change INI File Mapping Utility

chgusr

C:\Windows\system32\chgusr.exe /?

Output:

Change Install Mode.

CHANGE USER {/EXECUTE | /INSTALL | /QUERY}

 /EXECUTE Enable execute mode (default).
 /INSTALL Enable install mode.
 /QUERY Display current settings.

Return Code: 0

logoff

Sat, 07 Dec 2019 09:09:59 +0000

Session Logoff Utility

logoff

C:\Windows\system32\logoff.exe /?

STDERR:

Terminates a session.

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V] [/VM]

 sessionname The name of the session.
 sessionid The ID of the session.
 /SERVER:servername Specifies the Remote Desktop server containing the user
 session to log off (default is current).
 /V Displays information about the actions performed.
 /VM Logs off a session on server or within virtual machine. The unique ID of the session needs to be specified.

Return Code: 0

msg

Sat, 07 Dec 2019 09:09:59 +0000

Message Utility

msg

C:\Windows\system32\msg.exe /?

Output:

Send a message to a user.

MSG {username | sessionname | sessionid | @filename | *}
 [/SERVER:servername] [/TIME:seconds] [/V] [/W] [message]

 username Identifies the specified username.
 sessionname The name of the session.
 sessionid The ID of the session.
 @filename Identifies a file containing a list of usernames,
 sessionnames, and sessionids to send the message to.
 * Send message to all sessions on specified server.
 /SERVER:servername server to contact (default is current).
 /TIME:seconds Time delay to wait for receiver to acknowledge msg.
 /V Display information about actions being performed.
 /W Wait for response from user, useful with /V.
 message Message to send. If none specified, prompts for it
 or reads from stdin.

Return Code: 0

qappsrv

Sat, 07 Dec 2019 09:09:59 +0000

Query Remote Desktop Session Host Server Utility

qappsrv

C:\Windows\system32\qappsrv.exe /?

Output:

Displays the available Remote Desktop Session Host servers on the network.

QUERY TERMSERVER [servername] [/DOMAIN:domain] [/ADDRESS] [/CONTINUE]

 servername Identifies a Remote Desktop Session Host server.
 /DOMAIN:domain Displays information for the specified domain (defaults
 to the current domain).
 /ADDRESS Displays network and node addresses.
 /CONTINUE Does not pause after each screen of information.

Return Code: 0

qprocess

Sat, 07 Dec 2019 09:09:59 +0000

Query Process Utility

qprocess

C:\Windows\system32\qprocess.exe /?

Output:

Displays information about processes.

QUERY PROCESS [* | processid | username | sessionname | /ID:nn | programname]
 [/SERVER:servername]

 * Display all visible processes.
 processid Display process specified by processid.
 username Display all processes belonging to username.
 sessionname Display all processes running at sessionname.
 /ID:nn Display all processes running at session nn.
 programname Display all processes associated with programname.
 /SERVER:servername The Remote Desktop Session Host server to be queried.

Return Code: 0

query

Sat, 07 Dec 2019 09:09:59 +0000

MultiUser Query Utility

query

C:\Windows\system32\query.exe /?

Output:

QUERY { PROCESS | SESSION | TERMSERVER | USER }

Return Code: 0

quser

Sat, 07 Dec 2019 09:09:59 +0000

Query User Utility

quser

C:\Windows\system32\quser.exe /?

Output:

Display information about users logged on to the system.

QUERY USER [username | sessionname | sessionid] [/SERVER:servername]

 username Identifies the username.
 sessionname Identifies the session named sessionname.
 sessionid Identifies the session with ID sessionid.
 /SERVER:servername The server to be queried (default is current).

Return Code: 0

qwinsta

Sat, 07 Dec 2019 09:09:59 +0000

Query Session Utility

qwinsta

C:\Windows\system32\qwinsta.exe /?

Output:

Display information about Remote Desktop Services sessions.

QUERY SESSION [sessionname | username | sessionid]
 [/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] [/VM]

 sessionname Identifies the session named sessionname.
 username Identifies the session with user username.
 sessionid Identifies the session with ID sessionid.
 /SERVER:servername The server to be queried (default is current).
 /MODE Display current line settings.
 /FLOW Display current flow control settings.
 /CONNECT Display current connect settings.
 /COUNTER Display current Remote Desktop Services counters information.
 /VM Display information about sessions within virtual machines.

Return Code: 0

rwinsta

Sat, 07 Dec 2019 09:09:59 +0000

Reset Session Utility

rwinsta

C:\Windows\system32\rwinsta.exe /?

Output:

Reset the session subsytem hardware and software to known initial values.

RESET SESSION {sessionname | sessionid} [/SERVER:servername] [/V]

 sessionname Identifies the session with name sessionname.
 sessionid Identifies the session with ID sessionid.
 /SERVER:servername The server containing the session (default is current).
 /V Display additional information.

Return Code: 0

tscon

Sat, 07 Dec 2019 09:09:59 +0000

Session Connection Utility

tscon

C:\Windows\system32\tscon.exe /?

Output:

Attaches a user session to a remote desktop session.

TSCON {sessionid | sessionname} [/DEST:sessionname]
 [/PASSWORD:pw | /PASSWORD:*] [/V]

 sessionid The ID of the session.
 sessionname The name of the session.
 /DEST:sessionname Connect the session to destination sessionname.
 /PASSWORD:pw Password of user owning identified session.
 /V Displays information about the actions performed.

Return Code: 0

tsdiscon

Sat, 07 Dec 2019 09:09:59 +0000

Session Disconnection Utility

tsdiscon

C:\Windows\system32\tsdiscon.exe /?

Output:

Disconnects a Remote Desktop Services session.

TSDISCON [sessionid | sessionname] [/SERVER:servername] [/V] [/VM]

 sessionid The ID of the session.
 sessionname The name of the session.
 /SERVER:servername Specifies the Remote Desktop Session Host server (default is current).
 /V Displays information about the actions performed.
 /VM Disconnects session on server or within virtual machine. The unique ID of the session needs to be specified.

Return Code: 0

tskill

Sat, 07 Dec 2019 09:09:59 +0000

Remote Desktop Services End Process Utility

tskill

C:\Windows\system32\tskill.exe /?

STDERR:

Ends a process.

TSKILL processid | processname [/SERVER:servername] [/ID:sessionid | /A] [/V]

 processid Process ID for the process to be terminated.
 processname Process name to be terminated.
 /SERVER:servername Server containing processID (default is current).
 /ID or /A must be specified when using processname
 and /SERVER
 /ID:sessionid End process running under the specified session.
 /A End process running under ALL sessions.
 /V Display information about actions being performed.

Return Code: 0

reset

Sat, 07 Dec 2019 09:09:57 +0000

Remote Desktop Services Reset Utility

reset

C:\Windows\system32\reset.exe /?

Output:

RESET { SESSION }

Return Code: 0

packageinspector

Sat, 07 Dec 2019 09:09:55 +0000

PackageInspector allows creation of a catalog containing all executable files laid down by an installer

packageinspector

C:\Windows\system32\PackageInspector.exe /?

Output:

Usage:
PackageInspector.exe <command> <DriveLetter or Path> [options]
PackageInspector.exe start <DriveLetter>: [-path <pathToInstaller>]
PackageInspector.exe stop <DriveLetter>: -out cdf|cat|list [-cdfPath <outputCdfPath>] [-name <nameOfCat>] [-resdir <directoryForCat>] [-ph true | false] [-en <encoding type>] [-ca1 <CATATTR1>] [-ca2 <CATATTR2>] [-listPath <pathToOutputList.txt>]
PackageInspector.exe scan <PathToScan> -out cdf|cat|list [-cdfPath <outputCdfPath>] [-name <nameOfCat>] [-resdir <directoryForCat>] [-ph true | false] [-en <encoding type>] [-ca1 <CATATTR1>] [-ca2 <CATATTR2>] [-listPath <pathToOutputList.txt>]

Valid Commands :
 start -- Specifies that a user will start a scan
 stop -- Specifies that a scan is complete and one of the supported outputs it to be produced
 scan -- Specifies that PackageInspector is to directly scan the given path rather than monitor created files. Takes same options as stop

Start Options :
 path -- File path to the package being inspected

Stop/Scan Options :
 out -- Specifies what the tool should output from the scan (CAT, CDF, or List)
 cdfPath -- Specifies the full path for output of CDF including filename
 name -- Specifies the name of the catalog to produce
 resdir -- Specifies the result directory of the catalog
 ph -- Specifies whether page hashes should be included in the catalog
 en -- Specifies the encoding type of the catalog
 ca1 -- Specifies CATATTR1 in the CDF or CAT
 ca2 -- Specifies CATATTR2 in the CDF or CAT
 listPath -- Specifies location to output list of files laid down by installer (for -out list)

Return Code: 1

iotstartup

Sat, 07 Dec 2019 09:09:54 +0000

IotStartup

iotstartup

C:\Windows\system32\iotstartup.exe /?

Output:

Usage:
 IotStartup [list|add|remove|startup] ([headed|headless]) (suppress) (std::regex regular expression with implied ^ prepended)
 IotStartup [run|stop] (std::regex regular expression with implied ^ prepended)
 IotStartup [help|-?|-h|--help]

Examples:
 IotStartup list // list installed applications
 IotStartup list headed // list installed headed applications
 IotStartup list headless // list installed headless applications
 IotStartup list MyApp // list installed applications that match pattern MyApp

 IotStartup add headed MyApp // add headed application that matches pattern MyApp. Pattern must match only one application.
 IotStartup add headless Task1 // add headless applications that match pattern Task1

 IotStartup remove headless Task1 // remove headless applications that match pattern Task1
 IotStartup remove headless suppress Task1 // remove headless applications that match pattern Task1 and suppress WNF notification

 IotStartup startup // list headed and headless applications registered for startup
 IotStartup startup MyApp // list headed and headless applications registered for startup that match pattern MyApp
 IotStartup startup headed MyApp // list headed applications registered for startup that match MyApp
 IotStartup startup headless Task1 // list headless applications registered for startup that match Task1

 IotStartup run MyApp // Start app identified by MyApp (see 'iotstartup list')
 IotStartup stop MyApp // Stop app identified by MyApp (see 'iotstartup list')

Return Code: 2147942487

cacls

Sat, 07 Dec 2019 09:09:30 +0000

Control ACLs Program

cacls

C:\Windows\system32\cacls.exe /?

Output:


 NOTE: Cacls is now deprecated, please use Icacls.

 Displays or modifies access control lists (ACLs) of files

 CACLS filename [/T] [/M] [/L] [/S[:SDDL]] [/E] [/C] [/G user:perm]
 [/R user [...]] [/P user:perm [...]] [/D user [...]]
 filename Displays ACLs.
 /T Changes ACLs of specified files in
 the current directory and all subdirectories.
 /L Work on the Symbolic Link itself versus the target
 /M Changes ACLs of volumes mounted to a directory
 /S Displays the SDDL string for the DACL.
 /S:SDDL Replaces the ACLs with those specified in the SDDL string
 (not valid with /E, /G, /R, /P, or /D).
 /E Edit ACL instead of replacing it.
 /C Continue on access denied errors.
 /G user:perm Grant specified user access rights.
 Perm can be: R Read
 W Write
 C Change (write)
 F Full control
 /R user Revoke specified user's access rights (only valid with /E).
 /P user:perm Replace specified user's access rights.
 Perm can be: N None
 R Read
 W Write
 C Change (write)
 F Full control
 /D user Deny specified user access.
 Wildcards can be used to specify more than one file in a command.
 You can specify more than one user in a command.

 Abbreviations:
 CI - Container Inherit.
 The ACE will be inherited by directories.
 OI - Object Inherit.
 The ACE will be inherited by files.
 IO - Inherit Only.
 The ACE does not apply to the current file/directory.
 ID - Inherited.
 The ACE was inherited from the parent directory's ACL.

Return Code: 160

eventcreate

Sat, 07 Dec 2019 09:09:30 +0000

Event Create - Creates a custom event in an event log

eventcreate

C:\Windows\system32\eventcreate.exe /?

Output:


EVENTCREATE [/S system [/U username [/P [password]]]] /ID eventid
 [/L logname] [/SO srcname] /T type /D description

Description:
 This command line tool enables an administrator to create
 a custom event ID and message in a specified event log.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which
 the command should execute.

 /P [password] Specifies the password for the given
 user context. Prompts for input if omitted.

 /L logname Specifies the event log to create
 an event in.

 /T type Specifies the type of event to create.
 Valid types: SUCCESS, ERROR, WARNING, INFORMATION.

 /SO source Specifies the source to use for the
 event (if not specified, source will default
 to 'eventcreate'). A valid source can be any
 string and should represent the application
 or component that is generating the event.

 /ID id Specifies the event ID for the event. A
 valid custom message ID is in the range
 of 1 - 1000.

 /D description Specifies the description text for the new event.

 /? Displays this help message.


Examples:
 EVENTCREATE /T ERROR /ID 1000
 /L APPLICATION /D "My custom error event for the application log"

 EVENTCREATE /T ERROR /ID 999 /L APPLICATION
 /SO WinWord /D "Winword event 999 happened due to low diskspace"

 EVENTCREATE /S system /T ERROR /ID 100
 /L APPLICATION /D "Custom job failed to install"

 EVENTCREATE /S system /U user /P password /ID 1 /T ERROR
 /L APPLICATION /D "User access failed due to invalid user credentials"

Return Code: 0

ftp

Sat, 07 Dec 2019 09:09:30 +0000

File Transfer Program

ftp

C:\Windows\system32\ftp.exe /?

STDERR:


Transfers files to and from a computer running an FTP server service
(sometimes called a daemon). Ftp can be used interactively.

FTP [-v] [-d] [-i] [-n] [-g] [-s:filename] [-a] [-A] [-x:sendbuffer] [-r:recvbuffer] [-b:asyncbuffers] [-w:windowsize] [host]

 -v Suppresses display of remote server responses.
 -n Suppresses auto-login upon initial connection.
 -i Turns off interactive prompting during multiple file
 transfers.
 -d Enables debugging.
 -g Disables filename globbing (see GLOB command).
 -s:filename Specifies a text file containing FTP commands; the
 commands will automatically run after FTP starts.
 -a Use any local interface when binding data connection.
 -A login as anonymous.
 -x:send sockbuf Overrides the default SO_SNDBUF size of 8192.
 -r:recv sockbuf Overrides the default SO_RCVBUF size of 8192.
 -b:async count Overrides the default async count of 3
 -w:windowsize Overrides the default transfer buffer size of 65535.
 host Specifies the host name or IP address of the remote
 host to connect to.

Notes:
 - mget and mput commands take y/n/q for yes/no/quit.
 - Use Control-C to abort commands.

Return Code: 2

systeminfo

Sat, 07 Dec 2019 09:09:30 +0000

Displays system information

systeminfo

C:\Windows\system32\systeminfo.exe /?

Output:


SYSTEMINFO [/S system [/U username [/P [password]]]] [/FO format] [/NH]

Description:
 This tool displays operating system configuration information for
 a local or remote machine, including service pack levels.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which
 the command should execute.

 /P [password] Specifies the password for the given
 user context. Prompts for input if omitted.

 /FO format Specifies the format in which the output
 is to be displayed.
 Valid values: "TABLE", "LIST", "CSV".

 /NH Specifies that the "Column Header" should
 not be displayed in the output.
 Valid only for "TABLE" and "CSV" formats.

 /? Displays this help message.

Examples:
 SYSTEMINFO
 SYSTEMINFO /?
 SYSTEMINFO /S system
 SYSTEMINFO /S system /U user
 SYSTEMINFO /S system /U domain\user /P password /FO TABLE
 SYSTEMINFO /S system /FO LIST
 SYSTEMINFO /S system /FO CSV /NH

Return Code: 0

takeown

Sat, 07 Dec 2019 09:09:30 +0000

Takes ownership of a file

takeown

C:\Windows\system32\takeown.exe /?

Output:


TAKEOWN [/S system [/U username [/P [password]]]]
 /F filename [/A] [/R [/D prompt]]

Description:
 This tool allows an administrator to recover access to a file that
 was denied by re-assigning file ownership.

Parameter List:
 /S system Specifies the remote system to
 connect to.

 /U [domain\]user Specifies the user context under
 which the command should execute.

 /P [password] Specifies the password for the
 given user context.
 Prompts for input if omitted.

 /F filename Specifies the filename or directory
 name pattern. Wildcard "*" can be used
 to specify the pattern. Allows
 sharename\filename.

 /A Gives ownership to the administrators
 group instead of the current user.

 /R Recurse: instructs tool to operate on
 files in specified directory and all
 subdirectories.

 /D prompt Default answer used when the current user
 does not have the "list folder" permission
 on a directory. This occurs while operating
 recursively (/R) on sub-directories. Valid
 values "Y" to take ownership or "N" to skip.

 /SKIPSL Do not follow symbolic links.
 Only applicable with /R.

 /? Displays this help message.

 NOTE: 1) If /A is not specified, file ownership will be given to the
 current logged on user.

 2) Mixed patterns using "?" and "*" are not supported.

 3) /D is used to suppress the confirmation prompt.

Examples:
 TAKEOWN /?
 TAKEOWN /F lostfile
 TAKEOWN /F \\system\share\lostfile /A
 TAKEOWN /F directory /R /D N
 TAKEOWN /F directory /R /A
 TAKEOWN /F *
 TAKEOWN /F C:\Windows\System32\acme.exe
 TAKEOWN /F %windir%\*.txt
 TAKEOWN /S system /F MyShare\Acme*.doc
 TAKEOWN /S system /U user /F MyShare\MyBinary.dll
 TAKEOWN /S system /U domain\user /P password /F share\filename
 TAKEOWN /S system /U user /P password /F Doc\Report.doc /A
 TAKEOWN /S system /U user /P password /F Myshare\*
 TAKEOWN /S system /U user /P password /F Home\Logon /R
 TAKEOWN /S system /U user /P password /F Myshare\directory /R /A

Return Code: 0

taskkill

Sat, 07 Dec 2019 09:09:30 +0000

Terminates Processes

taskkill

C:\Windows\system32\taskkill.exe /?

Output:


TASKKILL [/S system [/U username [/P [password]]]]
 { [/FI filter] [/PID processid | /IM imagename] } [/T] [/F]

Description:
 This tool is used to terminate tasks by process id (PID) or image name.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which the
 command should execute.

 /P [password] Specifies the password for the given user
 context. Prompts for input if omitted.

 /FI filter Applies a filter to select a set of tasks.
 Allows "*" to be used. ex. imagename eq acme*

 /PID processid Specifies the PID of the process to be terminated.
 Use TaskList to get the PID.

 /IM imagename Specifies the image name of the process
 to be terminated. Wildcard '*' can be used
 to specify all tasks or image names.

 /T Terminates the specified process and any
 child processes which were started by it.

 /F Specifies to forcefully terminate the process(es).

 /? Displays this help message.

Filters:
 Filter Name Valid Operators Valid Value(s)
 ----------- --------------- -------------------------
 STATUS eq, ne RUNNING |
 NOT RESPONDING | UNKNOWN
 IMAGENAME eq, ne Image name
 PID eq, ne, gt, lt, ge, le PID value
 SESSION eq, ne, gt, lt, ge, le Session number.
 CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
 of hh:mm:ss.
 hh - hours,
 mm - minutes, ss - seconds
 MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
 USERNAME eq, ne User name in [domain\]user
 format
 MODULES eq, ne DLL name
 SERVICES eq, ne Service name
 WINDOWTITLE eq, ne Window title

 NOTE
 ----
 1) Wildcard '*' for /IM switch is accepted only when a filter is applied.
 2) Termination of remote processes will always be done forcefully (/F).
 3) "WINDOWTITLE" and "STATUS" filters are not considered when a remote
 machine is specified.

Examples:
 TASKKILL /IM notepad.exe
 TASKKILL /PID 1230 /PID 1241 /PID 1253 /T
 TASKKILL /F /IM cmd.exe /T
 TASKKILL /F /FI "PID ge 1000" /FI "WINDOWTITLE ne untitle*"
 TASKKILL /F /FI "USERNAME eq NT AUTHORITY\SYSTEM" /IM notepad.exe
 TASKKILL /S system /U domain\username /FI "USERNAME ne NT*" /IM *
 TASKKILL /S system /U username /P password /FI "IMAGENAME eq note*"

Return Code: 0

tasklist

Sat, 07 Dec 2019 09:09:30 +0000

Lists the current running tasks

tasklist

C:\Windows\system32\tasklist.exe /?

Output:


TASKLIST [/S system [/U username [/P [password]]]]
 [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
 This tool displays a list of currently running processes on
 either a local or remote machine.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which
 the command should execute.

 /P [password] Specifies the password for the given
 user context. Prompts for input if omitted.

 /M [module] Lists all tasks currently using the given
 exe/dll name. If the module name is not
 specified all loaded modules are displayed.

 /SVC Displays services hosted in each process.

 /APPS Displays Store Apps and their associated processes.

 /V Displays verbose task information.

 /FI filter Displays a set of tasks that match a
 given criteria specified by the filter.

 /FO format Specifies the output format.
 Valid values: "TABLE", "LIST", "CSV".

 /NH Specifies that the "Column Header" should
 not be displayed in the output.
 Valid only for "TABLE" and "CSV" formats.

 /? Displays this help message.

Filters:
 Filter Name Valid Operators Valid Value(s)
 ----------- --------------- --------------------------
 STATUS eq, ne RUNNING | SUSPENDED
 NOT RESPONDING | UNKNOWN
 IMAGENAME eq, ne Image name
 PID eq, ne, gt, lt, ge, le PID value
 SESSION eq, ne, gt, lt, ge, le Session number
 SESSIONNAME eq, ne Session name
 CPUTIME eq, ne, gt, lt, ge, le CPU time in the format
 of hh:mm:ss.
 hh - hours,
 mm - minutes, ss - seconds
 MEMUSAGE eq, ne, gt, lt, ge, le Memory usage in KB
 USERNAME eq, ne User name in [domain\]user
 format
 SERVICES eq, ne Service name
 WINDOWTITLE eq, ne Window title
 MODULES eq, ne DLL name

NOTE: "WINDOWTITLE" and "STATUS" filters are not supported when querying
 a remote machine.

Examples:
 TASKLIST
 TASKLIST /M
 TASKLIST /V /FO CSV
 TASKLIST /SVC /FO LIST
 TASKLIST /APPS /FI "STATUS eq RUNNING"
 TASKLIST /M wbem*
 TASKLIST /S system /FO LIST
 TASKLIST /S system /U domain\username /FO CSV /NH
 TASKLIST /S system /U username /P password /FO TABLE /NH
 TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

Return Code: 0

timeout

Sat, 07 Dec 2019 09:09:30 +0000

timeout - pauses command processing

timeout

C:\Windows\system32\timeout.exe /?

Output:


TIMEOUT [/T] timeout [/NOBREAK]

Description:
 This utility accepts a timeout parameter to wait for the specified
 time period (in seconds) or until any key is pressed. It also
 accepts a parameter to ignore the key press.

Parameter List:
 /T timeout Specifies the number of seconds to wait.
 Valid range is -1 to 99999 seconds.

 /NOBREAK Ignore key presses and wait specified time.

 /? Displays this help message.

NOTE: A timeout value of -1 means to wait indefinitely for a key press.

Examples:
 TIMEOUT /?
 TIMEOUT /T 10
 TIMEOUT /T 300 /NOBREAK
 TIMEOUT /T -1

Return Code: 0

vssadmin

Sat, 07 Dec 2019 09:09:30 +0000

Command Line Interface for Microsoftr Volume Shadow Copy Service

vssadmin

C:\Windows\system32\vssadmin.exe /?

Output:

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

---- Commands Supported ----

Delete Shadows - Delete volume shadow copies
List Providers - List registered volume shadow copy providers
List Shadows - List existing volume shadow copies
List ShadowStorage - List volume shadow copy storage associations
List Volumes - List volumes eligible for shadow copies
List Writers - List subscribed volume shadow copy writers
Resize ShadowStorage - Resize a volume shadow copy storage association

Return Code: 0

waitfor

Sat, 07 Dec 2019 09:09:30 +0000

waitfor - wait/send a signal over a network

waitfor

C:\Windows\system32\waitfor.exe /?

Output:


WaitFor has two ways of working:

Syntax 1: to send a signal
 WAITFOR [/S system [/U user [/P [password]]]] /SI signal

Syntax 2: to wait for a signal
 WAITFOR [/T timeout] signal

Description:
 This tool sends, or waits for, a signal on a system. When /S is not
 specified, the signal will be broadcasted to all the systems in a
 domain. If /S is specified, then the signal will be sent only
 to the specified system.

Parameter List:
 /S system Specifies remote system to send signal to.

 /U [domain\]user Specifies the user context under which
 the command should execute.

 /P [password] Specifies the password for the given user context.

 /SI Sends the signal across the net to waiting machines

 /T timeout Number of seconds to wait for signal. Valid range
 is 1 - 99999. Default is to wait forever for signal.

 signal The name of the signal to wait for or to send.

 /? Displays this help message.

 NOTE: A system can wait for multiple unique signal names.
 The signal name cannot exceed 225 characters and cannot
 contain characters other than a-z, A-Z, 0-9 and ASCII
 characters in the range 128-255.

Examples:
 WAITFOR /?
 WAITFOR SetupReady
 WAITFOR CopyDone /T 100
 WAITFOR /SI SetupReady
 WAITFOR /S system /U user /P password /SI CopyDone

Return Code: 0

where

Sat, 07 Dec 2019 09:09:30 +0000

Where - Lists location of files

where

C:\Windows\system32\where.exe /?

Output:


WHERE [/R dir] [/Q] [/F] [/T] pattern...

Description:
 Displays the location of files that match the search pattern.
 By default, the search is done along the current directory and
 in the paths specified by the PATH environment variable.

Parameter List:
 /R Recursively searches and displays the files that match the
 given pattern starting from the specified directory.

 /Q Returns only the exit code, without displaying the list
 of matched files. (Quiet mode)

 /F Displays the matched filename in double quotes.

 /T Displays the file size, last modified date and time for all
 matched files.

 pattern Specifies the search pattern for the files to match.
 Wildcards * and ? can be used in the pattern. The
 "$env:pattern" and "path:pattern" formats can also be
 specified, where "env" is an environment variable and
 the search is done in the specified paths of the "env"
 environment variable. These formats should not be used
 with /R. The search is also done by appending the
 extensions of the PATHEXT variable to the pattern.

 /? Displays this help message.

 NOTE: The tool returns an error level of 0 if the search is
 successful, of 1 if the search is unsuccessful and
 of 2 for failures or errors.

Examples:
 WHERE /?
 WHERE myfilename1 myfile????.*
 WHERE $windir:*.*
 WHERE /R c:\windows *.exe *.dll *.bat
 WHERE /Q ??.???
 WHERE "c:\windows;c:\windows\system32:*.dll"
 WHERE /F /T *.dll

Return Code: 0

whoami

Sat, 07 Dec 2019 09:09:30 +0000

whoami - displays logged on user information

whoami

C:\Windows\system32\whoami.exe /?

Output:


WhoAmI has three ways of working:

Syntax 1:
 WHOAMI [/UPN | /FQDN | /LOGONID]

Syntax 2:
 WHOAMI { [/USER] [/GROUPS] [/CLAIMS] [/PRIV] } [/FO format] [/NH]

Syntax 3:
 WHOAMI /ALL [/FO format] [/NH]

Description:
 This utility can be used to get user name and group information
 along with the respective security identifiers (SID), claims,
 privileges, logon identifier (logon ID) for the current user
 on the local system. I.e. who is the current logged on user?
 If no switch is specified, tool displays the user name in NTLM
 format (domain\username).

Parameter List:
 /UPN Displays the user name in User Principal
 Name (UPN) format.

 /FQDN Displays the user name in Fully Qualified
 Distinguished Name (FQDN) format.

 /USER Displays information on the current user
 along with the security identifier (SID).

 /GROUPS Displays group membership for current user,
 type of account, security identifiers (SID)
 and attributes.

 /CLAIMS Displays claims for current user,
 including claim name, flags, type and values.

 /PRIV Displays security privileges of the current
 user.

 /LOGONID Displays the logon ID of the current user.

 /ALL Displays the current user name, groups
 belonged to along with the security
 identifiers (SID), claims and privileges for
 the current user access token.

 /FO format Specifies the output format to be displayed.
 Valid values are TABLE, LIST, CSV.
 Column headings are not displayed with CSV
 format. Default format is TABLE.

 /NH Specifies that the column header should not
 be displayed in the output. This is
 valid only for TABLE and CSV formats.

 /? Displays this help message.

Examples:
 WHOAMI
 WHOAMI /UPN
 WHOAMI /FQDN
 WHOAMI /LOGONID
 WHOAMI /USER
 WHOAMI /USER /FO LIST
 WHOAMI /USER /FO CSV
 WHOAMI /GROUPS
 WHOAMI /GROUPS /FO CSV /NH
 WHOAMI /CLAIMS
 WHOAMI /CLAIMS /FO LIST
 WHOAMI /PRIV
 WHOAMI /PRIV /FO TABLE
 WHOAMI /USER /GROUPS
 WHOAMI /USER /GROUPS /CLAIMS /PRIV
 WHOAMI /ALL
 WHOAMI /ALL /FO LIST
 WHOAMI /ALL /FO CSV /NH
 WHOAMI /?

Return Code: 0

xwizard

Sat, 07 Dec 2019 09:09:30 +0000

Extensible Wizards Host Process

xwizard

C:\Windows\system32\xwizard.exe /?

Output:

---------------------------
Extensible wizard host process
---------------------------
Usage:
 xwizard ProcessXMLFile [/u] [/m] <filename>
 xwizard RunWizard [/u] [/t<?>] [/c<?>] [/f<?>] [/p<GUID>] <GUID> [/z [<?>] ]
 xwizard RunPropertySheet [/u] [/c<?>] [/f<?>] [/p<GUID>] <GUID> [/z [<?>] ]
where:
 /c = context flags
 /f = user defined flags
 /m = additionally generate Vista setup manifest file section
 (create resulting file in current directory as <filename>.man)
 /p = parent host GUID identifier ({<GUID>})
 /t = optional wizard type (wizard97, aero, dui, moderndui)
 /u = unattended (log errors instead of showing them)
 /z = user command line (should always be last, rest of line)
 filename = XML file name
 GUID = Wizard component GUID identifier ({<GUID>})
examples:
 xwizard ProcessXMLFile myconfig.xml
 xwizard ProcessXMLFile /m mysetup.xml
 xwizard RunWizard {7071ECA0-663B-4bc1-A1FA-B97F3B917C55}
 xwizard RunWizard /taero /c1 /f3 {7071ECA0-663B-4bc1-A1FA-B97F3B917C55} /z/myoption1 /myoption2
 xwizard RunPropertySheet {7071ECA0-663B-4bc1-A1FA-B97F3B917C55}
 xwizard RunPropertySheet /c1 /f3 {7071ECA0-663B-4bc1-A1FA-B97F3B917C55} /z/myoption1 /myoption2
---------------------------
OK
---------------------------

Return Code: 1

ndkping

Sat, 07 Dec 2019 09:09:29 +0000

RDMA Ping Cmd

ndkping

C:\Windows\system32\NDKPing.exe /?

Output:

NDKPing can run on a system as Server or Client.
Run as a Server:
 -S -- Specify that the system will be a Server.
 -ServerAddr <ServerIPAddress>:<ServerPort> -- Specify ip address of the server and the port on which to listen in format of ipServer:portServer.
 -ServerIf <ServerInterfaceIndex> -- Specify the interface index for the server.
 -TestType <TestType> -- Specify the type of test to run.
 -W <Timeout> -- Specify the timeout of Server Listen socket, in seconds. If this parameter is not specified, will wait infinitely.

Run as a Client:
 -C -- Specify that the system will be a Client.
 -ServerAddr <ServerIPAddress>:<ServerPort> -- Specify ip address of the server and the port on which to listen in format of ipServer:portServer.
 -ClientAddr <ClientIPAddress> -- Specify the ip address of the Client.
 -ClientIf <ClientInterfaceIndex> -- Specify the interface index for the Client.
 -LogFilename <LogFileName> -- Specify NDKPing test results log file name, relative path or full path.
 (Default: [systemdrive]\NDKPingResults.log). On client side only.
 -A -- Specify that at client side NDKPing test results should be appended to the log file if it already exists.
 -V -- Specify that at client side NDKPing test results should be printed out on screen except being stored in a log file.
 -TestType <TestType> -- Specify the type of test to run.

TestType Options: (Server and Client must be with same TestType)
 rping -- Tests RDMA connectivity with Send/Receive transfers and logs the status of each of them.

 Read/Write tests will be in future version!!!

Usage Sample:
 As a Server:
 NDKPing -S -ServerAddr 10.10.10.10:55555 -ServerIf 3 -TestType rping -W 60
 As a Client:
 NDKPing -C -ServerAddr 10.10.10.10:55555 -ClientAddr 10.10.10.11 -ClientIf 4 -TestType rping -LogFilename .\NDKPingResults.log -V

STDERR:


Error: Unable to stop NDKPing driver.
5: Access is denied.

Return Code: 5

regini

Sat, 07 Dec 2019 09:09:27 +0000

Registry Initializer

regini

C:\Windows\system32\regini.exe /?

STDERR:

usage: REGINI [-m \\machinename | -h hivefile hiveroot]
 [-i n] [-o outputWidth]
 [-b] textFiles...

where: -m specifies a remote Windows NT machine whose registry is to be manipulated.
 -h specifies a specify local hive to manipulate.
 -i n specifies the display indentation multiple. Default is 4
 -o outputWidth specifies how wide the output is to be. By default the
 outputWidth is set to the width of the console window if standard
 output has not been redirected to a file. In the latter case, an
 outputWidth of 240 is used.

 -b specifies that REGINI should be backward compatible with older
 versions of REGINI that did not strictly enforce line continuations
 and quoted strings Specifically, REG_BINARY, REG_RESOURCE_LIST and
 REG_RESOURCE_REQUIREMENTS_LIST data types did not need line
 continuations after the first number that gave the size of the data.
 It just kept looking on following lines until it found enough data
 values to equal the data length or hit invalid input. Quoted
 strings were only allowed in REG_MULTI_SZ. They could not be
 specified around key or value names, or around values for REG_SZ or
 REG_EXPAND_SZ Finally, the old REGINI did not support the semicolon
 as an end of line comment character.

 textFiles is one or more ANSI or Unicode text files with registry data.

 Some general rules are:
 Semicolon character is an end-of-line comment character, provided it
 is the first non-blank character on a line

 Backslash character is a line continuation character. All
 characters from the backslash up to but not including the first
 non-blank character of the next line are ignored. If there is more
 than one space before the line continuation character, it is
 replaced by a single space.

 Indentation is used to indicate the tree structure of registry keys
 The REGDMP program uses indentation in multiples of 4. You may use
 hard tab characters for indentation, but embedded hard tab
 characters are converted to a single space regardless of their
 position

 Values should come before child keys, as they are associated with
 the previous key at or above the value's indentation level.

 For key names, leading and trailing space characters are ignored and
 not included in the key name, unless the key name is surrounded by
 quotes. Imbedded spaces are part of a key name.

 Key names can be followed by an Access Control List (ACL) which is a
 series of decimal numbers, separated by spaces, bracketed by a
 square brackets (e.g. [8 4 17]). The valid numbers and their
 meanings are:

 1 - Administrators Full Access
 2 - Administrators Read Access
 3 - Administrators Read and Write Access
 4 - Administrators Read, Write and Delete Access
 5 - Creator Full Access
 6 - Creator Read and Write Access
 7 - World Full Access
 8 - World Read Access
 9 - World Read and Write Access
 10 - World Read, Write and Delete Access
 11 - Power Users Full Access
 12 - Power Users Read and Write Access
 13 - Power Users Read, Write and Delete Access
 14 - System Operators Full Access
 15 - System Operators Read and Write Access
 16 - System Operators Read, Write and Delete Access
 17 - System Full Access
 18 - System Read and Write Access
 19 - System Read Access
 20 - Administrators Read, Write and Execute Access
 21 - Interactive User Full Access
 22 - Interactive User Read and Write Access
 23 - Interactive User Read, Write and Delete Access

 If there is an equal sign on the same line as a left square bracket
 then the equal sign takes precedence, and the line is treated as a
 registry value. If the text between the square brackets is the
 string DELETE with no spaces, then REGINI will delete the key and
 any values and keys under it.

 For registry values, the syntax is:

 value Name = type data

 Leading spaces, spaces on either side of the equal sign and spaces
 between the type keyword and data are ignored, unless the value name
 is surrounded by quotes. If the text to the right of the equal sign
 is the string DELETE, then REGINI will delete the value.

 The value name may be left off or be specified by an at-sign
 character which is the same thing, namely the empty value name. So
 the following two lines are identical:

 = type data
 @ = type data

 This syntax means that you can't create a value with leading or
 trailing spaces, an equal sign or an at-sign in the value name,
 unless you put the name in quotes.

 Valid value types and format of data that follows are:

 REG_SZ text
 REG_EXPAND_SZ text
 REG_MULTI_SZ "string1" "str""ing2" ...
 REG_DATE mm/dd/yyyy HH:MM DayOfWeek
 REG_DWORD numberDWORD
 REG_BINARY numberOfBytes numberDWORD(s)...
 REG_NONE (same format as REG_BINARY)
 REG_RESOURCE_LIST (same format as REG_BINARY)
 REG_RESOURCE_REQUIREMENTS (same format as REG_BINARY)
 REG_RESOURCE_REQUIREMENTS_LIST (same format as REG_BINARY)
 REG_FULL_RESOURCE_DESCRIPTOR (same format as REG_BINARY)
 REG_QWORD numberQWORD
 REG_MULTISZ_FILE fileName
 REG_BINARYFILE fileName

 If no value type is specified, default is REG_SZ

 For REG_SZ and REG_EXPAND_SZ, if you want leading or trailing spaces
 in the value text, surround the text with quotes. The value text
 can contain any number of imbedded quotes, and REGINI will ignore
 them, as it only looks at the first and last character for quote
 characters.

 For REG_MULTI_SZ, each component string is surrounded by quotes. If
 you want an imbedded quote character, then double quote it, as in
 string2 above.

 For REG_BINARY, the value data consists of one or more numbers The
 default base for numbers is decimal. Hexidecimal may be specified
 by using 0x prefix. The first number is the number of data bytes,
 excluding the first number. After the first number must come enough
 numbers to fill the value. Each number represents one DWORD or 4
 bytes. So if the first number was 0x5 you would need two more
 numbers after that to fill the 5 bytes. The high order 3 bytes
 of the second DWORD would be ignored.

 Whenever specifying a registry path, either on the command line
 or in an input file, the following prefix strings can be used:

 HKEY_LOCAL_MACHINE
 HKEY_USERS
 HKEY_CURRENT_USER
 USER:

 Each of these strings can stand alone as the key name or be followed
 a backslash and a subkey path.

Return Code: 1

regsvr32

Sat, 07 Dec 2019 09:09:27 +0000

Microsoft(C) Register Server

regsvr32

C:\Windows\system32\regsvr32.exe

Output:

---------------------------
RegSvr32
---------------------------
To register a module, you must provide a binary name.

Usage: regsvr32 [/u] [/s] [/n] [/i[:cmdline]] dllname

default- Register server calling DllRegisterServer.
/u - Unregister server calling DllUnregisterServer.
/s - Silent; display no message boxes.
/i - Used without /u, calls DllInstall(TRUE, [cmdline]) to install
 the dll, after a successful call to DllRegisterServer.
 Used with /u, calls DllInstall(FALSE, [cmdline]) to uninstall
 the dll and DllUnregisterServer if DllInstall was successful.
/n - Do not call DllRegisterServer or DllUnregisterServer; this
 option must be used with /i.

dllname - The path (absolute or relative) to the DLL to call the entry points on. This DLL is required to export the entry points that will be called depending on the selected option (DllRegisterServer, DllUnregisterServer and/or DllInstall).
---------------------------
OK
---------------------------

Return Code: 1

setspn

Sat, 07 Dec 2019 09:09:27 +0000

Query or reset the computer’s SPN attribute

setspn

C:\Windows\system32\setspn.exe /?

Output:

Usage: C:\Windows\system32\setspn.exe [modifiers switch] [accountname]
 Where "accountname" can be the name or domain\name
 of the target computer or user account

 Edit Mode Switches:
 -R = reset HOST ServicePrincipalName
 Usage: setspn -R accountname
 -S = add arbitrary SPN after verifying no duplicates exist
 Usage: setspn -S SPN accountname
 -D = delete arbitrary SPN
 Usage: setspn -D SPN accountname
 -L = list SPNs registered to target account
 Usage: setspn [-L] accountname

 Edit Mode Modifiers:
 -C = specify that accountname is a computer account
 -U = specify that accountname is a user account

 Note: -C and -U are exclusive. If neither is specified, the tool
 will interpret accountname as a computer name if such a computer
 exists, and a user name if it does not.

 Query Mode Switches:
 -Q = query for existence of SPN
 Usage: setspn -Q SPN
 -X = search for duplicate SPNs
 Usage: setspn -X

 Note: searching for duplicates, especially forestwide, can take
 a long period of time and a large amount of memory. -Q will execute
 on each target domain/forest. -X will return duplicates that exist
 across all targets. SPNs are not required to be unique across forests,
 but duplicates can cause authentication issues when authenticating
 cross-forest.

 Query Mode Modifiers:
 -P = suppresses progress to the console and can be used when redirecting
 output to a file or when used in an unattended script. There will be no
 output until the command is complete.
 -F = perform queries at the forest, rather than domain level
 -T = perform query on the speicified domain or forest (when -F is also used)
 Usage: setspn -T domain (switches and other parameters)
 "" or * can be used to indicate the current domain or forest.

 Note: these modifiers can be used with the -S switch in order to specify
 where the check for duplicates should be performed before adding the SPN.
 Note: -T can be specified multiple times.

Examples:
setspn -R daserver1
 It will register SPN "HOST/daserver1" and "HOST/{DNS of daserver1}"
setspn -S http/daserver daserver1
 It will register SPN "http/daserver" for computer "daserver1"
 if no such SPN exists in the domain
setspn -D http/daserver daserver1
 It will delete SPN "http/daserver" for computer "daserver1"
setspn -F -S http/daserver daserver1
 It will register SPN "http/daserver" for computer "daserver1"
 if no such SPN exists in the forest
setspn -U -S http/daserver dauser
 It will register SPN "http/daserver" for user account "dauser"
 if no such SPN exists in the domain
setspn -T * -T bar -X
 It will report all duplicate registration of SPNs in this domain and bar
setspn -T bar -F -Q */daserver
 It will find all SPNs of the form */daserver registered in the forest to
 which bar belongs

Return Code: 2

fondue

Sat, 07 Dec 2019 09:09:26 +0000

Windows Features on Demand UX

fondue

C:\Windows\system32\fondue.exe /?

Output:

---------------------------
Windows Features
---------------------------
Features on Demand User Experience Tool

FONDUE.exe /enable-feature:<value> [/caller-name:<value>]
 [/hide-ux:{all | rebootRequest}]

Fondue.exe enables Windows optional features by downloading required files
from Windows Update or a source that Group Policy specifies.

/enable-feature - Specifies the name of the Windows optional feature that
 you want to enable. You can enable only one feature per command line. To
 enable multiple features, use Fondue.exe for each feature.

/caller-name - Specifies the program or process name when you call
 Fondue.exe from a script or a batch file. You can use this option to send
 a report of the program name to Microsoft.

/hide-ux:{all | rebootRequest} - Use "all" to hide all messages to the user,
 including progress and permission requests to access Windows Update. If
 permission is required, the operation will fail.
 Use "rebootRequest" only to hide user messages that ask for permission to
 reboot the PC. Use this option if you have a script that controls reboot
 requests.

EXAMPLES:
 FONDUE.exe /enable-feature:NETFX3
 FONDUE.exe /enable-feature:NETFX3 /caller-name:Admin.bat /hide-ux:all
---------------------------
OK
---------------------------

Return Code: 1

msiexec

Sat, 07 Dec 2019 09:09:26 +0000

Windowsr installer

MRT

C:\Windows\system32\msiexec.exe /?

Output:

Windows ® Installer. V 5.0.19041.1

msiexec /Option <Required Parameter> [Optional Parameter]

Install Options
 </package | /i> <Product.msi>
 Installs or configures a product
 /a <Product.msi>
 Administrative install - Installs a product on the network
 /j<u|m> <Product.msi> [/t <Transform List>] [/g <Language ID>]
 Advertises a product - m to all users, u to current user
 </uninstall | /x> <Product.msi | ProductCode>
 Uninstalls the product
Display Options
 /quiet
 Quiet mode, no user interaction
 /passive
 Unattended mode - progress bar only
 /q[n|b|r|f]
 Sets user interface level
 n - No UI
 b - Basic UI
 r - Reduced UI
 f - Full UI (default)
 /help
 Help information
Restart Options
 /norestart
 Do not restart after the installation is complete
 /promptrestart
 Prompts the user for restart if necessary
 /forcerestart
 Always restart the computer after installation
Logging Options
 /l[i|w|e|a|r|u|c|m|o|p|v|x|+|!|*] <LogFile>
 i - Status messages
 w - Nonfatal warnings
 e - All error messages
 a - Start up of actions
 r - Action-specific records
 u - User requests
 c - Initial UI parameters
 m - Out-of-memory or fatal exit information
 o - Out-of-disk-space messages
 p - Terminal properties
 v - Verbose output
 x - Extra debugging information
 + - Append to existing log file
 ! - Flush each line to the log
 * - Log all information, except for v and x options
 /log <LogFile>
 Equivalent of /l* <LogFile>
Update Options
 /update <Update1.msp>[;Update2.msp]
 Applies update(s)
 /uninstall <PatchCodeGuid>[;Update2.msp] /package <Product.msi | ProductCode>
 Remove update(s) for a product
Repair Options
 /f[p|e|c|m|s|o|d|a|u|v] <Product.msi | ProductCode>
 Repairs a product
 p - only if file is missing
 o - if file is missing or an older version is installed (default)
 e - if file is missing or an equal or older version is installed
 d - if file is missing or a different version is installed
 c - if file is missing or checksum does not match the calculated value
 a - forces all files to be reinstalled
 u - all required user-specific registry entries (default)
 m - all required computer-specific registry entries (default)
 s - all existing shortcuts (default)
 v - runs from source and recaches local package
Setting Public Properties
 [PROPERTY=PropertyValue]

Consult the Windows ® Installer SDK for additional documentation on the
command line syntax.

Copyright © Microsoft Corporation. All rights reserved.
Portions of this software are based in part on the work of the Independent JPEG Group.

Return Code: 1

pwlauncher

Sat, 07 Dec 2019 09:09:26 +0000

Windows To Go Startup Options Command Line Tool

pwlauncher

C:\Windows\system32\pwlauncher.exe /?

Output:

pwlauncher.exe - Windows To Go startup options command-line tool.

The pwlauncher.exe command-line tool is used to query or change your Windows To
Go startup options.

pwlauncher [/enable | /disable]

 <<no parameter>> Display the current state.

 /enable Enable the startup option.

 /disable Disable the startup option.

Return Code: 0

iexpress

Sat, 07 Dec 2019 09:09:23 +0000

Wizard

IExpress

C:\Windows\system32\IExpress.exe /?

Output:

---------------------------
IExpress Wizard
---------------------------
Command syntax is incorrect!

Options: [/N [/Q] [/M]] <SED filename> [/O:Override SED filename,OverrideSectionName] [/D:directory]

/N: Build package now (SED Filename must be specified)
/Q: Quiet mode when using /N
/M: Use minimized windows when using /N
/O: Specify override SED file and section
/D: Override directory for exe stub
---------------------------
OK
---------------------------

Return Code: 1

odbcconf

Sat, 07 Dec 2019 09:09:23 +0000

ODBC Driver Configuration Program

ODBCConf

C:\Windows\system32\odbcconf.exe /?

Output:

---------------------------
ODBCConf Usage
---------------------------
ODBCConf.exe -- perform various MDAC install actions.

Switches:
 /H, /? - Displays this usage dialog
 /S - Silent, Don't display any error messages
 /C - Continue executing actions even if an action fails
 /R - Perform the actions after reboot
 /F - Use a Response File, followed by the filename
 /E - Erase the Response File when done
 /L - Enable Logging, followed by a mode and filename
 Log modes: n (normal), v (verbose), d (debug)
 example '/Lv log.txt' Verbose logging to log.txt
 /A - List an action. Actions are listed in {}

Actions:
 SETFILEDSNDIR
 INSTALLDRIVER <driver name|driver=driver path|other attributes>
 INSTALLTRANSLATOR <translator name|translator=translator path|other attributes>
 CONFIGDRIVER <driver name> <driver attributes>
 CONFIGDSN <driver name> <DSN=DSN name|other attributes>
 CONFIGSYSDSN <driver name> <DSN=DSN name|other attributes>
 REGSVR <path to dll>

Examples:
 ODBCConf INSTALLDRIVER "My Driver|Driver=c:\Drv.dll|APILevel=2"
 ODBCConf CONFIGDSN "My Driver" "DSN=testDSN|Server=myServer"
 ODBCConf /a {REGSVR foo.dll} /a {CONFIGDRIVER "MyDriver" "CPTimeout=60"}
 ODBCConf /e /f "my response file.log" /Lv log.log

---------------------------
OK
---------------------------

Return Code: 1

dxdiag

Sat, 07 Dec 2019 09:09:18 +0000

Microsoft DirectX Diagnostic Tool

dxdiag

C:\Windows\system32\dxdiag.exe /?

Output:

---------------------------
DirectX Diagnostic Tool
---------------------------
Usage: dxdiag [/dontskip] [/whql:on | /whql:off] [/x outfile] [/t outfile]
/x outfile - silently save XML information to <outfile> and quit
/t outfile - silently save txt information to <outfile> and quit
/dontskip - don't bypass any diagnostics due to previous crashes in DxDiag
/whql:on - allow dxdiag to check for WHQL digital signatures
/whql:off - do not allow dxdiag to check for WHQL digital signatures
Note: Checking for WHQL digital signatures may connect via internet to update WHQL certificates.
---------------------------
OK
---------------------------

Return Code: 1

choice

Sat, 07 Dec 2019 09:09:16 +0000

Offers the user a choice

choice

C:\Windows\system32\choice.exe /?

Output:


CHOICE [/C choices] [/N] [/CS] [/T timeout /D choice] [/M text]

Description:
 This tool allows users to select one item from a list
 of choices and returns the index of the selected choice.

Parameter List:
 /C choices Specifies the list of choices to be created.
 Default list is "YN".

 /N Hides the list of choices in the prompt.
 The message before the prompt is displayed
 and the choices are still enabled.

 /CS Enables case-sensitive choices to be selected.
 By default, the utility is case-insensitive.

 /T timeout The number of seconds to pause before a default
 choice is made. Acceptable values are from 0 to
 9999. If 0 is specified, there will be no pause
 and the default choice is selected.

 /D choice Specifies the default choice after nnnn seconds.
 Character must be in the set of choices specified
 by /C option and must also specify nnnn with /T.

 /M text Specifies the message to be displayed before
 the prompt. If not specified, the utility
 displays only a prompt.

 /? Displays this help message.

 NOTE:
 The ERRORLEVEL environment variable is set to the index of the
 key that was selected from the set of choices. The first choice
 listed returns a value of 1, the second a value of 2, and so on.
 If the user presses a key that is not a valid choice, the tool
 sounds a warning beep. If tool detects an error condition,
 it returns an ERRORLEVEL value of 255. If the user presses
 CTRL+BREAK or CTRL+C, the tool returns an ERRORLEVEL value
 of 0. When you use ERRORLEVEL parameters in a batch program, list
 them in decreasing order.

Examples:
 CHOICE /?
 CHOICE /C YNC /M "Press Y for Yes, N for No or C for Cancel."
 CHOICE /T 10 /C ync /CS /D y
 CHOICE /C ab /M "Select a for option 1 and b for option 2."
 CHOICE /C ab /N /M "Select a for option 1 and b for option 2."

Return Code: 0

clip

Sat, 07 Dec 2019 09:09:16 +0000

Clip - copies the data into clipboard

clip

C:\Windows\system32\clip.exe /?

Output:


CLIP

Description:
 Redirects output of command line tools to the Windows clipboard.
 This text output can then be pasted into other programs.

Parameter List:
 /? Displays this help message.

Examples:
 DIR | CLIP Places a copy of the current directory
 listing into the Windows clipboard.

 CLIP < README.TXT Places a copy of the text from readme.txt
 on to the Windows clipboard.

Return Code: 0

convert

Sat, 07 Dec 2019 09:09:16 +0000

File System Conversion Utility

convert

C:\Windows\system32\convert.exe /?

Output:

Converts a FAT volume to NTFS.

CONVERT volume /FS:NTFS [/V] [/CvtArea:filename] [/NoSecurity] [/X]


 volume Specifies the drive letter (followed by a colon),
 mount point, or volume name.
 /FS:NTFS Specifies that the volume will be converted to NTFS.
 /V Specifies that Convert will be run in verbose mode.
 /CvtArea:filename
 Specifies a contiguous file in the root directory
 that will be the place holder for NTFS system files.
 /NoSecurity Specifies that the security settings on the converted
 files and directories allow access by all users.
 /X Forces the volume to dismount first if necessary.
 All open handles to the volume will not be valid.

Return Code: 0

forfiles

Sat, 07 Dec 2019 09:09:16 +0000

ForFiles - Executes a command on selected files

forfiles

C:\Windows\system32\forfiles.exe /?

Output:


FORFILES [/P pathname] [/M searchmask] [/S]
 [/C command] [/D [+ | -] {MM/dd/yyyy | dd}]

Description:
 Selects a file (or set of files) and executes a
 command on that file. This is helpful for batch jobs.

Parameter List:
 /P pathname Indicates the path to start searching.
 The default folder is the current working
 directory (.).

 /M searchmask Searches files according to a searchmask.
 The default searchmask is '*' .

 /S Instructs forfiles to recurse into
 subdirectories. Like "DIR /S".

 /C command Indicates the command to execute for each file.
 Command strings should be wrapped in double
 quotes.

 The default command is "cmd /c echo @file".

 The following variables can be used in the
 command string:
 @file - returns the name of the file.
 @fname - returns the file name without
 extension.
 @ext - returns only the extension of the
 file.
 @path - returns the full path of the file.
 @relpath - returns the relative path of the
 file.
 @isdir - returns "TRUE" if a file type is
 a directory, and "FALSE" for files.
 @fsize - returns the size of the file in
 bytes.
 @fdate - returns the last modified date of the
 file.
 @ftime - returns the last modified time of the
 file.

 To include special characters in the command
 line, use the hexadecimal code for the character
 in 0xHH format (ex. 0x09 for tab). Internal
 CMD.exe commands should be preceded with
 "cmd /c".

 /D date Selects files with a last modified date greater
 than or equal to (+), or less than or equal to
 (-), the specified date using the
 "MM/dd/yyyy" format; or selects files with a
 last modified date greater than or equal to (+)
 the current date plus "dd" days, or less than or
 equal to (-) the current date minus "dd" days. A
 valid "dd" number of days can be any number in
 the range of 0 - 32768.
 "+" is taken as default sign if not specified.

 /? Displays this help message.

Examples:
 FORFILES /?
 FORFILES
 FORFILES /P C:\WINDOWS /S /M DNS*.*
 FORFILES /S /M *.txt /C "cmd /c type @file | more"
 FORFILES /P C:\ /S /M *.bat
 FORFILES /D -30 /M *.exe
 /C "cmd /c echo @path 0x09 was changed 30 days ago"
 FORFILES /D 1/20/2006
 /C "cmd /c echo @fname is new since Jan 1st 2001"
 FORFILES /D +1/20/2006 /C "cmd /c echo @fname is new today"
 FORFILES /M *.exe /D +1
 FORFILES /S /M *.doc /C "cmd /c echo @fsize"
 FORFILES /M *.txt /C "cmd /c if @isdir==FALSE notepad.exe @file"

Return Code: 0

help

Sat, 07 Dec 2019 09:09:16 +0000

Command Line Help Utility

help

C:\Windows\system32\help.exe /?

Output:

Provides help information for Windows commands.

HELP [command]

 command - displays help information on that command.

Return Code: 1

ktmutil

Sat, 07 Dec 2019 09:09:16 +0000

Kernel Transaction Management Utility

ktmutil

C:\Windows\system32\ktmutil.exe

Output:

---- Commands Supported ----

tx Commands related to transactions
tm Commands related to transaction managers

Return Code: 0

ktmutil tx

C:\Windows\system32\ktmutil.exe tx

Output:

Usage :
 ktmutil tx list Lists all transactions
 ktmutil tx info Get information about a transaction
 ktmutil tx force Force a transaction to a given outcome
 ktmutil tx forget Forget a committed transaction

Return Code: 0

ktmutil tm

C:\Windows\system32\ktmutil.exe tm

Output:

Usage :
 ktmutil tm list Lists all transaction managers
 ktmutil tm info Get information about a particular transaction manager

Return Code: 0

label

Sat, 07 Dec 2019 09:09:16 +0000

Disk Label Utility

label

C:\Windows\system32\label.exe /?

Output:

Creates, changes, or deletes the volume label of a disk.

LABEL [drive:][label]
LABEL [/MP] [volume] [label]

 drive: Specifies the drive letter of a drive.
 label Specifies the label of the volume.
 /MP Specifies that the volume should be treated as a
 mount point or volume name.
 volume Specifies the drive letter (followed by a colon),
 mount point, or volume name. If volume name is specified,
 the /MP flag is unnecessary.

Return Code: 0

openfiles

Sat, 07 Dec 2019 09:09:16 +0000

Displays the current open files list

openfiles

C:\Windows\system32\openfiles.exe /?

Output:


OPENFILES /parameter [arguments]

Description:
 Enables an administrator to list or disconnect files and folders
 that have been opened on a system.

Parameter List:
 /Disconnect Disconnects one or more open files.

 /Query Displays files opened locally or from shared
 folders.

 /Local Enables / Disables the display of local open files.

 /? Displays this help message.

Examples:
 OPENFILES /Disconnect /?
 OPENFILES /Query /?
 OPENFILES /Local /?

Return Code: 0

stordiag

Sat, 07 Dec 2019 09:09:16 +0000

stordiag

C:\Windows\system32\stordiag.exe /?

Output:


Collects storage and filesystem diagnostic logs and outputs them to a folder.

StorDiag [-collectEtw] [-out <PATH>]
-collectEtw Collect a 30-second long ETW trace if run from an elevated session
-collectPerf Collect disk performance counters
-collectStorageBreakdown Collect system volume used space breakdown
-checkFSConsistency Checks for the consistency of the NTFS file system
-diagnostic outputs a storage diagnostic report
-bootdiag output boot sectors of the disk
-driverdiag output avaliable storport and storahci logs
-out <PATH> Specify the output path. If not specified, logs are saved to %TEMP%\StorDiag

Return Code: 0

arp

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP Arp Command

arp

C:\Windows\system32\ARP.EXE /?

Output:


Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).

ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr] [-v]

 -a Displays current ARP entries by interrogating the current
 protocol data. If inet_addr is specified, the IP and Physical
 addresses for only the specified computer are displayed. If
 more than one network interface uses ARP, entries for each ARP
 table are displayed.
 -g Same as -a.
 -v Displays current ARP entries in verbose mode. All invalid
 entries and entries on the loop-back interface will be shown.
 inet_addr Specifies an internet address.
 -N if_addr Displays the ARP entries for the network interface specified
 by if_addr.
 -d Deletes the host specified by inet_addr. inet_addr may be
 wildcarded with * to delete all hosts.
 -s Adds the host and associates the Internet address inet_addr
 with the Physical address eth_addr. The Physical address is
 given as 6 hexadecimal bytes separated by hyphens. The entry
 is permanent.
 eth_addr Specifies a physical address.
 if_addr If present, this specifies the Internet address of the
 interface whose address translation table should be modified.
 If not present, the first applicable interface will be used.
Example:
 > arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry.
 > arp -a .... Displays the arp table.

Return Code: 1

attrib

Sat, 07 Dec 2019 09:09:13 +0000

Attribute Utility

attrib

C:\Windows\system32\attrib.exe /?

Output:

Displays or changes file attributes.

ATTRIB [+R | -R] [+A | -A] [+S | -S] [+H | -H] [+O | -O] [+I | -I] [+X | -X] [+P | -P] [+U | -U]
 [drive:][path][filename] [/S [/D]] [/L]

 + Sets an attribute.
 - Clears an attribute.
 R Read-only file attribute.
 A Archive file attribute.
 S System file attribute.
 H Hidden file attribute.
 O Offline attribute.
 I Not content indexed file attribute.
 X No scrub file attribute.
 V Integrity attribute.
 P Pinned attribute.
 U Unpinned attribute.
 B SMR Blob attribute.
 [drive:][path][filename]
 Specifies a file or files for attrib to process.
 /S Processes matching files in the current folder
 and all subfolders.
 /D Processes folders as well.
 /L Work on the attributes of the Symbolic Link versus
 the target of the Symbolic Link

Return Code: 0

example


c:\example>dir /b
1Read-only file.txt
2Archive file.txt
3System file.txt
4Hidden file.txt
5Offline file.txt
6Not content indexed file.txt
7No scrub file.txt
8Pinned file.txt
9Unpinned file.txt
example.bat

c:\example>attrib
A C:\example\1Read-only file.txt
A C:\example\2Archive file.txt
A C:\example\3System file.txt
A C:\example\4Hidden file.txt
A C:\example\5Offline file.txt
A C:\example\6Not content indexed file.txt
A C:\example\7No scrub file.txt
A C:\example\8Pinned file.txt
A C:\example\9Unpinned file.txt
A C:\example\example.bat

c:\example>attrib +S "3System file.txt"

c:\example>attrib +H "4Hidden file.txt"

c:\example>dir /b
1Read-only file.txt
2Archive file.txt
5Offline file.txt
6Not content indexed file.txt
7No scrub file.txt
8Pinned file.txt
9Unpinned file.txt
example.bat

c:\example>attrib +R "1Read-only file.txt"

c:\example>attrib +A "2Archive file.txt"

c:\example>attrib +O "5Offline file.txt"

c:\example>attrib +I "6Not content indexed file.txt"

c:\example>attrib +X "7No scrub file.txt"

c:\example>attrib +P "8Pinned file.txt"

c:\example>attrib +U "9Unpinned file.txt"

c:\example>attrib
A R C:\example\1Read-only file.txt
A C:\example\2Archive file.txt
A S C:\example\3System file.txt
A H C:\example\4Hidden file.txt
A O C:\example\5Offline file.txt
A I C:\example\6Not content indexed file.txt
A X C:\example\7No scrub file.txt
A P C:\example\8Pinned file.txt
A U C:\example\9Unpinned file.txt
A C:\example\example.bat

c:\example>dir /b
1Read-only file.txt
2Archive file.txt
5Offline file.txt
6Not content indexed file.txt
7No scrub file.txt
8Pinned file.txt
9Unpinned file.txt
example.bat

c:\example>del *txt
c:\example\1Read-only file.txt
Access is denied.

c:\example>dir /b
1Read-only file.txt
example.bat

c:\example>attrib -R "1Read-only file.txt"

c:\example>attrib
A C:\example\1Read-only file.txt
A S C:\example\3System file.txt
A H C:\example\4Hidden file.txt
A C:\example\example.bat

c:\example>dir /b /a
1Read-only file.txt
3System file.txt
4Hidden file.txt
example.bat

c:\example>del /a *txt

c:\example>dir /b /a
example.bat

Symbolic Link

comp

Sat, 07 Dec 2019 09:09:13 +0000

File Compare Utility

comp

C:\Windows\system32\comp.exe /?

Output:

Compares the contents of two files or sets of files.

COMP [data1] [data2] [/D] [/A] [/L] [/N=number] [/C] [/OFF[LINE]] [/M]

 data1 Specifies location and name(s) of first file(s) to compare.
 data2 Specifies location and name(s) of second files to compare.
 /D Displays differences in decimal format.
 /A Displays differences in ASCII characters.
 /L Displays line numbers for differences.
 /N=number Compares only the first specified number of lines in each file.
 /C Disregards case of ASCII letters when comparing files.
 /OFF[LINE] Do not skip files with offline attribute set.
 /M Do not prompt for compare more files.

To compare sets of files, use wildcards in data1 and data2 parameters.

Return Code: 2

fc

Sat, 07 Dec 2019 09:09:13 +0000

DOS 5 File Compare Utility

fc

C:\Windows\system32\fc.exe /?

Output:

Compares two files or sets of files and displays the differences between
them


FC [/A] [/C] [/L] [/LBn] [/N] [/OFF[LINE]] [/T] [/U] [/W] [/nnnn]
 [drive1:][path1]filename1 [drive2:][path2]filename2
FC /B [drive1:][path1]filename1 [drive2:][path2]filename2

 /A Displays only first and last lines for each set of differences.
 /B Performs a binary comparison.
 /C Disregards the case of letters.
 /L Compares files as ASCII text.
 /LBn Sets the maximum consecutive mismatches to the specified
 number of lines.
 /N Displays the line numbers on an ASCII comparison.
 /OFF[LINE] Do not skip files with offline attribute set.
 /T Does not expand tabs to spaces.
 /U Compare files as UNICODE text files.
 /W Compresses white space (tabs and spaces) for comparison.
 /nnnn Specifies the number of consecutive lines that must match
 after a mismatch.
 [drive1:][path1]filename1
 Specifies the first file or set of files to compare.
 [drive2:][path2]filename2
 Specifies the second file or set of files to compare.

Return Code: 4294967295

findstr

Sat, 07 Dec 2019 09:09:13 +0000

Find String (QGREP) Utility

findstr

C:\Windows\system32\findstr.exe /?

Output:

Searches for strings in files.

FINDSTR [/B] [/E] [/L] [/R] [/S] [/I] [/X] [/V] [/N] [/M] [/O] [/P] [/F:file]
 [/C:string] [/G:file] [/D:dir list] [/A:color attributes] [/OFF[LINE]]
 strings [[drive:][path]filename[ ...]]

 /B Matches pattern if at the beginning of a line.
 /E Matches pattern if at the end of a line.
 /L Uses search strings literally.
 /R Uses search strings as regular expressions.
 /S Searches for matching files in the current directory and all
 subdirectories.
 /I Specifies that the search is not to be case-sensitive.
 /X Prints lines that match exactly.
 /V Prints only lines that do not contain a match.
 /N Prints the line number before each line that matches.
 /M Prints only the filename if a file contains a match.
 /O Prints character offset before each matching line.
 /P Skip files with non-printable characters.
 /OFF[LINE] Do not skip files with offline attribute set.
 /A:attr Specifies color attribute with two hex digits. See "color /?"
 /F:file Reads file list from the specified file(/ stands for console).
 /C:string Uses specified string as a literal search string.
 /G:file Gets search strings from the specified file(/ stands for console).
 /D:dir Search a semicolon delimited list of directories
 strings Text to be searched for.
 [drive:][path]filename
 Specifies a file or files to search.

Use spaces to separate multiple search strings unless the argument is prefixed
with /C. For example, 'FINDSTR "hello there" x.y' searches for "hello" or
"there" in file x.y. 'FINDSTR /C:"hello there" x.y' searches for
"hello there" in file x.y.

Regular expression quick reference:
 . Wildcard: any character
 * Repeat: zero or more occurrences of previous character or class
 ^  Line position: beginning of line
 $ Line position: end of line
 [class] Character class: any one character in set
 [^class] Inverse class: any one character not in set
 [x-y] Range: any characters within the specified range
 \x Escape: literal use of metacharacter x
 \<xyz Word position: beginning of word
 xyz\> Word position: end of word

For full information on FINDSTR regular expressions refer to the online Command
Reference.

Return Code: 0

finger

Sat, 07 Dec 2019 09:09:13 +0000

TCPIP Finger Command

finger

C:\Windows\system32\finger.exe /?

STDERR:


Displays information about a user on a specified system running the
Finger service. Output varies based on the remote system.

FINGER [-l] [user]@host [...]

 -l Displays information in long list format.
 user Specifies the user you want information about. Omit the user
 parameter to display information about all users on the
 specifed host.
 @host Specifies the server on the remote system whose users you
 want information about.

Return Code: 1

fsutil

Sat, 07 Dec 2019 09:09:13 +0000

fsutil.exe

fsutil

C:\Windows\system32\fsutil.exe

Output:

---- Commands Supported ----

8dot3name 8dot3name management
behavior Control file system behavior
dax Dax volume management
dirty Manage volume dirty bit
file File specific commands
fsInfo File system information
hardlink Hardlink management
objectID Object ID management
quota Quota management
repair Self healing management
reparsePoint Reparse point management
storageReserve Storage Reserve management
resource Transactional Resource Manager management
sparse Sparse file control
tiering Storage tiering property management
transaction Transaction management
usn USN management
volume Volume management
wim Transparent wim hosting management

Return Code: 0

hostname

Sat, 07 Dec 2019 09:09:13 +0000

Hostname APP

hostname

C:\Windows\system32\HOSTNAME.EXE /?

Output:


Prints the name of the current host.

hostname

Return Code: 1

icacls

Sat, 07 Dec 2019 09:09:13 +0000

icacls

C:\Windows\system32\icacls.exe /?

Output:


ICACLS name /save aclfile [/T] [/C] [/L] [/Q]
 stores the DACLs for the files and folders that match the name
 into aclfile for later use with /restore. Note that SACLs,
 owner, or integrity labels are not saved.

ICACLS directory [/substitute SidOld SidNew [...]] /restore aclfile
 [/C] [/L] [/Q]
 applies the stored DACLs to files in directory.

ICACLS name /setowner user [/T] [/C] [/L] [/Q]
 changes the owner of all matching names. This option does not
 force a change of ownership; use the takeown.exe utility for
 that purpose.

ICACLS name /findsid Sid [/T] [/C] [/L] [/Q]
 finds all matching names that contain an ACL
 explicitly mentioning Sid.

ICACLS name /verify [/T] [/C] [/L] [/Q]
 finds all files whose ACL is not in canonical form or whose
 lengths are inconsistent with ACE counts.

ICACLS name /reset [/T] [/C] [/L] [/Q]
 replaces ACLs with default inherited ACLs for all matching files.

ICACLS name [/grant[:r] Sid:perm[...]]
 [/deny Sid:perm [...]]
 [/remove[:g|:d]] Sid[...]] [/T] [/C] [/L] [/Q]
 [/setintegritylevel Level:policy[...]]

 /grant[:r] Sid:perm grants the specified user access rights. With :r,
 the permissions replace any previously granted explicit permissions.
 Without :r, the permissions are added to any previously granted
 explicit permissions.

 /deny Sid:perm explicitly denies the specified user access rights.
 An explicit deny ACE is added for the stated permissions and
 the same permissions in any explicit grant are removed.

 /remove[:[g|d]] Sid removes all occurrences of Sid in the ACL. With
 :g, it removes all occurrences of granted rights to that Sid. With
 :d, it removes all occurrences of denied rights to that Sid.

 /setintegritylevel [(CI)(OI)]Level explicitly adds an integrity
 ACE to all matching files. The level is to be specified as one
 of:
 L[ow]
 M[edium]
 H[igh]
 Inheritance options for the integrity ACE may precede the level
 and are applied only to directories.

 /inheritance:e|d|r
 e - enables inheritance
 d - disables inheritance and copy the ACEs
 r - remove all inherited ACEs


Note:
 Sids may be in either numerical or friendly name form. If a numerical
 form is given, affix a * to the start of the SID.

 /T indicates that this operation is performed on all matching
 files/directories below the directories specified in the name.

 /C indicates that this operation will continue on all file errors.
 Error messages will still be displayed.

 /L indicates that this operation is performed on a symbolic link
 itself versus its target.

 /Q indicates that icacls should suppress success messages.

 ICACLS preserves the canonical ordering of ACE entries:
 Explicit denials
 Explicit grants
 Inherited denials
 Inherited grants

 perm is a permission mask and can be specified in one of two forms:
 a sequence of simple rights:
 N - no access
 F - full access
 M - modify access
 RX - read and execute access
 R - read-only access
 W - write-only access
 D - delete access
 a comma-separated list in parentheses of specific rights:
 DE - delete
 RC - read control
 WDAC - write DAC
 WO - write owner
 S - synchronize
 AS - access system security
 MA - maximum allowed
 GR - generic read
 GW - generic write
 GE - generic execute
 GA - generic all
 RD - read data/list directory
 WD - write data/add file
 AD - append data/add subdirectory
 REA - read extended attributes
 WEA - write extended attributes
 X - execute/traverse
 DC - delete child
 RA - read attributes
 WA - write attributes
 inheritance rights may precede either form and are applied
 only to directories:
 (OI) - object inherit
 (CI) - container inherit
 (IO) - inherit only
 (NP) - don't propagate inherit
 (I) - permission inherited from parent container

Examples:

 icacls c:\windows\* /save AclFile /T
 - Will save the ACLs for all files under c:\windows
 and its subdirectories to AclFile.

 icacls c:\windows\ /restore AclFile
 - Will restore the Acls for every file within
 AclFile that exists in c:\windows and its subdirectories.

 icacls file /grant Administrator:(D,WDAC)
 - Will grant the user Administrator Delete and Write DAC
 permissions to file.

 icacls file /grant *S-1-1-0:(D,WDAC)
 - Will grant the user defined by sid S-1-1-0 Delete and
 Write DAC permissions to file.

Return Code: 0

ipconfig

Sat, 07 Dec 2019 09:09:13 +0000

IP Configuration Utility

ipconfig

C:\Windows\system32\ipconfig.exe /?

Output:


USAGE:
 ipconfig [/allcompartments] [/? | /all |
 /renew [adapter] | /release [adapter] |
 /renew6 [adapter] | /release6 [adapter] |
 /flushdns | /displaydns | /registerdns |
 /showclassid adapter |
 /setclassid adapter [classid] |
 /showclassid6 adapter |
 /setclassid6 adapter [classid] ]

where
 adapter Connection name
 (wildcard characters * and ? allowed, see examples)

 Options:
 /? Display this help message
 /all Display full configuration information.
 /release Release the IPv4 address for the specified adapter.
 /release6 Release the IPv6 address for the specified adapter.
 /renew Renew the IPv4 address for the specified adapter.
 /renew6 Renew the IPv6 address for the specified adapter.
 /flushdns Purges the DNS Resolver cache.
 /registerdns Refreshes all DHCP leases and re-registers DNS names
 /displaydns Display the contents of the DNS Resolver Cache.
 /showclassid Displays all the dhcp class IDs allowed for adapter.
 /setclassid Modifies the dhcp class id.
 /showclassid6 Displays all the IPv6 DHCP class IDs allowed for adapter.
 /setclassid6 Modifies the IPv6 DHCP class id.


The default is to display only the IP address, subnet mask and
default gateway for each adapter bound to TCP/IP.

For Release and Renew, if no adapter name is specified, then the IP address
leases for all adapters bound to TCP/IP will be released or renewed.

For Setclassid and Setclassid6, if no ClassId is specified, then the ClassId is removed.

Examples:
 > ipconfig ... Show information
 > ipconfig /all ... Show detailed information
 > ipconfig /renew ... renew all adapters
 > ipconfig /renew EL* ... renew any connection that has its
 name starting with EL
 > ipconfig /release *Con* ... release all matching connections,
 eg. "Wired Ethernet Connection 1" or
 "Wired Ethernet Connection 2"
 > ipconfig /allcompartments ... Show information about all
 compartments
 > ipconfig /allcompartments /all ... Show detailed information about all
 compartments

Return Code: 1

Sat, 07 Dec 2019 09:09:13 +0000

More Utility

C:\Windows\system32\more.com /?

Output:

Displays output one screen at a time.

MORE [/E [/C] [/P] [/S] [/Tn] [+n]] < [drive:][path]filename
command-name | MORE [/E [/C] [/P] [/S] [/Tn] [+n]]
MORE /E [/C] [/P] [/S] [/Tn] [+n] [files]

 [drive:][path]filename Specifies a file to display one
 screen at a time.

 command-name Specifies a command whose output
 will be displayed.

 /E Enable extended features
 /C Clear screen before displaying page
 /P Expand FormFeed characters
 /S Squeeze multiple blank lines into a single line
 /Tn Expand tabs to n spaces (default 8)

 Switches can be present in the MORE environment
 variable.

 +n Start displaying the first file at line n

 files List of files to be displayed. Files in the list
 are separated by blanks.

 If extended features are enabled, the following commands
 are accepted at the -- More -- prompt:

 P n Display next n lines
 S n Skip next n lines
 F Display next file
 Q Quit
 = Show line number
 ? Show help line
 <space> Display next page
 <ret> Display next line

Return Code: 0

mountvol

Sat, 07 Dec 2019 09:09:13 +0000

Mount Volume Utility

mountvol

C:\Windows\system32\mountvol.exe /?

Output:

Creates, deletes, or lists a volume mount point.

MOUNTVOL [drive:]path VolumeName
MOUNTVOL [drive:]path /D
MOUNTVOL [drive:]path /L
MOUNTVOL [drive:]path /P
MOUNTVOL /R
MOUNTVOL /N
MOUNTVOL /E
MOUNTVOL drive: /S

 path Specifies the existing NTFS directory where the mount
 point will reside.
 VolumeName Specifies the volume name that is the target of the mount
 point.
 /D Removes the volume mount point from the specified directory.
 /L Lists the mounted volume name for the specified directory.
 /P Removes the volume mount point from the specified directory,
 dismounts the volume, and makes the volume not mountable.
 You can make the volume mountable again by creating a volume
 mount point.
 /R Removes volume mount point directories and registry settings
 for volumes that are no longer in the system.
 /N Disables automatic mounting of new volumes.
 /E Re-enables automatic mounting of new volumes.
 /S Mount the EFI System Partition on the given drive.

Possible values for VolumeName along with current mount points are:

 \\?\Volume{722422e7-9891-446b-92f2-c40e32480b1d}\
 C:\

 \\?\Volume{fe9b1951-0267-4944-9baa-aa06ec7fb023}\
 *** NO MOUNT POINTS ***

 \\?\Volume{ac4a93b3-3ad2-4abf-8e1b-4bef42a8a330}\
 *** NO MOUNT POINTS ***

 \\?\Volume{5ebe4af1-403f-11ed-a5d3-806e6f6e6963}\
 D:\

Return Code: 0

mrinfo

Sat, 07 Dec 2019 09:09:13 +0000

Multicast Information

mrinfo

C:\Windows\system32\MRINFO.EXE /?

Output:


Usage: mrinfo [-n?] [-i address] [-t secs] [-r retries] destination

 -n Display IP addresses in numeric format
 -i address Address of local interface to send query out
 -t seconds Timeout in seconds for IGMP queries (default = 3 seconds)
 -r retries Number of extra times to send the SNMP queries (default = 0)
 -? Print Usage
 destination Address or name of destination

Return Code: 1

net

Sat, 07 Dec 2019 09:09:13 +0000

Net Command

net

C:\Windows\system32\net.exe help

Output:

The syntax of this command is:

NET HELP
command
 -or-
NET command /HELP

 Commands available are:

 NET ACCOUNTS NET HELPMSG NET STATISTICS
 NET COMPUTER NET LOCALGROUP NET STOP
 NET CONFIG NET PAUSE NET TIME
 NET CONTINUE NET SESSION NET USE
 NET FILE NET SHARE NET USER
 NET GROUP NET START NET VIEW
 NET HELP

 NET HELP NAMES explains different types of names in NET HELP syntax lines.
 NET HELP SERVICES lists some of the services you can start.
 NET HELP SYNTAX explains how to read NET HELP syntax lines.
 NET HELP command | MORE displays Help one screen at a time.

Return Code: 1

net SERVICES

C:\Windows\system32\net.exe HELP SERVICES

Output:

The syntax of this command is:

SERVICES
NET START can be used to start services, including:

 NET START BROWSER
 NET START DHCP CLIENT
 NET START EVENTLOG
 NET START FILE REPLICATION
 NET START NETLOGON
 NET START PLUG AND PLAY
 NET START REMOTE ACCESS CONNECTION MANAGER
 NET START ROUTING AND REMOTE ACCESS
 NET START RPCSS
 NET START SCHEDULE
 NET START SERVER
 NET START SPOOLER
 NET START TCP/IP NETBIOS HELPER
 NET START UPS
 NET START WORKSTATION

When typed at the command prompt, service names of two words or more must
be enclosed in quotation marks. For example, NET START "DHCP Client"
starts the DHCP Client service.

Return Code: 1

netsh

Sat, 07 Dec 2019 09:09:13 +0000

Network Command Shell

netsh

C:\Windows\system32\netsh.exe help

Output:


The following commands are available:

Commands in this context:
? - Displays a list of commands.
add - Adds a configuration entry to a list of entries.
advfirewall - Changes to the `netsh advfirewall' context.
branchcache - Changes to the `netsh branchcache' context.
bridge - Changes to the `netsh bridge' context.
delete - Deletes a configuration entry from a list of entries.
dhcpclient - Changes to the `netsh dhcpclient' context.
dnsclient - Changes to the `netsh dnsclient' context.
dump - Displays a configuration script.
exec - Runs a script file.
firewall - Changes to the `netsh firewall' context.
help - Displays a list of commands.
http - Changes to the `netsh http' context.
interface - Changes to the `netsh interface' context.
ipsec - Changes to the `netsh ipsec' context.
lan - Changes to the `netsh lan' context.
mbn - Changes to the `netsh mbn' context.
namespace - Changes to the `netsh namespace' context.
netio - Changes to the `netsh netio' context.
p2p - Changes to the `netsh p2p' context.
ras - Changes to the `netsh ras' context.
rpc - Changes to the `netsh rpc' context.
set - Updates configuration settings.
show - Displays information.
trace - Changes to the `netsh trace' context.
wcn - Changes to the `netsh wcn' context.
wfp - Changes to the `netsh wfp' context.
winhttp - Changes to the `netsh winhttp' context.
winsock - Changes to the `netsh winsock' context.
wlan - Changes to the `netsh wlan' context.

The following sub-contexts are available:
 advfirewall branchcache bridge dhcpclient dnsclient firewall http interface ipsec lan mbn namespace netio p2p ras rpc trace wcn wfp winhttp winsock wlan

To view help for a command, type the command, followed by a space, and then
 type ?.

Return Code: 0

netstat

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP Netstat Command

netstat

C:\Windows\system32\NETSTAT.EXE /?

STDERR:


Displays protocol statistics and current TCP/IP network connections.

NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [-x] [-y] [interval]

 -a Displays all connections and listening ports.
 -b Displays the executable involved in creating each connection or
 listening port. In some cases well-known executables host
 multiple independent components, and in these cases the
 sequence of components involved in creating the connection
 or listening port is displayed. In this case the executable
 name is in [] at the bottom, on top is the component it called,
 and so forth until TCP/IP was reached. Note that this option
 can be time-consuming and will fail unless you have sufficient
 permissions.
 -e Displays Ethernet statistics. This may be combined with the -s
 option.
 -f Displays Fully Qualified Domain Names (FQDN) for foreign
 addresses.
 -n Displays addresses and port numbers in numerical form.
 -o Displays the owning process ID associated with each connection.
 -p proto Shows connections for the protocol specified by proto; proto
 may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
 option to display per-protocol statistics, proto may be any of:
 IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
 -q Displays all connections, listening ports, and bound
 nonlistening TCP ports. Bound nonlistening ports may or may not
 be associated with an active connection.
 -r Displays the routing table.
 -s Displays per-protocol statistics. By default, statistics are
 shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
 the -p option may be used to specify a subset of the default.
 -t Displays the current connection offload state.
 -x Displays NetworkDirect connections, listeners, and shared
 endpoints.
 -y Displays the TCP connection template for all connections.
 Cannot be combined with the other options.
 interval Redisplays selected statistics, pausing interval seconds
 between each display. Press CTRL+C to stop redisplaying
 statistics. If omitted, netstat will print the current
 configuration information once.

Return Code: 1

pathping

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP PathPing Command

pathping

C:\Windows\system32\PATHPING.EXE /?

Output:


Usage: pathping [-g host-list] [-h maximum_hops] [-i address] [-n]
 [-p period] [-q num_queries] [-w timeout]
 [-4] [-6] target_name

Options:
 -g host-list Loose source route along host-list.
 -h maximum_hops Maximum number of hops to search for target.
 -i address Use the specified source address.
 -n Do not resolve addresses to hostnames.
 -p period Wait period milliseconds between pings.
 -q num_queries Number of queries per hop.
 -w timeout Wait timeout milliseconds for each reply.
 -4 Force using IPv4.
 -6 Force using IPv6.

Return Code: 1

ping

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP Ping Command

ping

C:\Windows\system32\PING.EXE /?

Output:


Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
 [-r count] [-s count] [[-j host-list] | [-k host-list]]
 [-w timeout] [-R] [-S srcaddr] [-c compartment] [-p]
 [-4] [-6] target_name

Options:
 -t Ping the specified host until stopped.
 To see statistics and continue - type Control-Break;
 To stop - type Control-C.
 -a Resolve addresses to hostnames.
 -n count Number of echo requests to send.
 -l size Send buffer size.
 -f Set Don't Fragment flag in packet (IPv4-only).
 -i TTL Time To Live.
 -v TOS Type Of Service (IPv4-only. This setting has been deprecated
 and has no effect on the type of service field in the IP
 Header).
 -r count Record route for count hops (IPv4-only).
 -s count Timestamp for count hops (IPv4-only).
 -j host-list Loose source route along host-list (IPv4-only).
 -k host-list Strict source route along host-list (IPv4-only).
 -w timeout Timeout in milliseconds to wait for each reply.
 -R Use routing header to test reverse route also (IPv6-only).
 Per RFC 5095 the use of this routing header has been
 deprecated. Some systems may drop echo requests if
 this header is used.
 -S srcaddr Source address to use.
 -c compartment Routing compartment identifier.
 -p Ping a Hyper-V Network Virtualization provider address.
 -4 Force using IPv4.
 -6 Force using IPv6.

Return Code: 0

recover

Sat, 07 Dec 2019 09:09:13 +0000

Recover Files Utility

recover

C:\Windows\system32\recover.exe /?

Output:

Recovers readable information from a bad or defective disk.

RECOVER [drive:][path]filename
Consult the online Command Reference in Windows Help
before using the RECOVER command.

Return Code: 0

reg

Sat, 07 Dec 2019 09:09:13 +0000

Registry Console Tool

reg

C:\Windows\system32\reg.exe /?

Output:


REG Operation [Parameter List]

 Operation [ QUERY | ADD | DELETE | COPY |
 SAVE | LOAD | UNLOAD | RESTORE |
 COMPARE | EXPORT | IMPORT | FLAGS ]

Return Code: (Except for REG COMPARE)

 0 - Successful
 1 - Failed

For help on a specific operation type:

 REG Operation /?

Examples:

 REG QUERY /?
 REG ADD /?
 REG DELETE /?
 REG COPY /?
 REG SAVE /?
 REG RESTORE /?
 REG LOAD /?
 REG UNLOAD /?
 REG COMPARE /?
 REG EXPORT /?
 REG IMPORT /?
 REG FLAGS /?

Return Code: 0

route

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP Route Command

route

C:\Windows\system32\ROUTE.EXE /?

STDERR:


Manipulates network routing tables.

ROUTE [-f] [-p] [-4|-6] command [destination]
 [MASK netmask] [gateway] [METRIC metric] [IF interface]

 -f Clears the routing tables of all gateway entries. If this is
 used in conjunction with one of the commands, the tables are
 cleared prior to running the command.

 -p When used with the ADD command, makes a route persistent across
 boots of the system. By default, routes are not preserved
 when the system is restarted. Ignored for all other commands,
 which always affect the appropriate persistent routes.

 -4 Force using IPv4.

 -6 Force using IPv6.

 command One of these:
 PRINT Prints a route
 ADD Adds a route
 DELETE Deletes a route
 CHANGE Modifies an existing route
 destination Specifies the host.
 MASK Specifies that the next parameter is the 'netmask' value.
 netmask Specifies a subnet mask value for this route entry.
 If not specified, it defaults to 255.255.255.255.
 gateway Specifies gateway.
 interface the interface number for the specified route.
 METRIC specifies the metric, ie. cost for the destination.

All symbolic names used for destination are looked up in the network database
file NETWORKS. The symbolic names for gateway are looked up in the host name
database file HOSTS.

If the command is PRINT or DELETE. Destination or gateway can be a wildcard,
(wildcard is specified as a star '*'), or the gateway argument may be omitted.

If Dest contains a * or ?, it is treated as a shell pattern, and only
matching destination routes are printed. The '*' matches any string,
and '?' matches any one char. Examples: 157.*.1, 157.*, 127.*, *224*.

Pattern match is only allowed in PRINT command.
Diagnostic Notes:
 Invalid MASK generates an error, that is when (DEST & MASK) != DEST.
 Example> route ADD 157.0.0.0 MASK 155.0.0.0 157.55.80.1 IF 1
 The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination.

Examples:

 > route PRINT
 > route PRINT -4
 > route PRINT -6
 > route PRINT 157* .... Only prints those matching 157*

 > route ADD 157.0.0.0 MASK 255.0.0.0 157.55.80.1 METRIC 3 IF 2
 destination^  ^mask ^gateway metric^  ^
  Interface^
  If IF is not given, it tries to find the best interface for a given
 gateway.
 > route ADD 3ffe::/32 3ffe::1

 > route CHANGE 157.0.0.0 MASK 255.0.0.0 157.55.80.5 METRIC 2 IF 2

 CHANGE is used to modify gateway and/or metric only.

 > route DELETE 157.0.0.0
 > route DELETE 3ffe::/32

Return Code: 1

sc

Sat, 07 Dec 2019 09:09:13 +0000

Service Control Manager Configuration Tool

sc

C:\Windows\system32\sc.exe

Output:

DESCRIPTION:
 SC is a command line program used for communicating with the
 Service Control Manager and services.
USAGE:
 sc <server> [command] [service name] <option1> <option2>...


 The option <server> has the form "\\ServerName"
 Further help on commands can be obtained by typing: "sc [command]"
 Commands:
 query-----------Queries the status for a service, or
 enumerates the status for types of services.
 queryex---------Queries the extended status for a service, or
 enumerates the status for types of services.
 start-----------Starts a service.
 pause-----------Sends a PAUSE control request to a service.
 interrogate-----Sends an INTERROGATE control request to a service.
 continue--------Sends a CONTINUE control request to a service.
 stop------------Sends a STOP request to a service.
 config----------Changes the configuration of a service (persistent).
 description-----Changes the description of a service.
 failure---------Changes the actions taken by a service upon failure.
 failureflag-----Changes the failure actions flag of a service.
 sidtype---------Changes the service SID type of a service.
 privs-----------Changes the required privileges of a service.
 managedaccount--Changes the service to mark the service account
 password as managed by LSA.
 qc--------------Queries the configuration information for a service.
 qdescription----Queries the description for a service.
 qfailure--------Queries the actions taken by a service upon failure.
 qfailureflag----Queries the failure actions flag of a service.
 qsidtype--------Queries the service SID type of a service.
 qprivs----------Queries the required privileges of a service.
 qtriggerinfo----Queries the trigger parameters of a service.
 qpreferrednode--Queries the preferred NUMA node of a service.
 qmanagedaccount-Queries whether a services uses an account with a
 password managed by LSA.
 qprotection-----Queries the process protection level of a service.
 quserservice----Queries for a local instance of a user service template.
 delete----------Deletes a service (from the registry).
 create----------Creates a service. (adds it to the registry).
 control---------Sends a control to a service.
 sdshow----------Displays a service's security descriptor.
 sdset-----------Sets a service's security descriptor.
 showsid---------Displays the service SID string corresponding to an arbitrary name.
 triggerinfo-----Configures the trigger parameters of a service.
 preferrednode---Sets the preferred NUMA node of a service.
 GetDisplayName--Gets the DisplayName for a service.
 GetKeyName------Gets the ServiceKeyName for a service.
 EnumDepend------Enumerates Service Dependencies.

 The following commands don't require a service name:
 sc <server> <command> <option>
 boot------------(ok | bad) Indicates whether the last boot should
 be saved as the last-known-good boot configuration
 Lock------------Locks the Service Database
 QueryLock-------Queries the LockStatus for the SCManager Database
EXAMPLE:
 sc start MyService


QUERY and QUERYEX OPTIONS:
 If the query command is followed by a service name, the status
 for that service is returned. Further options do not apply in
 this case. If the query command is followed by nothing or one of
 the options listed below, the services are enumerated.
 type= Type of services to enumerate (driver, service, userservice, all)
 (default = service)
 state= State of services to enumerate (inactive, all)
 (default = active)
 bufsize= The size (in bytes) of the enumeration buffer
 (default = 4096)
 ri= The resume index number at which to begin the enumeration
 (default = 0)
 group= Service group to enumerate
 (default = all groups)

SYNTAX EXAMPLES
sc query - Enumerates status for active services & drivers
sc query eventlog - Displays status for the eventlog service
sc queryex eventlog - Displays extended status for the eventlog service
sc query type= driver - Enumerates only active drivers
sc query type= service - Enumerates only Win32 services
sc query state= all - Enumerates all services & drivers
sc query bufsize= 50 - Enumerates with a 50 byte buffer
sc query ri= 14 - Enumerates with resume index = 14
sc queryex group= "" - Enumerates active services not in a group
sc query type= interact - Enumerates all interactive services
sc query type= driver group= NDIS - Enumerates all NDIS drivers

Return Code: 1639

setx

Sat, 07 Dec 2019 09:09:13 +0000

Setx - Sets environment variables

setx

C:\Windows\system32\setx.exe /?

Output:


SetX has three ways of working:

Syntax 1:
 SETX [/S system [/U [domain\]user [/P [password]]]] var value [/M]

Syntax 2:
 SETX [/S system [/U [domain\]user [/P [password]]]] var /K regpath [/M]

Syntax 3:
 SETX [/S system [/U [domain\]user [/P [password]]]]
 /F file {var {/A x,y | /R x,y string}[/M] | /X} [/D delimiters]

Description:
 Creates or modifies environment variables in the user or system
 environment. Can set variables based on arguments, regkeys or
 file input.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under which
 the command should execute.

 /P [password] Specifies the password for the given
 user context. Prompts for input if omitted.

 var Specifies the environment variable to set.

 value Specifies a value to be assigned to the
 environment variable.

 /K regpath Specifies that the variable is set based
 on information from a registry key.
 Path should be specified in the format of
 hive\key\...\value. For example,
 HKEY_LOCAL_MACHINE\System\CurrentControlSet\
 Control\TimeZoneInformation\StandardName.

 /F file Specifies the filename of the text file
 to use.

 /A x,y Specifies absolute file coordinates
 (line X, item Y) as parameters to search
 within the file.

 /R x,y string Specifies relative file coordinates with
 respect to "string" as the search parameters.

 /M Specifies that the variable should be set in
 the system wide (HKEY_LOCAL_MACHINE)
 environment. The default is to set the
 variable under the HKEY_CURRENT_USER
 environment.

 /X Displays file contents with x,y coordinates.

 /D delimiters Specifies additional delimiters such as ","
 or "\". The built-in delimiters are space,
 tab, carriage return, and linefeed. Any
 ASCII character can be used as an additional
 delimiter. The maximum number of delimiters,
 including the built-in delimiters, is 15.

 /? Displays this help message.

NOTE: 1) SETX writes variables to the master environment in the registry.

 2) On a local system, variables created or modified by this tool
 will be available in future command windows but not in the
 current CMD.exe command window.

 3) On a remote system, variables created or modified by this tool
 will be available at the next logon session.

 4) The valid Registry Key data types are REG_DWORD, REG_EXPAND_SZ,
 REG_SZ, REG_MULTI_SZ.

 5) Supported hives: HKEY_LOCAL_MACHINE (HKLM),
 HKEY_CURRENT_USER (HKCU).

 6) Delimiters are case sensitive.

 7) REG_DWORD values are extracted from the registry in decimal
 format.

Examples:
 SETX MACHINE COMPAQ
 SETX MACHINE "COMPAQ COMPUTER" /M
 SETX MYPATH "%PATH%"
 SETX MYPATH ~PATH~
 SETX /S system /U user /P password MACHINE COMPAQ
 SETX /S system /U user /P password MYPATH ^%PATH^%
 SETX TZONE /K HKEY_LOCAL_MACHINE\System\CurrentControlSet\
 Control\TimeZoneInformation\StandardName
 SETX BUILD /K "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
 NT\CurrentVersion\CurrentBuildNumber" /M
 SETX /S system /U user /P password TZONE /K HKEY_LOCAL_MACHINE\
 System\CurrentControlSet\Control\TimeZoneInformation\
 StandardName
 SETX /S system /U user /P password BUILD /K
 "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
 CurrentVersion\CurrentBuildNumber" /M
 SETX /F ipconfig.out /X
 SETX IPADDR /F ipconfig.out /A 5,11
 SETX OCTET1 /F ipconfig.out /A 5,3 /D "#$*."
 SETX IPGATEWAY /F ipconfig.out /R 0,7 Gateway
 SETX /S system /U user /P password /F c:\ipconfig.out /X

Return Code: 0

sort

Sat, 07 Dec 2019 09:09:13 +0000

Sort Utility

sort

C:\Windows\system32\sort.exe /?

Output:

SORT [/R] [/+n] [/M kilobytes] [/L locale] [/REC recordbytes]
 [[drive1:][path1]filename1] [/T [drive2:][path2]]
 [/O [drive3:][path3]filename3]
 /+n Specifies the character number, n, to
 begin each comparison. /+3 indicates that
 each comparison should begin at the 3rd
 character in each line. Lines with fewer
 than n characters collate before other lines.
 By default comparisons start at the first
 character in each line.
 /L[OCALE] locale Overrides the system default locale with
 the specified one. The ""C"" locale yields
 the fastest collating sequence and is
 currently the only alternative. The sort
 is always case insensitive.
 /M[EMORY] kilobytes Specifies amount of main memory to use for
 the sort, in kilobytes. The memory size is
 always constrained to be a minimum of 160
 kilobytes. If the memory size is specified
 the exact amount will be used for the sort,
 regardless of how much main memory is
 available.

 The best performance is usually achieved by
 not specifying a memory size. By default the
 sort will be done with one pass (no temporary
 file) if it fits in the default maximum
 memory size, otherwise the sort will be done
 in two passes (with the partially sorted data
 being stored in a temporary file) such that
 the amounts of memory used for both the sort
 and merge passes are equal. The default
 maximum memory size is 90% of available main
 memory if both the input and output are
 files, and 45% of main memory otherwise.
 /REC[ORD_MAXIMUM] characters Specifies the maximum number of characters
 in a record (default 4096, maximum 65535).
 /R[EVERSE] Reverses the sort order; that is,
 sorts Z to A, then 9 to 0.
 [drive1:][path1]filename1 Specifies the file to be sorted. If not
 specified, the standard input is sorted.
 Specifying the input file is faster than
 redirecting the same file as standard input.
 /T[EMPORARY]
 [drive2:][path2] Specifies the path of the directory to hold
 the sort's working storage, in case the data
 does not fit in main memory. The default is
 to use the system temporary directory.
 /O[UTPUT]
 [drive3:][path3]filename3 Specifies the file where the sorted input is
 to be stored. If not specified, the data is
 written to the standard output. Specifying
 the output file is faster than redirecting
 standard output to the same file.

Return Code: 0

tracert

Sat, 07 Dec 2019 09:09:13 +0000

TCP/IP Traceroute Command

tracert

C:\Windows\system32\TRACERT.EXE /?

Output:


Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout]
 [-R] [-S srcaddr] [-4] [-6] target_name

Options:
 -d Do not resolve addresses to hostnames.
 -h maximum_hops Maximum number of hops to search for target.
 -j host-list Loose source route along host-list (IPv4-only).
 -w timeout Wait timeout milliseconds for each reply.
 -R Trace round-trip path (IPv6-only).
 -S srcaddr Source address to use (IPv6-only).
 -4 Force using IPv4.
 -6 Force using IPv6.

Return Code: 1

xcopy

Sat, 07 Dec 2019 09:09:13 +0000

Extended Copy Utility

xcopy

C:\Windows\system32\xcopy.exe /?

Output:

Copies files and directory trees.

XCOPY source [destination] [/A | /M] [/D[:date]] [/P] [/S [/E]] [/V] [/W]
 [/C] [/I] [/Q] [/F] [/L] [/G] [/H] [/R] [/T] [/U]
 [/K] [/N] [/O] [/X] [/Y] [/-Y] [/Z] [/B] [/J]
 [/EXCLUDE:file1[+file2][+file3]...] [/COMPRESS]

 source Specifies the file(s) to copy.
 destination Specifies the location and/or name of new files.
 /A Copies only files with the archive attribute set,
 doesn't change the attribute.
 /M Copies only files with the archive attribute set,
 turns off the archive attribute.
 /D:m-d-y Copies files changed on or after the specified date.
 If no date is given, copies only those files whose
 source time is newer than the destination time.
 /EXCLUDE:file1[+file2][+file3]...
 Specifies a list of files containing strings. Each string
 should be in a separate line in the files. When any of the
 strings match any part of the absolute path of the file to be
 copied, that file will be excluded from being copied. For
 example, specifying a string like \obj\ or .obj will exclude
 all files underneath the directory obj or all files with the
 .obj extension respectively.
 /P Prompts you before creating each destination file.
 /S Copies directories and subdirectories except empty ones.
 /E Copies directories and subdirectories, including empty ones.
 Same as /S /E. May be used to modify /T.
 /V Verifies the size of each new file.
 /W Prompts you to press a key before copying.
 /C Continues copying even if errors occur.
 /I If destination does not exist and copying more than one file,
 assumes that destination must be a directory.
 /Q Does not display file names while copying.
 /F Displays full source and destination file names while copying.
 /L Displays files that would be copied.
 /G Allows the copying of encrypted files to destination that does
 not support encryption.
 /H Copies hidden and system files also.
 /R Overwrites read-only files.
 /T Creates directory structure, but does not copy files. Does not
 include empty directories or subdirectories. /T /E includes
 empty directories and subdirectories.
 /U Copies only files that already exist in destination.
 /K Copies attributes. Normal Xcopy will reset read-only attributes.
 /N Copies using the generated short names.
 /O Copies file ownership and ACL information.
 /X Copies file audit settings (implies /O).
 /Y Suppresses prompting to confirm you want to overwrite an
 existing destination file.
 /-Y Causes prompting to confirm you want to overwrite an
 existing destination file.
 /Z Copies networked files in restartable mode.
 /B Copies the Symbolic Link itself versus the target of the link.
 /J Copies using unbuffered I/O. Recommended for very large files.
 /COMPRESS Request network compression during file transfer where
 applicable.

The switch /Y may be preset in the COPYCMD environment variable.
This may be overridden with /-Y on the command line.

Return Code: 0

cmdkey

Sat, 07 Dec 2019 09:08:49 +0000

Credential Manager Command Line Utility

cmdkey

C:\Windows\system32\cmdkey.exe /?

Output:


Creates, displays, and deletes stored user names and passwords.

The syntax of this command is:

CMDKEY [{/add | /generic}:targetname {/smartcard | /user:username {/pass{:password}}} | /delete{:targetname | /ras} | /list{:targetname}]

Examples:

 To list available credentials:
 cmdkey /list
 cmdkey /list:targetname

 To create domain credentials:
 cmdkey /add:targetname /user:username /pass:password
 cmdkey /add:targetname /user:username /pass
 cmdkey /add:targetname /user:username
 cmdkey /add:targetname /smartcard

 To create generic credentials:
 The /add switch may be replaced by /generic to create generic credentials

 To delete existing credentials:
 cmdkey /delete:targetname

 To delete RAS credentials:
 cmdkey /delete /ras

Return Code: 1

tpmvscmgr

Sat, 07 Dec 2019 09:08:49 +0000

TPM Virtual Smartcard Setup Utility

tpmvscmgr

C:\Windows\system32\tpmvscmgr.exe /?

STDERR:

TpmVscMgr.exe

 Commands:
 create
 [/quiet]
 /name <name>
 /adminkey 'PROMPT'|'DEFAULT'|'RANDOM'
 [/puk 'PROMPT'|'DEFAULT']
 /pin 'PROMPT'|'DEFAULT'
 [/generate]
 [/machine <machine name>]
 [/pinpolicy [policy options]]
 policy options:
 minlen <minimum PIN length>
 maxlen <maximum PIN length>
 uppercase 'ALLOWED'|'DISALLOWED'|'REQUIRED'
 lowercase 'ALLOWED'|'DISALLOWED'|'REQUIRED'
 digits 'ALLOWED'|'DISALLOWED'|'REQUIRED'
 specialchars 'ALLOWED'|'DISALLOWED'|'REQUIRED'
 [/attestation 'AIK_AND_CERT'|'AIK_ONLY']

 destroy
 [/quiet]
 /instance <device instance ID>
 [/machine <machine name>]

 Legend:
 'PROMPT' => prompt for parameter
 'DEFAULT' => default value for parameter
 'RANDOM' => generate a random value
 'ALLOWED' => these characters are allowed
 'DISALLOWED' => these characters are not
 allowed
 'REQUIRED' => at least one such character
 is required
 'AIK_AND_CERT' => Creates an AIK and obtains
 an AIK certificate from the cloud CA
 'AIK_ONLY' => Creates an AIK but
 does not obtain an AIK certificate

 Note:
 The generate command formats the TPM
 virtual smart card so that it can be used
 to enroll for certificates. If this option
 is not specified, a card management
 system/tool will need to be used to format
 the card before first use.

 Note:
 /pinpolicy may only be used in conjunction
 with /pin prompt.

 Note:
 The default PIN policy options are as
 follows:
 minlen 8
 maxlen 127
 uppercase allowed
 lowercase allowed
 digits allowed
 specialchars allowed

 The lower and upper bounds on PIN length
 are 4 and 127, respectively. When using
 /pinpolicy, PIN characters must be
 printable ASCII characters.

 Note:
 If '/attestation AIK_AND_CERT' is specified, it
 is possible that VSC creation will fail if
 there is no network connectivity.
 Examples:
 Create a TPM virtual smart card with default value for
 PIN and a random admin key with no attestation:

 TpmVscMgr create /name MyVSC /pin default /adminkey random /generate

 Create a TPM virtual smart card with default value for
 admin key and a specified PIN policy and attestation method:

 TpmVscMgr create /name MyVSC /pin prompt /pinpolicy minlen 4 maxlen 8
 /adminkey default /attestation AIK_AND_CERT /generate

 Destroy a TPM virtual smart card using the instance ID
 that was returned when the card was created:

 TpmVscMgr destroy /instance root\smartcardreader\0000

Return Code: 0

cmstp

Sat, 07 Dec 2019 09:08:46 +0000

Microsoft Connection Manager Profile Installer

cmstp

C:\Windows\system32\cmstp.exe /?

Output:

---------------------------
Connection Manager Profile Installer
---------------------------
Modes:

Profile Install -- cmstp.exe [/ni /ns /nf /s /su /sd /au] <Full Path to Profile Inf>
Profile Uninstall -- cmstp.exe /u [/s] <Full Path to Profile Inf>
Help -- cmstp.exe /?

Long Paths to Inf Files must be enclosed in double quotes (").


Install Modifiers:

/ns No Desktop Shortcut
/nf Skip Support File Dependency Check
/s Silent Install
/su Single User Install
/sd Set this connection as the IE default connection
/au All User Install (Administrators only)

Uninstall Modifiers:

/s No Uninstall Confirmation Prompt

Please see the Connection Manager Administration Kit documentation for
further details about the usage of cmstp.exe.
---------------------------
OK
---------------------------

Return Code: 1

driverquery

Sat, 07 Dec 2019 09:08:46 +0000

Queries the drivers on a system

driverquery

C:\Windows\system32\driverquery.exe /?

Output:


DRIVERQUERY [/S system [/U username [/P [password]]]]
 [/FO format] [/NH] [/SI] [/V]
Description:
 Enables an administrator to display a list of
 installed device drivers.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context
 under which the command should execute.

 /P [password] Specify the password for the given
 user context.

 /FO format Specifies the type of output to display.
 Valid values to be passed with the
 switch are "TABLE", "LIST", "CSV".

 /NH Specifies that the "Column Header"
 should not be displayed. Valid for
 "TABLE" and "CSV" format only.

 /SI Provides information about signed drivers.

 /V Displays verbose output. Not valid
 for signed drivers.

 /? Displays this help message.

Examples:
 DRIVERQUERY
 DRIVERQUERY /FO CSV /SI
 DRIVERQUERY /NH
 DRIVERQUERY /S ipaddress /U user /V
 DRIVERQUERY /S system /U domain\user /P password /FO LIST

Return Code: 0

powercfg

Sat, 07 Dec 2019 09:08:46 +0000

Power Settings Command-Line Tool

powercfg

C:\Windows\system32\powercfg.exe /?

Output:


POWERCFG /COMMAND [ARGUMENTS]

Description:
 Enables users to control power settings on a local system.

 For detailed command and option information, run "POWERCFG /? <COMMAND>"

Command List:
 /LIST, /L Lists all power schemes.

 /QUERY, /Q Displays the contents of a power scheme.

 /CHANGE, /X Modifies a setting value in the current power scheme.

 /CHANGENAME Modifies the name and description of a power scheme.

 /DUPLICATESCHEME Duplicates a power scheme.

 /DELETE, /D Deletes a power scheme.

 /DELETESETTING Deletes a power setting.

 /SETACTIVE, /S Makes a power scheme active on the system.

 /GETACTIVESCHEME Retrieves the currently active power scheme.

 /SETACVALUEINDEX Sets the value associated with a power setting
 while the system is powered by AC power.

 /SETDCVALUEINDEX Sets the value associated with a power setting
 while the system is powered by DC power.

 /IMPORT Imports all power settings from a file.

 /EXPORT Exports a power scheme to a file.

 /ALIASES Displays all aliases and their corresponding GUIDs.

 /GETSECURITYDESCRIPTOR
 Gets a security descriptor associated with a specified
 power setting, power scheme, or action.

 /SETSECURITYDESCRIPTOR
 Sets a security descriptor associated with a
 power setting, power scheme, or action.

 /HIBERNATE, /H Enables and disables the hibernate feature.

 /AVAILABLESLEEPSTATES, /A
 Reports the sleep states available on the system.

 /DEVICEQUERY Returns a list of devices that meet specified criteria.

 /DEVICEENABLEWAKE Enables a device to wake the system from a sleep state.

 /DEVICEDISABLEWAKE Disables a device from waking the system from a sleep
 state.

 /LASTWAKE Reports information about what woke the system from the
 last sleep transition.

 /WAKETIMERS Enumerates active wake timers.

 /REQUESTS Enumerates application and driver Power Requests.

 /REQUESTSOVERRIDE Sets a Power Request override for a particular Process,
 Service, or Driver.

 /ENERGY Analyzes the system for common energy-efficiency and
 battery life problems.

 /BATTERYREPORT Generates a report of battery usage.

 /SLEEPSTUDY Generates a diagnostic system power transition report.

 /SRUMUTIL Dumps Energy Estimation data from System Resource Usage
 Monitor (SRUM).

 /SYSTEMSLEEPDIAGNOSTICS
 Generates a diagnostic report of system sleep transitions.

 /SYSTEMPOWERREPORT Generates a diagnostic system power transition report.

 /POWERTHROTTLING Control power throttling for an application.

Return Code: 0

rasphone

Sat, 07 Dec 2019 09:08:46 +0000

Remote Access Phonebook

rasphone

C:\Windows\system32\rasphone.exe /?

Output:

---------------------------
Dial-Up Networking Command Line
---------------------------
rasphone.exe [-f file] [[-e | -d | -h | -r] entry]
rasphone.exe [-f file] -a [entry]
rasphone.exe [-f file] -lx link
rasphone.exe

-a Popup new entry dialogs
-e Popup edit entry dialogs
-d Popup dial entry dialogs
-h Quietly hang up the entry
-r Quietly delete the entry
-lx Execute command 'x' on dial-up shortcut file
x Any of the commands a, e, d, h, or r
entry The entry name to which the operation applies
file The full path to the phonebook file
link The full path to the dial-up shortcut file

'entry' alone selects the entry in the phonebook dialog
---------------------------
OK
---------------------------

Return Code: 1

rmclient

Sat, 07 Dec 2019 09:08:46 +0000

Restart Manager LUA Restart Client

rmclient

C:\Windows\system32\RmClient.exe /?

Output:


 RmClient.exe pipename

Return Code: 3489398788

secedit

Sat, 07 Dec 2019 09:08:46 +0000

Windows Security Configuration Editor Command Tool

secedit

C:\Windows\system32\SecEdit.exe /?

Output:


The syntax of this command is:

secedit [/configure | /analyze | /import | /export | /validate | /generaterollback]

Return Code: 0

secedit

C:\Windows\system32\SecEdit.exe /analyze

Output:


Allows you to analyze current systems settings against baseline settings that are stored in a database. The analysis results are stored in a separate area of the database and can be viewed in the Security Configuration and Analysis snap-in.

The syntax of this command is:

secedit /analyze /db filename [/cfg filename ] [/overwrite] [/log filename] [/quiet]

 /db filename - Specifies the database used to perform the analysis.

 /cfg filename - Specifies a security template to import into the database prior to performing the analysis. Security templates are created using the Security Templates snap-in.

 /log filename - Specifies a file in which to log the status of the configuration process. If not specified, configuration processing information is logged in the scesrv.log file which is located in the s%windir%\security\logs directory.

 /quiet - Specifies that the analysis process should take place without prompting the user for any confirmation.

Example:

secedit /analyze /db hisecws.sdb

For all filenames, the current directory is used if no path is specified.

Return Code: 1

getmac

Sat, 07 Dec 2019 09:08:44 +0000

Displays NIC MAC information

getmac

C:\Windows\system32\getmac.exe /?

Output:


GETMAC [/S system [/U username [/P [password]]]] [/FO format] [/NH] [/V]

Description:
 This tool enables an administrator to display the MAC address
 for network adapters on a system.

Parameter List:
 /S system Specifies the remote system to connect to.

 /U [domain\]user Specifies the user context under
 which the command should execute.

 /P [password] Specifies the password for the given
 user context. Prompts for input if omitted.

 /FO format Specifies the format in which the output
 is to be displayed.
 Valid values: "TABLE", "LIST", "CSV".

 /NH Specifies that the "Column Header" should
 not be displayed in the output.
 Valid only for TABLE and CSV formats.

 /V Specifies that verbose output is displayed.

 /? Displays this help message.

Examples:
 GETMAC /?
 GETMAC /FO csv
 GETMAC /S system /NH /V
 GETMAC /S system /U user
 GETMAC /S system /U domain\user /P password /FO list /V
 GETMAC /S system /U domain\user /P password /FO table /NH

Return Code: 0

nbtstat

Sat, 07 Dec 2019 09:08:44 +0000

TCP/IP NetBios Information

nbtstat

C:\Windows\system32\nbtstat.exe /?

STDERR:


Displays protocol statistics and current TCP/IP connections using NBT
(NetBIOS over TCP/IP).

NBTSTAT [ [-a RemoteName] [-A IP address] [-c] [-n]
 [-r] [-R] [-RR] [-s] [-S] [interval] ]

 -a (adapter status) Lists the remote machine's name table given its name
 -A (Adapter status) Lists the remote machine's name table given its
 IP address.
 -c (cache) Lists NBT's cache of remote [machine] names and their IP addresses
 -n (names) Lists local NetBIOS names.
 -r (resolved) Lists names resolved by broadcast and via WINS
 -R (Reload) Purges and reloads the remote cache name table
 -S (Sessions) Lists sessions table with the destination IP addresses
 -s (sessions) Lists sessions table converting destination IP
 addresses to computer NETBIOS names.
 -RR (ReleaseRefresh) Sends Name Release packets to WINS and then, starts Refresh

 RemoteName Remote host machine name.
 IP address Dotted decimal representation of the IP address.
 interval Redisplays selected statistics, pausing interval seconds
 between each display. Press Ctrl+C to stop redisplaying
 statistics.

Return Code: 2

nbtstat

C:\Windows\system32\nbtstat.exe –help

STDERR:


Displays protocol statistics and current TCP/IP connections using NBT
(NetBIOS over TCP/IP).

NBTSTAT [ [-a RemoteName] [-A IP address] [-c] [-n]
 [-r] [-R] [-RR] [-s] [-S] [interval] ]

 -a (adapter status) Lists the remote machine's name table given its name
 -A (Adapter status) Lists the remote machine's name table given its
 IP address.
 -c (cache) Lists NBT's cache of remote [machine] names and their IP addresses
 -n (names) Lists local NetBIOS names.
 -r (resolved) Lists names resolved by broadcast and via WINS
 -R (Reload) Purges and reloads the remote cache name table
 -S (Sessions) Lists sessions table with the destination IP addresses
 -s (sessions) Lists sessions table converting destination IP
 addresses to computer NETBIOS names.
 -RR (ReleaseRefresh) Sends Name Release packets to WINS and then, starts Refresh

 RemoteName Remote host machine name.
 IP address Dotted decimal representation of the IP address.
 interval Redisplays selected statistics, pausing interval seconds
 between each display. Press Ctrl+C to stop redisplaying
 statistics.

Return Code: 2

at

Sat, 07 Dec 2019 09:08:39 +0000

Schedule service command line interface

at

C:\Windows\system32\at.exe /?

Output:

The AT command has been deprecated. Please use schtasks.exe instead.

The AT command schedules commands and programs to run on a computer at
a specified time and date. The Schedule service must be running to use
the AT command.

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
 [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

\\computername Specifies a remote computer. Commands are scheduled on the
 local computer if this parameter is omitted.
id Is an identification number assigned to a scheduled
 command.
/delete Cancels a scheduled command. If id is omitted, all the
 scheduled commands on the computer are canceled.
/yes Used with cancel all jobs command when no further
 confirmation is desired.
time Specifies the time when command is to run.
/interactive Allows the job to interact with the desktop of the user
 who is logged on at the time the job runs.
/every:date[,...] Runs the command on each specified day(s) of the week or
 month. If date is omitted, the current day of the month
 is assumed.
/next:date[,...] Runs the specified command on the next occurrence of the
 day (for example, next Thursday). If date is omitted, the
 current day of the month is assumed.
"command" Is the Windows NT command, or batch program to be run.

Return Code: 0

netcfg

Sat, 07 Dec 2019 09:08:33 +0000

WinPE network installer

netcfg

C:\Windows\system32\netcfg.exe /?

Output:

netcfg [-v] [-winpe] [-l <full-path-to-component-INF>] -c <p|s|c>
 -i <comp-id>

 -winpe installs TCP/IP, NetBIOS and Microsoft Client for Windows
 preinstallation environment
 -l provides the location of INF
 -c provides the class of the component to be installed (p == Protocol,
 s == Service, c == Client)
 -i provides the component ID

 The arguments must be passed in the order shown.

 Examples:

 netcfg -l c:\oemdir\myprot.inf -c p -i myprot

 Installs protocol 'myprot' using c:\oemdir\myprot.inf

 netcfg -c s -i MS_Server

 Installs service 'MS_Server'

OR

netcfg [-v] -winpe

 Example:

 netcfg -v -winpe

 Installs TCP/IP, NetBIOS, and Microsoft Client for Windows
 preinstallation environment

OR

netcfg [-v] -q <comp-id>

 Example:

 netcfg -q MS_IPX

 Displays if component 'MS_IPX' is installed

OR

netcfg [-v] -u <comp-id>

 Example:

 netcfg -u MS_IPX

 Uninstalls component 'MS_IPX'

OR

netcfg [-v] -s <a|n>

 -s provides the type of components to show (a == adapters,
 n == net components)

 Example:

 netcfg -s n

 Shows all installed net components

OR

netcfg [-v] -b <comp-id>

 Example:

 netcfg -b ms_tcpip

 Shows binding paths containing 'MS_TCPIP'

OR

netcfg [-v] -m

 Example:

 netcfg -m

 Outputs the binding map to NetworkBindingMap.txt in the current directory.
 -v will also display the binding map to the console.

OR

netcfg -d

 Example:

 netcfg -d

 Performs a cleanup on all networking devices.
 This will require a reboot.

OR

netcfg -x

 Example:

 netcfg -x

 Performs a cleanup on networking devices, skipping those without physical
 object names.
 This will require a reboot.

General Notes:
 -v Run in verbose (detailed) mode
 -? Displays this help information

Return Code: 0

shutdown

Sat, 07 Dec 2019 09:08:33 +0000

Windows Shutdown and Annotation Tool

shutdown

C:\Windows\system32\shutdown.exe /?

Output:

Usage: C:\Windows\system32\shutdown.exe [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft] [/fw] [/f]
 [/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]

 No args Display help. This is the same as typing /?.
 /? Display help. This is the same as not typing any options.
 /i Display the graphical user interface (GUI).
 This must be the first option.
 /l Log off. This cannot be used with /m or /d options.
 /s Shutdown the computer.
 /sg Shutdown the computer. On the next boot, if Automatic Restart Sign-On
 is enabled, automatically sign in and lock last interactive user.
 After sign in, restart any registered applications.
 /r Full shutdown and restart the computer.
 /g Full shutdown and restart the computer. After the system is rebooted,
 if Automatic Restart Sign-On is enabled, automatically sign in and
 lock last interactive user.
 After sign in, restart any registered applications.
 /a Abort a system shutdown.
 This can only be used during the time-out period.
 Combine with /fw to clear any pending boots to firmware.
 /p Turn off the local computer with no time-out or warning.
 Can be used with /d and /f options.
 /h Hibernate the local computer.
 Can be used with the /f option.
 /hybrid Performs a shutdown of the computer and prepares it for fast startup.
 Must be used with /s option.
 /fw Combine with a shutdown option to cause the next boot to go to the
 firmware user interface.
 /e Document the reason for an unexpected shutdown of a computer.
 /o Go to the advanced boot options menu and restart the computer.
 Must be used with /r option.
 /m \\computer Specify the target computer.
 /t xxx Set the time-out period before shutdown to xxx seconds.
 The valid range is 0-315360000 (10 years), with a default of 30.
 If the timeout period is greater than 0, the /f parameter is
 implied.
 /c "comment" Comment on the reason for the restart or shutdown.
 Maximum of 512 characters allowed.
 /f Force running applications to close without forewarning users.
 The /f parameter is implied when a value greater than 0 is
 specified for the /t parameter.
 /d [p|u:]xx:yy Provide the reason for the restart or shutdown.
 p indicates that the restart or shutdown is planned.
 u indicates that the reason is user defined.
 If neither p nor u is specified the restart or shutdown is
 unplanned.
 xx is the major reason number (positive integer less than 256).
 yy is the minor reason number (positive integer less than 65536).

Reasons on this computer:
(E = Expected U = Unexpected P = planned, C = customer defined)
Type Major Minor Title

 U 0 0 Other (Unplanned)
E 0 0 Other (Unplanned)
E P 0 0 Other (Planned)
 U 0 5 Other Failure: System Unresponsive
E 1 1 Hardware: Maintenance (Unplanned)
E P 1 1 Hardware: Maintenance (Planned)
E 1 2 Hardware: Installation (Unplanned)
E P 1 2 Hardware: Installation (Planned)
E 2 2 Operating System: Recovery (Unplanned)
E P 2 2 Operating System: Recovery (Planned)
 P 2 3 Operating System: Upgrade (Planned)
E 2 4 Operating System: Reconfiguration (Unplanned)
E P 2 4 Operating System: Reconfiguration (Planned)
 P 2 16 Operating System: Service pack (Planned)
 2 17 Operating System: Hot fix (Unplanned)
 P 2 17 Operating System: Hot fix (Planned)
 2 18 Operating System: Security fix (Unplanned)
 P 2 18 Operating System: Security fix (Planned)
E 4 1 Application: Maintenance (Unplanned)
E P 4 1 Application: Maintenance (Planned)
E P 4 2 Application: Installation (Planned)
E 4 5 Application: Unresponsive
E 4 6 Application: Unstable
 U 5 15 System Failure: Stop error
 U 5 19 Security issue (Unplanned)
E 5 19 Security issue (Unplanned)
E P 5 19 Security issue (Planned)
E 5 20 Loss of network connectivity (Unplanned)
 U 6 11 Power Failure: Cord Unplugged
 U 6 12 Power Failure: Environment
 P 7 0 Legacy API shutdown

Return Code: 1

cipher

Sat, 07 Dec 2019 09:08:32 +0000

File Encryption Utility

cipher

C:\Windows\system32\cipher.exe /?

Output:

Displays or alters the encryption of directories [files] on NTFS partitions.

 CIPHER [/E | /D | /C]
 [/S:directory] [/B] [/H] [pathname [...]]

 CIPHER /K [/ECC:256|384|521]

 CIPHER /R:filename [/SMARTCARD] [/ECC:256|384|521]

 CIPHER /P:filename.cer

 CIPHER /U [/N]

 CIPHER /W:directory

 CIPHER /X[:efsfile] [filename]

 CIPHER /Y

 CIPHER /ADDUSER [/CERTHASH:hash | /CERTFILE:filename | /USER:username]
 [/S:directory] [/B] [/H] [pathname [...]]

 CIPHER /FLUSHCACHE [/SERVER:servername]

 CIPHER /REMOVEUSER /CERTHASH:hash
 [/S:directory] [/B] [/H] [pathname [...]]

 CIPHER /REKEY [pathname [...]]

 /B Abort if an error is encountered. By default, CIPHER continues
 executing even if errors are encountered.
 /C Displays information on the encrypted file.
 /D Decrypts the specified files or directories.
 /E Encrypts the specified files or directories. Directories will be
 marked so that files added afterward will be encrypted. The
 encrypted file could become decrypted when it is modified if the
 parent directory is not encrypted. It is recommended that you
 encrypt the file and the parent directory.
 /H Displays files with the hidden or system attributes. These files
 are omitted by default.
 /K Creates a new certificate and key for use with EFS. If this
 option is chosen, all the other options will be ignored.

 Note: By default, /K creates a certificate and key that conform
 to current group policy. If ECC is specified, a self-signed
 certificate will be created with the supplied key size.

 /N This option only works with /U. This will prevent keys being
 updated. This is used to find all the encrypted files on the
 local drives.
 /R Generates an EFS recovery key and certificate, then writes them
 to a .PFX file (containing certificate and private key) and a
 .CER file (containing only the certificate). An administrator may
 add the contents of the .CER to the EFS recovery policy to create
 the recovery key for users, and import the .PFX to recover
 individual files. If SMARTCARD is specified, then writes the
 recovery key and certificate to a smart card. A .CER file is
 generated (containing only the certificate). No .PFX file is
 generated.

 Note: By default, /R creates an 2048-bit RSA recovery key and
 certificate. If ECC is specified, it must be followed by a
 key size of 256, 384, or 521.

 /P Creates a base64-encoded recovery-policy blob from the passed-in
 certificate. This blob can be used to set DRA policy for
 MDM deployments.
 /S Performs the specified operation on the given directory and all
 files and subdirectories within it.
 /U Tries to touch all the encrypted files on local drives. This will
 update user's file encryption key or recovery keys to the current
 ones if they are changed. This option does not work with other
 options except /N.
 /W Removes data from available unused disk space on the entire
 volume. If this option is chosen, all other options are ignored.
 The directory specified can be anywhere in a local volume. If it
 is a mount point or points to a directory in another volume, the
 data on that volume will be removed.
 /X Backup EFS certificate and keys into file filename. If efsfile is
 provided, the current user's certificate(s) used to encrypt the
 file will be backed up. Otherwise, the user's current EFS
 certificate and keys will be backed up.
 /Y Displays your current EFS certificate thumbprint on the local PC.
 /ADDUSER Adds a user to the specified encrypted file(s). If CERTHASH is
 provided, cipher will search for a certificate with this SHA1
 hash. If CERTFILE is provided, cipher will extract the
 certificate from the file. If USER is provided, cipher will
 try to locate the user's certificate in Active Directory Domain
 Services.
 /FLUSHCACHE
 Clears the calling user's EFS key cache on the specified server.
 If servername is not provided, cipher clears the user's key cache
 on the local machine.
 /REKEY Updates the specified encrypted file(s) to use the configured
 EFS current key.
 /REMOVEUSER
 Removes a user from the specified file(s). CERTHASH must be the
 SHA1 hash of the certificate to remove.

 directory A directory path.
 filename A filename without extensions.
 pathname Specifies a pattern, file or directory.
 efsfile An encrypted file path.

 Used without parameters, CIPHER displays the encryption state of the
 current directory and any files it contains. You may use multiple directory
 names and wildcards. You must put spaces between multiple parameters.

Return Code: 1

lodctr

Sat, 07 Dec 2019 09:08:30 +0000

Load PerfMon Counters

lodctr

C:\Windows\system32\lodctr.exe /?

Output:



LODCTR
 Updates registry values related to performance counters.
Usage:
 LODCTR <INI-filename>
 Installs counter text strings. INI-filename is the name of the
 initialization file that contains the counter name definitions
 and explain text for an extensible counter DLL.

 LODCTR /C:<filename>
 Upgrades counter text strings using <filename>

 LODCTR /H:<filename>
 Upgrades help text strings using <filename>

 LODCTR /L:<LangID>
 Specifies the language for the /C and /H commands

 LODCTR /S:<Backup-filename>
 Saves the current perf registry strings and info to
 <Backup-filename>

 LODCTR /R
 Rebuilds perf registry from scratch based on current registry
 settings and backup INI files.

 LODCTR /R:<filename>
 Restores perf registry strings & info using <filename>

 LODCTR /T:<service-name>
 Sets the specified performance counter provider as trusted.

 LODCTR /Q
 Displays performance counter provider information.

 LODCTR /Q:<service-name>
 Displays performance counter provider information for a
 specific provider.

 LODCTR /E:<service-name>
 Enables the performance counter provider.

 LODCTR /D:<service-name>
 Disables the performance counter provider.

 LODCTR /M:<Counter-Manifest> [<Installation-Path>]
 Installs a v2.0 performance counter provider using the specified
 XML manifest.

 The installation requires a full path to the DLL containing the
 performance counter resources (localized strings). The path
 to the DLL will be determined as follows:

 If the applicationIdentity attribute in the manifest is a full
 path, that will be used.

 Otherwise, if <Installation-Path> is provided and is a full
 path, that will be used.

 Otherwise, if <Counter-Manifest> is a full path, the directory
 from <Counter-Manifest> will be combined with the DLL name from
 the applicationIdentity attribute in the manifest.

 Otherwise, the current directory will be combined with the DLL
 name from the applicationIdentity attribute in the manifest.

Note: Any arguments with spaces in the names must be enclosed within double
quotation marks.

Return Code: 0

nslookup

Sat, 07 Dec 2019 09:08:30 +0000

nslookup

C:\Windows\system32\nslookup.exe /?

STDERR:

Usage:
 nslookup [-opt ...] # interactive mode using default server
 nslookup [-opt ...] - server # interactive mode using 'server'
 nslookup [-opt ...] host # just look up 'host' using default server
 nslookup [-opt ...] host server # just look up 'host' using 'server'

Return Code: 1

unlodctr

Sat, 07 Dec 2019 09:08:30 +0000

Unload PerfMon Counters

unlodctr

C:\Windows\system32\unlodctr.exe /?

Output:



UNLODCTR
 uninstalls a performance counter provider.
Usage:
 UNLODCTR <service-name>
 uninstalls the v1.0 performance counter provider associated
 with the <service-name> service.
 UNLODCTR /m:<manifest>
 uninstall a v2.0 performance counter provider using the
 provider GUID from the specified XML manifest.
 UNLODCTR /g:{ProviderGuid}
 uninstall a v2.0 performance counter provider using the
 specified provider GUID. The GUID should be specified in
 registry form, i.e. {nnnnnnnn-nnnn...}
 UNLODCTR /p:<ProviderName>
 uninstall a v2.0 performance counter provider matching the
 specified provider name.

Note: any arguments with spaces in the names must be enclosed within double
quotation marks.

Return Code: 0

expand

Sat, 07 Dec 2019 09:08:29 +0000

LZ Expansion Utility

expand

C:\Windows\system32\expand.exe /?

Output:

Microsoft (R) File Expansion Utility
Copyright (c) Microsoft Corporation. All rights reserved.

Expands one or more compressed files.

EXPAND [-R] Source Destination
EXPAND -R Source [Destination]
EXPAND -I Source [Destination]
EXPAND -D Source.cab [-F:Files]
EXPAND Source.cab -F:Files Destination

 -R Rename expanded files.
 -I Rename expanded files but ignore directory structure.
 -D Display list of files in source.
 Source Source file specification. Wildcards may be used.
 -F:Files Name of files to expand from a .CAB.
 Destination Destination file | path specification.
 Destination may be a directory.
 If Source is multiple files and -r is not specified,
 Destination must be a directory.

Return Code: 0

compact

Sat, 07 Dec 2019 09:08:26 +0000

File Compress Utility

compact

C:\Windows\system32\compact.exe /?

Output:

Displays or alters the compression of files on NTFS partitions.

COMPACT [/C | /U] [/S[:dir]] [/A] [/I] [/F] [/Q] [/EXE[:algorithm]]
 [/CompactOs[:option] [/WinDir:dir]] [filename [...]]

 /C Compresses the specified files. Directories will be marked
 so that files added afterward will be compressed unless /EXE
 is specified.
 /U Uncompresses the specified files. Directories will be marked
 so that files added afterward will not be compressed. If
 /EXE is specified, only files compressed as executables will
 be uncompressed; if this is omitted, only NTFS compressed
 files will be uncompressed.
 /S Performs the specified operation on files in the given
 directory and all subdirectories. Default "dir" is the
 current directory.
 /A Displays files with the hidden or system attributes. These
 files are omitted by default.
 /I Continues performing the specified operation even after errors
 have occurred. By default, COMPACT stops when an error is
 encountered.
 /F Forces the compress operation on all specified files, even
 those which are already compressed. Already-compressed files
 are skipped by default.
 /Q Reports only the most essential information.
 /EXE Use compression optimized for executable files which are read
 frequently and not modified. Supported algorithms are:
 XPRESS4K (fastest) (default)
 XPRESS8K
 XPRESS16K
 LZX (most compact)
 /CompactOs Set or query the system's compression state. Supported options are:
 query - Query the system's Compact state.
 always - Compress all OS binaries and set the system state to Compact
 which remains unless administrator changes it.
 never - Uncompress all OS binaries and set the system state to non
 Compact which remains unless administrator changes it.
 /WinDir Used with /CompactOs:query, when querying the offline OS. Specifies
 the directory where Windows is installed.
 filename Specifies a pattern, file, or directory.

 Used without parameters, COMPACT displays the compression state of
 the current directory and any files it contains. You may use multiple
 filenames and wildcards. You must put spaces between multiple
 parameters.

Return Code: 0

extrac32

Sat, 07 Dec 2019 09:08:26 +0000

Microsoftr CAB File Extract Utility

extrac32

C:\Windows\system32\extrac32.exe /?

Output:

Microsoft (R) Cabinet Extraction Tool
Copyright (c) Microsoft Corporation. All rights reserved..

EXTRACT [/Y] [/A] [/D | /E] [/L dir] cabinet [filename ...]
EXTRACT [/Y] source [newname]
EXTRACT [/Y] /C source destination

 cabinet - Cabinet file (contains two or more files).
 filename - Name of the file to extract from the cabinet.
 Wild cards and multiple filenames (separated by
 blanks) may be used.

 source - Compressed file (a cabinet with only one file).
 newname - New filename to give the extracted file.
 If not supplied, the original name is used.

 /A Process ALL cabinets. Follows cabinet chain
 starting in first cabinet mentioned.
 /C Copy source file to destination (to copy from DMF disks).
 /D Display cabinet directory (use with filename to avoid extract).
 /E Extract (use instead of *.* to extract all files).
 /L dir Location to place extracted files (default is current directory).
 /Y Do not prompt before overwriting an existing file.

Return Code: 0

makecab

Sat, 07 Dec 2019 09:08:26 +0000

Microsoftr Cabinet Maker

makecab

C:\Windows\system32\makecab.exe /?

Output:

Cabinet Maker - Lossless Data Compression Tool

MAKECAB [/V[n]] [/D var=value ...] [/L dir] source [destination]
MAKECAB [/V[n]] [/D var=value ...] /F directive_file [...]

 source File to compress.
 destination File name to give compressed file. If omitted, the
 last character of the source file name is replaced
 with an underscore (_) and used as the destination.
 /F directives A file with MakeCAB directives (may be repeated). Refer to
 Microsoft Cabinet SDK for information on directive_file.
 /D var=value Defines variable with specified value.
 /L dir Location to place destination (default is current directory).
 /V[n] Verbosity level (1..3).

Return Code: 0

rpcping

Sat, 07 Dec 2019 09:08:24 +0000

RPC Ping Utility

rpcping

C:\Windows\system32\RpcPing.exe /?

Output:

Usage:
rpcping [-t <protseq>] [-s <server_addr>] [-e <endpoint>
 |-f <interface UUID>[,MajorVer]] [-O <Interface Object UUID]
 [-i <#_iterations>] [-u <security_package_id>] [-a <authn_level>]
 [-N <server_princ_name>] [-I <auth_identity>] [-C <capabilities>]
 [-T <identity_tracking>] [-M <impersonation_type>]
 [-S <server_sid>] [-P <proxy_auth_identity>] [-F <RPCHTTP_flags>]
 [-H <RPC/HTTP_authn_schemes>] [-o <binding_options>]
 [-B <server_certificate_subject>] [-b] [-E] [-q] [-c]
 [-A <http_proxy_auth_identity>] [-U <HTTP_proxy_authn_schemes>]
 [-r <report_results_interval>] [-v <verbose_level>]

Pings a server using RPC. Options are:

-t <protseq> - protocol sequence to use. Can be one of the standard
 RPC protocol sequences - ncacn_ip_tcp, ncacn_np, ncacn_http, etc.
 If not specified, default is ncacn_ip_tcp.

-s <server_addr> - the server address. If not specified, the local
 machine will be pinged. E.g. server, server.com, 157.59.244.141

-e <endpoint> - the endpoint to ping. If none is specified, the endpoint
 mapper on the target machine will be pinged. This option is mutually
 exclusive with the interface (-f) option.

-o <binding_options> - the binding options for the RPC ping. See the
 MSDN for more details (RpcStringBindingCompose and RPC over HTTP).

-f <interface UUID>[,MajorVer] - the interface to ping. This option is
 mutually exclusive with the endpoint option. The interface is specified
 as a UUID. If the MajorVer is not specified, version 1 of the interface
 will be sought. When interface is specified, rpcping will query the
 endpoint mapper on the target machine to retrieve the endpoint for the
 specified interface. The endpoint mapper will be queried using the
 options specified in the command line.

-O <Object UUID> - Object Uuid if the interface registerd one.

-i <#_iterations> - number of calls to make. The default is 1. This
 option is useful for measuring connection latency if multiple
 iterations are specified.

-u <security_package_id> - the security package (security provider) RPC
 will use to make the call. The security package is identified as a
 number or a name. If a number is used it is the same number as in the
 RpcBindingSetAuthInfoEx API. The table below gives the names and
 numbers. Names are not case sensitive:
 Negotiate - 9 or one of nego, snego or negotiate
 NTLM - 10 or NTLM
 SChannel - 14 or SChannel
 Kerberos - 16 or Kerberos
 Kernel - 20 or Kernel
 If you specify this option you must specify authentication level other
 than none. There is no default for this option. If it is not specified,
 RPC will not use security for the ping.

-a <authn_level> - the authentication level to use. Possible values are
 connect, call, pkt, integrity and privacy. If this option is
 specified, the security package id (-u) must also be specified. There
 is no default for this option. If this option is not specified, RPC
 will not use security for the ping.

-N <server_princ_name> - specifies a server principal name. Same semantics
 as the ServerPrincName argument to RpcBindingSetAuthInfoEx. See the
 MSDN for more information on RpcBidningSetAuthInfoEx. This field can be
 used only when authentication level and security package are selected.

-I <auth_identity> - allows you to specify alternative identity to connect
 to the server. The identity is in the form user,domain,password where
 the three fields have the obvious meaning. If the user name, domain or
 password have special characters that can be interpreted by the shell
 be sure to enclose the identity in double quotes. You can specify *
 instead of the password and RPC will prompt you to enter the password
 without echoing it on the screen. If this field is not specified, the
 identity of the logged on user will be used. This field can be used
 only when authentication level and security package are selected.

-C <capabilities> - a hex bitmask of flags. It has the same meaning as
 the Capabilities field in the RPC_SECURITY_QOS structure described
 in the MSDN. This field can be used only when authentication level and
 security package are selected.

-T <identity_tracking> - can be static or dynamic. If not specified,
 dynamic is the default. This field can be used only when authentication
 level and security package are selected.

-M <impersonation_type> - can be anonymous, identify, impersonate or
 delegate. Default is impersonate. This field can be used only when
 authentication level and security package are selected.

-S <server_sid> - the expected SID of the server. For more information
 see the Sid field in the RPC_SECURITY_QOS structure in the MSDN. Using
 this option requires Windows .NET Server 2003 or higher. This field can
 be used only when authentication level and security package are
 selected.

-Z <effectiveonly> - the EffectiveOnly setting to use. For more information
 see the EffectiveOnly field in the RPC_SECURITY_QOS structure in MSDN.
 Using this option requires Windows Vista or higher. This field can be
 used only when authentication level and security package are selected.

-D <serversecuritydescriptor> - the security descriptor (in string format)
 of the server when using mutual authentication. For more information
 see the ServerSecurityDescriptor field in the RPC_SECURITY_QOS structure
 in MSDN. Using this option requires Windows 8 or higher. This field can
 be used only when authentication level and security package are
 selected.

-P <proxy_auth_identity> - specifies the identity to authenticate with to
 the RPC/HTTP proxy. Has the same format as for the -I option.
 Also, you must specify security package (-u), authentication level
 (-a), and authentication schemes (-H) in order to use this option.

-F <RPCHTTP_flags> - the flags to pass for RPC/HTTP front end
 authentication. The flags may be specified as numbers or names
 The currently recognized flags are:
 Use SSL - 1 or ssl or use_ssl
 Use first auth scheme - 2 or first or use_first
 See the Flags field in RPC_HTTP_TRANSPORT_CREDENTIALS for more
 information. Also, you must specify security package (-u) and
 authentication level (-a) in order to use this option.

-H <RPC/HTTP_authn_schemes> - the authentication schemes to use for
 RPC/HTTP front end authentication. This option is a list of numerical
 values or names separated by comma. E.g. Basic,NTLM. Recognized values
 are (names are not case sensitive:
 Basic - 1 or Basic
 NTLM - 2 or NTLM
 Certificate - 65536 or Cert
 Also, you must specify security package (-u) and authentication level
 (-a) in order to use this option.

-B <server_certificate_subject> - the server certificate subject. For
 more information, see the ServerCertificateSubject field in the
 RPC_HTTP_TRANSPORT_CREDENTIALS structure in the MSDN. You must use
 SSL for this option to work. Also, you must specify security package
 (-u) and authentication level (-a) in order to use this option.

-b - retrieves the server certificate subject from the certificate sent
 by the server and prints it to a screen or a log file. Valid only when
 the Proxy Echo only option (-E) and the use SSL options are specified.
 Also, you must specify security package (-u) and authentication level
 (-a) in order to use this option.

-R - specifies the HTTP proxy. if it's 'none', we will not use HTTP proxy but
 directly attempt the RPC proxy. the value 'default' means to use the IE
 settings in your client machine. any other value will be treated as the
 explicit HTTP proxy. if you don't specify this flag, the default value
 is assumed, that is, the IE settings are checked. this flag is valid
 only when the -E (Echo Only) flag is enabled.

-E - restricts the ping to the RPC/HTTP proxy only. The ping does not
 reach the server. Useful when trying to establish whether the RPC/HTTP
 proxy is reachable. Also, you must specify security package (-u) and
 authentication level (-a) in order to use this option. To specify an
 HTTP proxy, use the -R flag. If an HTTP proxy is specified in the -o
 flag, this option will be ignored.

-q - quiet mode. Does not issue any prompts except for passwords. Assumes
 'Y' response to all queries. Use this option with care.

-c - use smart card certificate. RPCPing will prompt user to choose
 smart card.

-A <http_proxy_auth_identity> - specifies the identity to authenticate
 with to the HTTP proxy. Has the same format as for the -I option.
 Also, you must specify authentication schemes (-U), security package
 (-u) and authentication level (-a) in order to use this option.

-U <HTTP_proxy_authn_schemes> - the authentication schemes to use for
 HTTP proxy authentication. This option is a list of numerical
 values or names separated by comma. E.g. Basic,NTLM. Recognized values
 are (names are not case sensitive:
 Basic - 1 or Basic
 NTLM - 2 or NTLM
 You must specify security package (-u) and authentication level (-a)
 in order to use this option.

-r <report_results_interval> - if multiple iterations are specified, this
 option will make rpcping display current execution statistics
 periodically instead after the last call. The report interval is given
 in seconds. Default is 15.

-v <verbose_level> - tells rpcping how verbose to make the output. Default
 value is 1. 2 and 3 provide more output from rpcping.

Example: Find out if your Exchange server that you connect through
RPC/HTTP is accessible:
 rpcping -t ncacn_http -s exchange_server -o RpcProxy=front_end_proxy
 -P "username,domain,*" -H Basic -u NTLM -a connect -F 3
When prompted for the password, enter it. exchange_server is the name of
your exchange server, front_end_proxy is the name of your proxy, username
and domain are your user name and domain as you would enter them in the
Outlook prompt. The other parameters will ask rpcping to ping your
Exchange server in exactly the same way as Outlook will connect to it for
the typical profile.

-p - Prompt for credentials if authentication fails.

Return Code: 0

bitsadmin

Sat, 07 Dec 2019 09:08:23 +0000

BITS administration utility

bitsadmin

C:\Windows\system32\bitsadmin.exe /?

Output:


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

USAGE: BITSADMIN [/RAWRETURN] [/WRAP | /NOWRAP] command
The following commands are available:

/HELP Prints this help
/? Prints this help
/UTIL /? Prints the list of utilities commands
/PEERCACHING /? Prints the list of commands to manage Peercaching
/CACHE /? Prints the list of cache management commands
/PEERS /? Prints the list of peer management commands

/LIST [/ALLUSERS] [/VERBOSE] List the jobs
/MONITOR [/ALLUSERS] [/REFRESH sec] Monitors the copy manager
/RESET [/ALLUSERS] Deletes all jobs in the manager

/TRANSFER <job name> [type] [/PRIORITY priority] [/ACLFLAGS flags] [/DYNAMIC]
 remote_url local_name
 Transfers one of more files.
 [type] may be /DOWNLOAD or /UPLOAD; default is download
 Multiple URL/file pairs may be specified.
 Unlike most commands, <job name> may only be a name and not a GUID.
 /DYNAMIC configures the job with BITS_JOB_PROPERTY_DYNAMIC_CONTENT, which relaxes the server-side requirements.

/CREATE [type] <job name> Creates a job
 [type] may be /DOWNLOAD, /UPLOAD, or /UPLOAD-REPLY; default is download
 Unlike most commands, <job name> may only be a name and not a GUID.

/INFO <job> [/VERBOSE] Displays information about the job
/ADDFILE <job> <remote_url> <local_name> Adds a file to the job
/ADDFILESET <job> <textfile> Adds multiple files to the job
 Each line of <textfile> lists a file's remote name and local name, separated
 by spaces. A line beginning with '#' is treated as a comment.
 Once the file set is read into memory, the contents are added to the job.

/ADDFILEWITHRANGES <job> <remote_url> <local_name range_list>
 Like /ADDFILE, but BITS will read only selected byte ranges of the URL.
 range_list is a comma-delimited series of offset and length pairs.
 For example,

 0:100,2000:100,5000:eof

 instructs BITS to read 100 bytes starting at offset zero, 100 bytes starting
 at offset 2000, and the remainder of the URL starting at offset 5000.

/REPLACEREMOTEPREFIX <job> <old_prefix> <new_prefix>
 All files whose URL begins with <old_prefix> are changed to use <new_prefix>

Note that BITS currently supports HTTP/HTTPS downloads and uploads.
It also supports UNC paths and file:// paths as URLS

/LISTFILES <job> Lists the files in the job
/SUSPEND <job> Suspends the job
/RESUME <job> Resumes the job
/CANCEL <job> Cancels the job
/COMPLETE <job> Completes the job

/GETTYPE <job> Retrieves the job type
/GETACLFLAGS <job> Retrieves the ACL propagation flags

/SETACLFLAGS <job> <ACL_flags> Sets the ACL propagation flags for the job
 O - OWNER G - GROUP
 D - DACL S - SACL

 Examples:
 bitsadmin /setaclflags MyJob OGDS
 bitsadmin /setaclflags MyJob OGD

/GETBYTESTOTAL <job> Retrieves the size of the job
/GETBYTESTRANSFERRED <job> Retrieves the number of bytes transferred
/GETFILESTOTAL <job> Retrieves the number of files in the job
/GETFILESTRANSFERRED <job> Retrieves the number of files transferred
/GETCREATIONTIME <job> Retrieves the job creation time
/GETMODIFICATIONTIME <job> Retrieves the job modification time
/GETCOMPLETIONTIME <job> Retrieves the job completion time
/GETSTATE <job> Retrieves the job state
/GETERROR <job> Retrieves detailed error information
/GETOWNER <job> Retrieves the job owner
/GETDISPLAYNAME <job> Retrieves the job display name
/SETDISPLAYNAME <job> <display_name> Sets the job display name
/GETDESCRIPTION <job> Retrieves the job description
/SETDESCRIPTION <job> <description> Sets the job description
/GETPRIORITY <job> Retrieves the job priority
/SETPRIORITY <job> <priority> Sets the job priority
 Priority usage choices:
 FOREGROUND
 HIGH
 NORMAL
 LOW
/GETNOTIFYFLAGS <job> Retrieves the notify flags
/SETNOTIFYFLAGS <job> <notify_flags> Sets the notify flags
 For more help on this option, please refer to the MSDN help page for SetNotifyFlags/GETNOTIFYINTERFACE <job> Determines if notify interface is registered
/GETMINRETRYDELAY <job> Retrieves the retry delay in seconds
/SETMINRETRYDELAY <job> <retry_delay> Sets the retry delay in seconds
/GETNOPROGRESSTIMEOUT <job> Retrieves the no progress timeout in seconds
/SETNOPROGRESSTIMEOUT <job> <timeout> Sets the no progress timeout in seconds
/GETMAXDOWNLOADTIME <job> Retrieves the download timeout in seconds
/SETMAXDOWNLOADTIME <job> <timeout> Sets the download timeout in seconds
/GETERRORCOUNT <job> Retrieves an error count for the job

/SETPROXYSETTINGS <job> <usage> Sets the proxy usage
 usage choices:
 PRECONFIG - Use the owner's default Internet settings.
 AUTODETECT - Force autodetection of proxy.
 NO_PROXY - Do not use a proxy server.
 OVERRIDE - Use an explicit proxy list and bypass list.
 Must be followed by a proxy list and a proxy bypass list.
 NULL or "" may be used for an empty proxy bypass list.
 Examples:
 bitsadmin /setproxysettings MyJob PRECONFIG
 bitsadmin /setproxysettings MyJob AUTODETECT
 bitsadmin /setproxysettings MyJob NO_PROXY
 bitsadmin /setproxysettings MyJob OVERRIDE proxy1:80 "<local>"
 bitsadmin /setproxysettings MyJob OVERRIDE proxy1,proxy2,proxy3 NULL

/GETPROXYUSAGE <job> Retrieves the proxy usage setting
/GETPROXYLIST <job> Retrieves the proxy list
/GETPROXYBYPASSLIST <job> Retrieves the proxy bypass list

/TAKEOWNERSHIP <job> Take ownership of the job

/SETNOTIFYCMDLINE <job> <program_name> [program_parameters]
 Sets a program to execute for notification, and optionally parameters.
 The program name and parameters can be NULL.
 IMPORTANT: if parameters are non-NULL, then the program name should be the
 first parameter.

 Examples:
 bitsadmin /SetNotifyCmdLine MyJob c:\winnt\system32\notepad.exe NULL
 bitsadmin /SetNotifyCmdLine MyJob c:\callback.exe "c:\callback.exe parm1 parm2"
 bitsadmin /SetNotifyCmdLine MyJob NULL NULL

/GETNOTIFYCMDLINE <job> Returns the job's notification command line

/SETCREDENTIALS <job> <target> <scheme> <username> <password>
 Adds credentials to a job.
 <target> may be either SERVER or PROXY
 <scheme> may be BASIC, DIGEST, NTLM, NEGOTIATE, or PASSPORT.

/REMOVECREDENTIALS <job> <target> <scheme>
 Removes credentials from a job.
/GETCUSTOMHEADERS <job> Gets the Custom HTTP Headers
/SETCUSTOMHEADERS <job> <header1> <header2> <...> Sets the Custom HTTP Headers
/MAKECUSTOMHEADERSWRITEONLY <job> Make a job's Custom HTTP Headers write-only (cannot be undone).

/GETHTTPMETHOD <job> Gets the HTTP verb to use.
/SETHTTPMETHOD <job> <HTTPMethod> Sets the HTTP verb to use.

/GETCLIENTCERTIFICATE <job> Gets the job's Client Certificate Information
/SETCLIENTCERTIFICATEBYID <job> <store_location> <store_name> <hexa-decimal_cert_id>
 Sets a client authentication certificate to a job.
 <store_location> may be
 1(CURRENT_USER), 2(LOCAL_MACHINE), 3(CURRENT_SERVICE),
 4(SERVICES), 5(USERS), 6(CURRENT_USER_GROUP_POLICY),
 7(LOCAL_MACHINE_GROUP_POLICY) or 8(LOCAL_MACHINE_ENTERPRISE).

/SETCLIENTCERTIFICATEBYNAME <job> <store_location> <store_name> <subject_name>
 Sets a client authentication certificate to a job.
 <store_location> may be
 1(CURRENT_USER), 2(LOCAL_MACHINE), 3(CURRENT_SERVICE),
 4(SERVICES), 5(USERS), 6(CURRENT_USER_GROUP_POLICY),
 7(LOCAL_MACHINE_GROUP_POLICY) or 8(LOCAL_MACHINE_ENTERPRISE).

/REMOVECLIENTCERTIFICATE <job> Removes the Client Certificate Information from the job

/SETSECURITYFLAGS <job> <value>
 Sets the HTTP security flags for URL redirection and checks performed on the server certificate during the transfer.
 The value is an unsigned integer with the following interpretation for the bits in the binary representation.
 Enable CRL Check : Set the least significant bit
 Ignore invalid common name in server certificate : Set the 2nd bit from right
 Ignore invalid date in server certificate : Set the 3rd bit from right
 Ignore invalid certificate authority in server
 certificate : Set the 4th bit from right
 Ignore invalid usage of certificate : Set the 5th bit from right
 Redirection policy : Controlled by the 9th-11th bits from right
 0,0,0 - Redirects will be automatically allowed.
 0,0,1 - Remote name in the IBackgroundCopyFile interface will be updated if a redirect occurs.
 0,1,0 - BITS will fail the job if a redirect occurs.

 Allow redirection from HTTPS to HTTP : Set the 12th bit from right

/GETSECURITYFLAGS <job>
 Reports the HTTP security flags for URL redirection and checks performed on the server certificate during the transfer.

/SETVALIDATIONSTATE <job> <file-index> <true|false>
 <file-index> starts from 0
 Sets the content-validation state of the given file within the job.

/GETVALIDATIONSTATE <job> <file-index>
 <file-index> starts from 0
 Reports the content-validation state of the given file within the job.

/GETTEMPORARYNAME <job> <file-index>
 <file-index> starts from 0
 Reports the temporary filename of the given file within the job.

The following options control peercaching of a particular job:

/SETPEERCACHINGFLAGS <job> <value>
 Sets the flags for the job's peercaching behavior.
 The value is an unsigned integer with the following interpretation for the bits in the binary representation.
 Allow the job's data to be downloaded from a peer : Set the least significant bit
 Allow the job's data to be served to peers : Set the 2nd bit from right

/GETPEERCACHINGFLAGS <job>
 Reports the flags for the job's peercaching behavior.

The following options are valid for UPLOAD-REPLY jobs only:

/GETREPLYFILENAME <job> Gets the path of the file containing the server reply
/SETREPLYFILENAME <job> <path> Sets the path of the file containing the server reply
/GETREPLYPROGRESS <job> Gets the size and progress of the server reply
/GETREPLYDATA <job> Dumps the server's reply data in hex format

/SETHELPERTOKEN <job> Sets the current command prompt's primary token as a job's helper token
/GETHELPERTOKENSID <job> Reports the user account SID of a job's helper token, if one is set

/SETHELPERTOKENFLAGS <job> <flags>
 Sets the helper token usage flags for a job. Possible values are:
 1 - The helper token is used when accessing the local filesystem.
 2 - The helper token is used when accessing the network.
 3 - The helper token is used when accessing both the local filesystem and the network.

/GETHELPERTOKENFLAGS <job>
 Reports a job's helper token usage flags.

/GETPEERSTATS <job> <file-index>
 <file-index> starts from 0
 Reports statistics about the amount of data downloaded from peers and origin servers for a specific file within a job.

The following options can be placed before the command:
/RAWRETURN Return data more suitable for parsing
/WRAP Wrap output around console (default)
/NOWRAP Don't wrap output around console

The /RAWRETURN option strips new line characters and formatting.
It is recognized by the /CREATE and /GET* commands.

Commands that take a <job> parameter will accept either a job name or a job ID
GUID inside braces. BITSADMIN reports an error if a name is ambiguous.

Return Code: 0

chkdsk

Sat, 07 Dec 2019 09:08:23 +0000

Check Disk Utility

chkdsk

C:\Windows\system32\chkdsk.exe /?

Output:

Checks a disk and displays a status report.


CHKDSK [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]] [/B] [/scan] [/spotfix]


 volume Specifies the drive letter (followed by a colon),
 mount point, or volume name.
 filename FAT/FAT32 only: Specifies the files to check for
 fragmentation.
 /F Fixes errors on the disk.
 /V On FAT/FAT32: Displays the full path and name of every
 file on the disk.
 On NTFS: Displays cleanup messages if any.
 /R Locates bad sectors and recovers readable information
 (implies /F, when /scan not specified).
 /L:size NTFS only: Changes the log file size to the specified
 number of kilobytes. If size is not specified, displays
 current size.
 /X Forces the volume to dismount first if necessary.
 All opened handles to the volume would then be invalid
 (implies /F).
 /I NTFS only: Performs a less vigorous check of index
 entries.
 /C NTFS only: Skips checking of cycles within the folder
 structure.
 /B NTFS only: Re-evaluates bad clusters on the volume
 (implies /R)
 /scan NTFS only: Runs an online scan on the volume
 /forceofflinefix NTFS only: (Must be used with "/scan")
 Bypass all online repair; all defects found
 are queued for offline repair (i.e. "chkdsk /spotfix").
 /perf NTFS only: (Must be used with "/scan")
 Uses more system resources to complete a scan as fast as
 possible. This may have a negative performance impact on
 other tasks running on the system.
 /spotfix NTFS only: Runs spot fixing on the volume
 /sdcleanup NTFS only: Garbage collect unneeded security descriptor
 data (implies /F).
 /offlinescanandfix Runs an offline scan and fix on the volume.
 /freeorphanedchains FAT/FAT32/exFAT only: Frees any orphaned cluster chains
 instead of recovering their contents.
 /markclean FAT/FAT32/exFAT only: Marks the volume clean if no
 corruption was detected, even if /F was not specified.

The /I or /C switch reduces the amount of time required to run Chkdsk by
skipping certain checks of the volume.

Return Code: 3

chkntfs

Sat, 07 Dec 2019 09:08:23 +0000

NTFS Volume Maintenance Utility

chkntfs

C:\Windows\system32\chkntfs.exe /?

Output:

Displays or modifies the checking of disk at boot time.

CHKNTFS volume [...]
CHKNTFS /D
CHKNTFS /T[:time]
CHKNTFS /X volume [...]
CHKNTFS /C volume [...]

 volume Specifies the drive letter (followed by a colon),
 mount point, or volume name.
 /D Restores the machine to the default behavior; all drives are
 checked at boot time and chkdsk is run on those that are
 dirty.
 /T:time Changes the AUTOCHK initiation countdown time to the
 specified amount of time in seconds. If time is not
 specified, displays the current setting.
 /X Excludes a drive from the default boot-time check. Excluded
 drives are not accumulated between command invocations.
 /C Schedules a drive to be checked at boot time; chkdsk will run
 if the drive is dirty.

If no switches are specified, CHKNTFS will display if the specified drive is
dirty or scheduled to be checked on next reboot.

Return Code: 2

format

Sat, 07 Dec 2019 09:08:23 +0000

Disk Format Utility

format

C:\Windows\system32\format.com /?

Output:

Formats a disk for use with Windows.

FORMAT volume [/FS:file-system] [/V:label] [/Q] [/L[:state]] [/A:size] [/C] [/I:state] [/X] [/P:passes] [/S:state]
FORMAT volume [/V:label] [/Q] [/F:size] [/P:passes]
FORMAT volume [/V:label] [/Q] [/T:tracks /N:sectors] [/P:passes]
FORMAT volume [/V:label] [/Q] [/P:passes]
FORMAT volume [/Q]

 volume Specifies the drive letter (followed by a colon),
 mount point, or volume name.
 /FS:filesystem Specifies the type of the file system (FAT, FAT32, exFAT,
 NTFS, UDF, ReFS).
 /V:label Specifies the volume label.
 /Q Performs a quick format. Note that this switch overrides /P.
 /C NTFS only: Files created on the new volume will be compressed
 by default.
 /X Forces the volume to dismount first if necessary. All opened
 handles to the volume would no longer be valid.
 /R:revision UDF only: Forces the format to a specific UDF version
 (1.02, 1.50, 2.00, 2.01, 2.50). The default
 revision is 2.01.
 /D UDF 2.50 only: Metadata will be duplicated.
 /L[:state] NTFS Only: Overrides the default size of file record.
 By default, a non-tiered volume will be formatted with small
 size file records and a tiered volume will be formatted with
 large size file records. /L and /L:enable forces format to
 use large size file records and /L:disable forces format to
 use small size file records.
 /A:size Overrides the default allocation unit size. Default settings
 are strongly recommended for general use.
 ReFS supports 4096, 64K.
 NTFS supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
 128K, 256K, 512K, 1M, 2M.
 FAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
 (128K, 256K for sector size > 512 bytes).
 FAT32 supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
 (128K, 256K for sector size > 512 bytes).
 exFAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
 128K, 256K, 512K, 1M, 2M, 4M, 8M, 16M, 32M.

 Note that the FAT and FAT32 files systems impose the
 following restrictions on the number of clusters on a volume:

 FAT: Number of clusters <= 65526
 FAT32: 65526 < Number of clusters < 4177918

 Format will immediately stop processing if it decides that
 the above requirements cannot be met using the specified
 cluster size.

 NTFS compression is not supported for allocation unit sizes
 above 4096.

 /F:size Specifies the size of the floppy disk to format (1.44)
 /T:tracks Specifies the number of tracks per disk side.
 /N:sectors Specifies the number of sectors per track.
 /P:count Zero every sector on the volume. After that, the volume
 will be overwritten "count" times using a different
 random number each time. If "count" is zero, no additional
 overwrites are made after zeroing every sector. This switch
 is ignored when /Q is specified.
 /S:state Specifies support for short filenames (enable, disable)
 Short names are disabled by default
 /TXF:state Specifies txf is enabled/disabled (enabled, disabled)
 TxF is enabled by default
 /I:state ReFS only: Specifies whether integrity should be enabled on
 the new volume. "state" is either "enable" or "disable"
 Integrity is enabled on storage that supports data redundancy
 by default.
 /DAX[:state] NTFS Only: Enable direct access storage (DAX) mode for this
 volume. In DAX mode, the volume is accessed via the memory
 bus, boosting IO performance. A volume can be formatted
 with DAX mode only if the hardware is DAX capable.
 State can specify "enable" or "disable". /DAX is considered
 as /DAX:enable.
 /LogSize[:size] NTFS Only: Specifies the size for NTFS log file in kilobytes.
 The minimum supported size is 2MB, so specifying size smaller
 than 2MB will result in a 2MB log file. Zero indicates the
 default value which generally depend on the volume size.
 /NoRepairLogs NTFS Only: Disables NTFS repair logs. If the flag is set
 spotfix (i.e. chkdsk /spotfix) will not work.

Return Code: 0

sfc

Sat, 07 Dec 2019 09:08:19 +0000

System Integrity Check and Repair

sfc

C:\Windows\system32\sfc.exe /?

Output:


Microsoft (R) Windows (R) Resource Checker Version 6.0
Copyright (C) Microsoft Corporation. All rights reserved.

Scans the integrity of all protected system files and replaces incorrect versions with
correct Microsoft versions.

SFC [/SCANNOW] [/VERIFYONLY] [/SCANFILE=<file>] [/VERIFYFILE=<file>]
 [/OFFWINDIR=<offline windows directory> /OFFBOOTDIR=<offline boot directory> [/OFFLOGFILE=<log file path>]]

/SCANNOW Scans integrity of all protected system files and repairs files with
 problems when possible.
/VERIFYONLY Scans integrity of all protected system files. No repair operation is
 performed.
/SCANFILE Scans integrity of the referenced file, repairs file if problems are
 identified. Specify full path <file>
/VERIFYFILE Verifies the integrity of the file with full path <file>. No repair
 operation is performed.
/OFFBOOTDIR For offline repair, specify the location of the offline boot directory
/OFFWINDIR For offline repair, specify the location of the offline windows directory
/OFFLOGFILE For offline repair, optionally enable logging by specifying a log file path

e.g.

 sfc /SCANNOW
 sfc /VERIFYFILE=c:\windows\system32\kernel32.dll
 sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
 sfc /SCANFILE=d:\windows\system32\kernel32.dll /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows /OFFLOGFILE=c:\log.txt
 sfc /VERIFYONLY

Return Code: 1

verifier

Sat, 07 Dec 2019 09:08:13 +0000

Verifier Configuration Editor

verifier

C:\Windows\system32\verifier.exe /?

Output:


Copyright (c) Microsoft Corporation. All rights reserved.

SYNTAX:

 verifier {/? | /help}
 verifier /standard /all
 verifier /standard /driver <name> [<name> ...]
 verifier {/ruleclasses | /rc} <options> [<ruleclass_1> <ruleclass_2> ...] /all
 verifier /flags <options> [<options> ...] /all
 verifier /flags <options> [<options> ...] /driver <name> [<name> ...]
 verifier /rules {query | reset | default <id> | disable <id>}
 verifier /query
 verifier /querysettings
 verifier /bootmode {persistent | resetonbootfail | oneboot | resetonunusualshutdown}
 verifier /persistthroughupgrade
 verifier /reset
 verifier /faults [probability [pool_tags [applications [delay_minutes]]]]
 verifier /faultssystematic [<options> ...]
 verifier /log <file_name> [/interval <seconds>]
 verifier /volatile /flags <options> [<options> ...]
 verifier /volatile /adddriver <name> [<name> ...]
 verifier /volatile /removedriver <name> [<name> ...]
 verifier /volatile /faults [probability [pool_tags [applications
 [delay_minutes]]]]
 verifier /domain {wdm | ndis | ks | audio} [rules.all | rules.default ]
 /driver ... [/logging | /livedump]
 verifier /logging
 verifier /livedump

PARAMETERS:

 /? or /help
 Displays this help message.

 /standard
 Specifies standard Driver Verifier flags.

 /all
 Specifies that all installed drivers will be verified after the next
 boot.

 /driver <name> [<name> ...]
 Specifies one or more drivers (image names) that will be verified.
 Wildcard values (e.g. n*.sys) are not supported.

 /driver.exclude <name> [<name> ...]
 Specifies one or more drivers (image names) that will be excluded
 from verification. This parameter is applicable only if all drivers
 are selected for verification. Wildcard values (e.g. n*.sys) are not
 supported.

 /flags <options> [<options> ...]
 Specifies one or more options that should be enabled for verification.
 Flags are applied to all drivers being checked by Driver Verifier. The
 provided options values must be either in decimal, hexadecimal ("0x"
 prefix), octal ("0o" prefix) or binary ("0b" prefix) format.

 Standard Flags:
 Standard Driver Verifier options can be specified using '/standard'.
 WDF verification is included in /standard but is not shown here.

 0x00000001 (bit 0) - Special pool
 0x00000002 (bit 1) - Force IRQL checking
 0x00000008 (bit 3) - Pool tracking
 0x00000010 (bit 4) - I/O verification
 0x00000020 (bit 5) - Deadlock detection
 0x00000080 (bit 7) - DMA checking
 0x00000100 (bit 8) - Security checks
 0x00000800 (bit 11) - Miscellaneous checks
 0x00020000 (bit 17) - DDI compliance checking

 Additional Flags:
 These flags are intended for specific scenario testing. Flags marked
 with (*) require I/O Verification (bit 4) that will be automatically
 enabled. Flags marked with (**) support disabling of individual
 rules.

 0x00000004 (bit 2) - Randomized low resources simulation
 0x00000200 (bit 9) - Force pending I/O requests (*)
 0x00000400 (bit 10) - IRP logging (*)
 0x00002000 (bit 13) - Invariant MDL checking for stack (*)
 0x00004000 (bit 14) - Invariant MDL checking for driver (*)
 0x00008000 (bit 15) - Power framework delay fuzzing
 0x00010000 (bit 16) - Port/miniport interface checking
 0x00040000 (bit 18) - Systematic low resources simulation
 0x00080000 (bit 19) - DDI compliance checking (additional)
 0x00200000 (bit 21) - NDIS/WIFI verification (**)
 0x00800000 (bit 23) - Kernel synchronization delay fuzzing
 0x01000000 (bit 24) - VM switch verification
 0x02000000 (bit 25) - Code integrity checks

 /ruleclasses or /rc [<ruleclass_1> <ruleclass_2> ... <ruleclass_k>]
 This parameter is larger set of '/flags' above. While '/flags' is
 limited to 32 bit bitmap expression, this can include more than 32
 verification classes. Each positive decimal integer represents a
 verification class. Multiple classes can be expressed by separating
 each class id with space character. Following rule classes IDs are
 available and leading 0's can be omitted.

 Standard Rule Classes:

 1 - Special pool
 2 - Force IRQL checking
 4 - Pool tracking
 5 - I/O verification
 6 - Deadlock detection
 8 - DMA checking
 9 - Security checks
 12 - Miscellaneous checks
 18 - DDI compliance checking
 34 - WDF Verification

 Additional Rule Classes:
 These rule classes are intended for specific scenario testing. Rule
 classes are marked with (*) require I/O Verification (5) that will
 be automatically enabled. Flags marked with (**) support disabling
 of individual rules.

 3 - Randomized low resources simulation
 10 - Force pending I/O requests (*)
 11 - IRP logging (*)
 14 - Invariant MDL checking for stack (*)
 15 - Invariant MDL checking for driver (*)
 16 - Power framework delay fuzzing
 17 - Port/miniport interface checking
 19 - Systematic low resources simulation
 20 - DDI compliance checking (additional)
 22 - NDIS/WIFI verification (**)
 24 - Kernel synchronization delay fuzzing
 25 - VM switch verification
 26 - Code integrity checks

 /log.code_integrity
 This option suppresses Code Integrity violation breaks and collects
 only statistics for verified drivers. Statistics could be extracted
 via /log option or kernel debugger. This parameter is applicable only
 if Code Integrity checks are enabled.

 /rules {query | reset | default <id> | disable <id>}
 Specifies rules level control (advanced).

 query Shows current status of controllable rules.
 reset Resets all rules to their default state.
 default <id> Sets rule ID to its default state.
 disable <id> Disables specified rule ID.

 /query
 Display runtime Driver Verifier statistics and settings.

 /querysettings
 Displays a summary of the options and drivers that are currently
 enabled, or options and drivers that will be verified after the
 next boot. The display does not include drivers and options added
 using /volatile.

 /bootmode
 Specifies the Driver Verifier boot mode. This option requires system
 reboot to take effect.

 persistent Ensures that Driver Verifier settings are
 persistent across reboots. This is the default
 value.
 resetonbootfail Disables Driver Verifier for subsequent reboots
 if the system failed to start.
 resetonunusualshutdown
 Driver Verifier persists until unusual shutdown
 happens. Its abbrevation, 'rous', can be used.
 oneboot Enables Driver Verifier only for the next boot.

 /persistthroughupgrade
 Makes the Driver Verifier settings persist through upgrade. Driver
 Verifier will be active during system upgrade.

 /reset
 Clears Driver Verifier flags and driver settings. This option requires
 system reboot to take effect.

 /faults [probability [pool_tags [applications [delay_minutes]]]]
 Enable the Randomized low resources simulation feature and optionally
 control parameters for the Randomized low resources simulation.

 Probability Specifies the probability that Driver Verifier will
 fail a given allocation. The value represents the
 number of chances in 10,000 that Driver Verifier will
 fail the allocation. The default value 600, means
 600/10000 or 6.
 Pool Tags: Specifies a space separated list of the pool tags to
 be injected with faults. By default, any pool
 allocation can be injected with faults.
 Applications Specifies a space separated list of image file names
 (an executable) that will be injected with faults. By
 default, any pool allocation can be injected with
 faults.
 DelayMinutes Specifies the number of minutes after booting during
 which Driver Verifier does not intentionally fail any
 allocations. This delay allows the drivers to load
 and the system to stabilize before the test begins.
 The default value is 8 minutes.

 /faultssystematic [<options> ...]
 Controls the Systematic low resources simulation parameters.

 enableboottime Enables fault injections across reboots.
 disableboottime Disables fault injections across reboots.
 This is the default value.
 recordboottime Enables fault injections in 'what if' mode
 across reboots.
 resetboottime Disables fault injections across reboots and
 clears the stack exclusion list.
 enableruntime Dynamically enables fault injections.
 disableruntime Dynamically disables fault injections.
 recordruntime Dynamically enables fault injections in
 'what if' mode.
 resetruntime Dynamically disables fault injections and
 clears the previously faulted stack list.
 querystatistics Shows the current fault injection statistics.
 incrementcounter Increments the test pass counter used to
 identify when a fault was injected.
 getstackid <counter> Retrieves the indicated injected stack id.
 excludestack <stack_id> Excludes the stack from fault injection.

 /log <file_name> [/interval <seconds>]
 Creates a log file with the specified name and periodically writes the
 runtime statistics to this file. The interval between log file updates
 is controlled by the '/interval' parameter. The default value is 30
 seconds. Use CTRL+C to close the log and return.

 /volatile
 Changes Driver Verifier settings without rebooting the computer.
 Volatile settings take effect immediately and are in effect until the
 next system reboot.

 /volatile /adddriver <name> [<name> ...]
 Starts the verification for the specified driver or drivers.

 /volatile /removedriver <name> [<name> ...]
 Stops the verification for the specified driver or drivers.

 /domain {wdm | ndis | ks | audio} [rules.all | rules.default] /driver ...
 [/logging | /livedump]
 Controls the verifier extension settings. The following verifier
 extension types are supported:

 wdm Enabled verifier extension for WDM drivers.
 ndis Enabled verifier extension for networking drivers.
 ks Enabled verifier extension for kernel mode
 streaming drivers.
 audio Enabled verifier extension for audio drivers.

 The following extension options are supported:

 rules.default Enables default validation rules for the selected
 verifier extension.
 rules.all Enables all validation rules for the selected
 verifier extension.

 /logging
 Enables logging for violated rules detected by the selected verifier
 extensions.

 /livedump
 Enables live memory dump collection for violated rules detected by
 the selected verifier extensions.

Return Code: 0

dispdiag

Sat, 07 Dec 2019 09:08:07 +0000

Display Diagnostics

dispdiag

C:\Windows\system32\dispdiag.exe /?

Output:

Logs display information to a file in the current directory.

Usage: dispdiag [-testacpi] [-d] [-delay <seconds>] [-brightnesslogging] [-out <FilePath>]
 -testacpi runs hotkey diagnostics test
 -d generates a dmp file as well with additional data.
 -delay delays the collection of data by specified time in seconds.
 -out <FilePath> path where the dispdiag file should be saved, including filename. This must be the last parameter
 -DumpIdDiag force Indirect DIsplay framework to dump diag info via WPP
 -brightnesslogging toggle verbose brightness logging.
 -ccddatabaselogging <on|off> toggle Ccd database access logging.
 -dxgautologger <on|off> toggle DxgDiagnostics autologger. Requires admin and a reboot.
 -DodFullscreenupdates <on|off> toggle if all active display only drivers should process each present
 as full screen dirty.
 -Msg <Message to log> Inserts the specified message into the diagnostic buffers
Output:
 Name of the saved file.

Return Code: 1

vaultcmd

Sat, 07 Dec 2019 09:08:03 +0000

Vault cmdline Program

vaultcmd

C:\Windows\system32\VaultCmd.exe /?

Output:

Creates, displays and deletes stored credentials.
Following commands are supported.Use VaultCmd /<command> /? for further help
VaultCmd /list
VaultCmd /listschema
VaultCmd /listcreds
VaultCmd /addcreds
VaultCmd /deletecreds
VaultCmd /listproperties
VaultCmd /sync

Return Code: 0

register-cimprovider

Sat, 07 Dec 2019 09:07:56 +0000

WMI

register-cimprovider

C:\Windows\system32\Register-CimProvider.exe -help

Output:


Registers CIM Provider into system

Usage: Register-CimProvider.exe
 -Namespace <NamespaceName>
 -ProviderName <ProviderName>
 -Path <ProviderDllPath>
 [-ClassList <Space delimited list of white-listed classes>]
 [-Impersonation <True or False>]
 [-Decoupled <SDDL>]
 [-HostingModel <HostingModel>]
 [-Localize <locale>]
 [-NoAutorecover]
 [-SupportWQL]
 [-GenerateUnregistration]
 [-ForceUpdate]
 [-Verbose]

-Namespace <NamespaceName>
 Specifies the target namespace of the provider.

-ProviderName <ProviderName>
 Specifies the provider name.

-Path <ProviderDllPath>
 Specifies the provider binary path.

-Impersonation <True or False>
 Specifies foldidentity of decoupled provider, by default is True.

-Decoupled <SDDL>
 Registers provider as decoupled and specifies the security descriptor
 that determines the set of users that can successfully register
 the provider.

-HostingModel <HostingModel>
 Specifies the HostingModel of coupled provider.

-Localize <locale>
 Localizes the provider with resource of specified locale.

-NoAutorecover
 Doesn't autorecover the provider.

-SupportWQL
 Passes the query expression to the filter.

-GenerateUnregistration
 Generate the uninstall mof for the registration,
 which is disabled by default.

-ForceUpdate
 Force update the class if it exists in the system.

-ClassList <ProviderDllPath>
 Specifies space delimited list of white-listed classes that
 will be generated in the mof.

-Verbose
 Outputs registration log.

Return Code: 0

winrs

Sat, 07 Dec 2019 09:07:54 +0000

winrs

C:\Windows\system32\winrs.exe /?

Output:


USAGE
=====
(ALL UPPER-CASE = value that must be supplied by user.)

winrs [-/SWITCH[:VALUE]] COMMAND

COMMAND - Any string that can be executed as a command in the cmd.exe shell.

SWITCHES
========
(All switches accept both short form or long form. For example both -r and
-remote are valid.)

-r[emote]:ENDPOINT - The target endpoint using a NetBIOS name or the standard connection URL: [TRANSPORT://]TARGET[:PORT]. If not specified
-r:localhost is used.

-un[encrypted] - Specify that the messages to the remote shell will not be encrypted. This is useful for troubleshooting, or when the network traffic is already encrypted using ipsec, or when physical security is enforced. By default the messages are encrypted using Kerberos or NTLM keys. This switch is ignored when HTTPS transport is selected.

-u[sername]:USERNAME - Specify username on command line. If not specified the tool will use Negotiate authentication or prompt for the name.
If -username is specified, -password must be as well.

-p[assword]:PASSWORD - Specify password on command line. If -password is not specified but -username is the tool will prompt for the password. If -password is specified, -user must be specified as well.

-t[imeout]:SECONDS - This option is deprecated.

-d[irectory]:PATH - Specifies starting directory for remote shell. If not specified the remote shell will start in the user's home directory defined by the environment variable %USERPROFILE%.

-env[ironment]:STRING=VALUE - Specifies a single environment variable to be set when shell starts, which allows changing default environment for shell. Multiple occurrences of this switch must be used to specify multiple environment variables.

-noe[cho] - Specifies that echo should be disabled. This may be necessary to ensure that user's answers to remote prompts are not displayed locally. By default echo is "on".

-nop[rofile] - Specifies that the user's profile should not be loaded. By default the server will attempt to load the user profile. If the remote user is not a local administrator on the target system then this option will be required (the default will result in error).

-a[llow]d[elegate] - Specifies that the user's credentials can be used to access a remote share, for example, found on a different machine than the target endpoint.

-comp[ression] - Turn on compression. Older installations on remote machines may not support compression so it is off by default.

-[use]ssl - Use an SSL connection when using a remote endpoint. Specifying this instead of the transport "https:" will use the default WinRM default port.

-? - Help

To terminate the remote command the user can type Ctrl-C or Ctrl-Break, which will be sent to the remote shell. The second Ctrl-C will force termination of winrs.exe.

To manage active remote shells or WinRS configuration, use the WinRM tool. The URI alias to manage active shells is shell/cmd. The URI alias for WinRS configuration is winrm/config/winrs. Example usage can be found in the WinRM tool by typing "WinRM -?".

Examples:
winrs -r:https://myserver.com command
winrs -r:myserver.com -usessl command
winrs -r:myserver command
winrs -r:http://127.0.0.1 command
winrs -r:http://169.51.2.101:80 -unencrypted command
winrs -r:https://[::FFFF:129.144.52.38] command
winrs -r:http://[1080:0:0:0:8:800:200C:417A]:80 command
winrs -r:https://myserver.com -t:600 -u:administrator -p:$%fgh7 ipconfig
winrs -r:myserver -env:PATH=^%PATH^%;c:\tools -env:TEMP=d:\temp config.cmd
winrs -r:myserver netdom join myserver /domain:testdomain /userd:johns /passwordd:$%fgh789
winrs -r:myserver -ad -u:administrator -p:$%fgh7 dir \\anotherserver\share

Return Code: 0

tzutil

Sat, 07 Dec 2019 09:07:49 +0000

Windows Time Zone Utility

tzutil

C:\Windows\system32\tzutil.exe /?

Output:

Windows Time Zone Utility

Usage:
TZUTIL </? | /g | /s TimeZoneID[_dstoff] | /l>

Parameters:
 /? Displays usage information.

 /g Displays the current time zone ID.

 /s TimeZoneID[_dstoff]
 Sets the current time zone using the specified time zone ID.
 The _dstoff suffix disables Daylight Saving Time adjustments
 for the time zone (where applicable).

 /l Lists all valid time zone IDs and display names. The output will
 be:
 <display name>
 <time zone ID>

Examples:
 TZUTIL /g
 TZUTIL /s "Pacific Standard Time"
 TZUTIL /s "Pacific Standard Time_dstoff"

Remarks:
 An exit code of 0 indicates the command completed successfully.

Return Code: 0

w32tm

Sat, 07 Dec 2019 09:07:49 +0000

Windows Time Service Diagnostic Tool

w32tm

C:\Windows\system32\w32tm.exe /?

Output:

w32tm [/? | /register | /unregister ]
 ? - this help screen.
 register - register to run as a service and add default
 configuration to the registry.
 unregister - unregister service and remove all configuration
 information from the registry.

w32tm /monitor [/domain:<domain name>]
 [/computers:<name>[,<name>[,<name>...]]]
 [/threads:<num>] [/ipprotocol:<4|6>] [/nowarn]
 domain - specifies which domain to monitor. If no domain name
 is given, or neither the domain nor computers option is
 specified, the default domain is used. This option may be
 used more than once.
 computers - monitors the given list of computers. Computer
 names are separated by commas, with no spaces. If a name is
 prefixed with a '*', it is treated as an AD PDC. This option
 may be used more than once.
 threads - how many computers to analyze simultaneously. The
 default value is 3. Allowed range is 1-50.
 ipprotocol - specify the IP protocol to use. The default is
 to use whatever is available.
 nowarn - skip warning message.

w32tm /ntte <NT time epoch>
 Convert a NT system time, in (10^-7)s intervals from 0h 1-Jan 1601,
 into a readable format.

w32tm /ntpte <NTP time epoch>
 Convert an NTP time, in (2^-32)s intervals from 0h 1-Jan 1900, into
 a readable format.

w32tm /resync [/computer:<computer>] [/nowait] [/rediscover] [/soft]
 Tell a computer that it should resynchronize its clock as soon
 as possible, throwing out all accumulated error statistics.
 computer:<computer> - computer that should resync. If not
 specified, the local computer will resync.
 nowait - do not wait for the resync to occur;
 return immediately. Otherwise, wait for the resync to
 complete before returning.
 rediscover - redetect the network configuration and rediscover
 network sources, then resynchronize.
 soft - resync utilizing existing error statistics. Not useful,
 provided for compatibility.

w32tm /stripchart /computer:<target> [/period:<refresh>]
 [/dataonly] [/samples:<count>] [/packetinfo] [/ipprotocol:<4|6>] [/rdtsc]
 Display a strip chart of the offset between this computer and
 another computer.
 computer:<target> - the computer to measure the offset against.
 period:<refresh> - the time between samples, in seconds. The
 default is 2s
 dataonly - display only the data, no graphics.
 samples:<count> - collect <count> samples, then stop. If not
 specified, samples will be collected until Ctrl-C is pressed.
 packetinfo - print out NTP packet response message.
 ipprotocol - specify the IP protocol to use. The default is
 to use whatever is available.
 rdtsc - display the TSC values and time offset data in CSV format.
 The output displays TSC and FILETIME values captured before the
 NTP request is sent, TSC value after an NTP response is received
 along with NTP roundtrip and time offset values.


w32tm /config [/computer:<target>] [/update]
 [/manualpeerlist:<peers>] [/syncfromflags:<source>]
 [/LocalClockDispersion:<seconds>]
 [/reliable:(YES|NO)]
 [/largephaseoffset:<milliseconds>]
 computer:<target> - adjusts the configuration of <target>. If not
 specified, the default is the local computer.
 update - notifies the time service that the configuration has
 changed, causing the changes to take effect.
 manualpeerlist:<peers> - sets the manual peer list to <peers>,
 which is a space-delimited list of DNS and/or IP addresses.
 When specifying multiple peers, this switch must be enclosed in
 quotes.
 syncfromflags:<source> - sets what sources the NTP client should
 sync from. <source> should be a comma separated list of
 these keywords (not case sensitive):
 MANUAL - sync from peers in the manual peer list
 DOMHIER - sync from an AD DC in the domain hierarchy
 NO - sync from none
 ALL - sync from both manual and domain peers
 LocalClockDispersion:<seconds> - configures the accuracy of the
 internal clock that w32time will assume when it can't acquire
 time from its configured sources.
 reliable:(YES|NO) - set whether this machine is a reliable time source.
 This setting is only meaningful on domain controllers.
 YES - this machine is a reliable time service
 NO - this machine is not a reliable time service
 largephaseoffset:<milliseconds> - sets the time difference between
 local and network time which w32time will consider a spike.

w32tm /tz
 Display the current time zone settings.

w32tm /dumpreg [/subkey:<key>] [/computer:<target>]
 Display the values associated with a given registry key.
 The default key is HKLM\System\CurrentControlSet\Services\W32Time
 (the root key for the time service).
 subkey:<key> - displays the values associated with subkey <key>
 of the default key.
 computer:<target> - queries registry settings for computer <target>.

w32tm /query [/computer:<target>]
 {/source | /configuration | /peers | /status}
 [/verbose]
 Display a computer's windows time service information.
 computer:<target> - query the information of <target>. If not
 specified, the default is the local computer.
 source: display the time source.
 configuration: display the configuration of run-time and where
 the setting comes from. In verbose mode, display the undefined
 or unused setting too.
 peers: display a list of peers and their status.
 status: display windows time service status.
 verbose: set the verbose mode to display more information.

w32tm /debug {/disable | {/enable /file:<name> /size:<bytes> /entries:<value>
 [/truncate]}}
 Enable or disable local computer windows time service private log.
 disable: disable the private log.
 enable: enable the private log.
 file:<name> - specify the absolute filename.
 size:<bytes> - specify the maximum size for circular logging.
 entries:<value> - contains a list of flags, specified by number and
 separated by commas, that specify the types of information that
 should be logged. Valid numbers are 0 to 300. A range of numbers
 is valid, in addition to single numbers, such as 0-100,103,106.
 Value 0-300 is for logging all information.
 truncate: truncate the file if it exists.

w32tm /leapseconds /getstatus [/verbose]
 Display the status of leap seconds on the local machine.
 verbose: Set the verbose mode to display more information.

Return Code: 0

bootcfg

Sat, 07 Dec 2019 09:07:45 +0000

BootCfg - Lists or changes the boot settings.

bootcfg

C:\Windows\system32\bootcfg.exe /?

Output:


BOOTCFG /parameter [arguments]

Description:
 This command line tool can be used to configure, query, change or
 delete the boot entry settings in the BOOT.INI file.

Parameter List:
 /Copy Makes a copy of an existing boot entry.

 /Delete Deletes an existing boot entry from the BOOT.INI file.

 /Query Displays the current boot entries and their settings.

 /Raw Allows the user to specify any switch to be added.

 /Timeout Allows the user to change the Timeout value.

 /Default Allows the user to change the Default boot entry.

 /EMS Allows the user to configure the /redirect switch
 for headless support.

 /Debug Allows the user to specify the port and baudrate for
 remote debugging.

 /Addsw Allows the user to add predefined switches.

 /Rmsw Allows the user to remove predefined switches.

 /Dbg1394 Allows the user to configure 1394 port for debugging.

 /? Displays this help message.

Examples:
 BOOTCFG /Copy /?
 BOOTCFG /Delete /?
 BOOTCFG /Query /?
 BOOTCFG /Raw /?
 BOOTCFG /Timeout /?
 BOOTCFG /EMS /?
 BOOTCFG /Debug /?
 BOOTCFG /Addsw /?
 BOOTCFG /Rmsw /?
 BOOTCFG /Dbg1394 /?
 BOOTCFG /Default /?
 BOOTCFG /?

WARNING: BOOT.INI is used for boot options on Windows XP and earlier
 operating systems. Use the BCDEDIT command line tool to modify
 Windows Vista boot options.

Return Code: 0

bootsect

Sat, 07 Dec 2019 09:07:45 +0000

Boot Sector Manipulation Tool

bootsect

C:\Windows\system32\bootsect.exe /help

Output:


bootsect {/help|/nt60|/nt52} {SYS|ALL|<DriveLetter>:} [/force] [/mbr]

Boot sector restoration tool

Bootsect.exe updates the master boot code for hard disk partitions in order to
switch between BOOTMGR and NTLDR. You can use this tool to restore the boot
sector on your computer.

/help Displays these usage instructions.

/nt52 Applies the master boot code that is compatible with NTLDR to SYS,
 ALL, or <DriveLetter>. The operating system installed on SYS, ALL, or
 <DriveLetter> must be older than Windows Vista.

/nt60 Applies the master boot code that is compatible with BOOTMGR to SYS,
 ALL, or <DriveLetter>. The operating system installed on SYS, ALL, or
 <DriveLetter> must be Windows Vista, Windows Server 2008 or later.

SYS Updates the master boot code on the system partition used to boot
 Windows.

ALL Updates the master boot code on all partitions. ALL does not
 necessarily update the boot code for each volume. Instead, this
 option updates the boot code on volumes that could be used as Windows
 boot volumes, which excludes any dynamic volumes that are not
 connected with an underlying disk partition. This restriction is
 present because boot code must be located at the beginning of a disk
 partition.

<DriveLetter> Updates the master boot code on the volume associated with this
 drive letter. Boot code will not be updated if either 1)
 <DriveLetter> is not associated with a volume or 2) <DriveLetter> is
 associated with a volume not connected to an underlying disk
 partition.

/force Forcibly dismounts the volume(s) during the boot code update. You
 should use this option with caution.

 If Bootsect.exe cannot gain exclusive volume access then the file
 system may overwrite the boot code before the next reboot.
 Bootsect.exe always attempts to lock and dismount the volume before
 each update. When /force is specified, a forced dismount is attempted
 if the initial lock attempt fails. A lock can fail, for example, if
 files on the target volume are currently opened by other programs.

 When successful, a forced dismount allows exclusive volume access and
 a reliable boot code update even though the initial lock failed. At
 the same time, a forced dismount invalidates all open handles to files
 on the target volume. This could result in unexpected behavior from
 the programs that opened these files. Therefore, you should use this
 option with caution.

/mbr Updates the Master Boot Record without changing the partition table on
 sector 0 of the disk that contains the partition specified by SYS, ALL,
 or drive letter. When used with /nt52 option, the master boot record
 is compatible with operating systems older than Windows Vista. When
 used with the /nt60 option, the master boot record is compatible with
 Windows Vista, Windows Server 2008 or later.

Example:

To apply the master boot code that is compatible with NTLDR to the volume
labeled E:, use the following command:

bootsect /nt52 E:

Return Code: 0