|
|
|
   |
||
 |
||
|
|
||
| ||||||||||||
|
|
DOWNLOAD: ARP ASSISTANT
Use Nbtstat to gather NetBIOS information -- Great article on Tech Republic Another NetBIOS name tool
How can you determine which ports a specific process is using on Windows XP and later? If you want to find out which ports a process is using and you know the process name, you must first determine the process identifier (PID). For example, to identify the PID for the pop3svc.exe process running on my system, I went to the command prompt and typed c:\> tasklist /fi "IMAGENAME eq pop3svc.exe" This command returned the following information: Image Name PID Session Name Session# Mem Usage POP3Svc.exe 3044 RDP-Tcp#9 0 2,072 K The second column shows the PID, which I can then use with the Netstat command to search all in-use ports. For example, if I type c:\> netstat -ano | findstr 3044 my system returns the following information: TCP 0.0.0.0:110 0.0.0.0:0 LISTENING 3044 This result shows that the POP3 service was using TCP port 110 on all addresses. You can also perform a reverse operation to find out which process is associated with a port. For example, to identify which process is using port 25, I could go to the command prompt and type c:\> netstat -ano | findstr :25 On my system, this command returns the following information: TCP 0.0.0.0:25 0.0.0.0:0 LISTENING 2500 After I identify the process (in this case, 2500), I can determine the process name by typing c:\> tasklist /fi "PID eq 2500" which returns the following information on my system: Image Name PID Session Name Session# Mem Usage inetinfo.exe 2500 RDP-Tcp#9 0 5,584 K This information tells me that port 25 is being used by the inetinfo.exe process. Note: Above information was obtained from Windows 2000 Magazine mail list.
Scripting Resources from Windows Magazine: Patrick Goodwin, who reads the HowTo Mailing List(see the URL below), recently offered readers a startup boot script that he uses to help automate service pack installation. (Goodwin's employee, Chi Kin To wrote the script.) The script checks the OS type and service pack level against presets written into the script code. If the system doesn't meet conditions (e.g., Windows 2000 Service Pack 4--SP4--isn't installed), the script places that computer in a service pack installation group (a Group Policy Object--GPO). The original script creates a second script on the system that schedules a system reboot at a predetermined time (e.g., in the middle of the night when no one uses the system). When the system reboots, the system downloads and installs a copy of the service pack. When the same script runs again and determines that the system has the specified service pack installed, the script moves that system out of the service pack installation group. http://63.88.172.96/listserv/page_listserv.asp?s=howto Depending on your particular situation, you might find this script handy. You might also consider modifying the code to fit another task or purpose. Also, if you want to learn scripting techniques, the script serves as a good example of how to perform various actions, such as determining an OS type, service pack level, and GPO membership. You can access the script to examine or use in the HowTo for Security mailing list archives (see the first URL below). At the second URL below, you'll find another version of the script (Chi Kin To also wrote this version), which has additional code that checks a machine's IP address to make sure it's connected to the local subnets before any actions are performed. This check might be helpful for systems connected over slow WAN links. The IP address check can ensure that the script doesn't cause that system to try to download a huge service pack file over a slow link. http://www.secadministrator.com/listserv/page_listserv.asp?a2=ind0308c&l=howto&p=3253 http://www.secadministrator.com/listserv/page_listserv.asp?a2=ind0308d&l=howto&p=2351You can get a head start on script writing by searching for ready-made scripts on the Internet, by learning about scripting techniques in various forums, and of course by reading the Windows Scripting Solutions newsletter. (You can learn more about our scripting forum and newsletter at the URLs below.) http://www.winscriptingsolutions.com http://www.winnetmag.com/forums/categories.cfm?catid=43
Script like the pro's: Visit the TechNet Scripting center. They also have a ScriptoMatic tool!
A few NT command line utilities: ipconfig or ipconfig /all. The /displaydns switch returns the list of all cached DNS names, and the /flushdns switch clears the cache.
Need to know your total uptime on that workstation or server? One way is to enter the following at the command prompt: C:\> net statistics workstation | more
Net config server or Net config workstation will return valuable NT information about a machine. nbtstat winipcfg (The Ip config GUI utility) ipconfig (The ip config utility in Win 2000- non GUI) winmsd for NT Diaganostics windisk starts the disk administrator tool ntipcfg netstat -a or netstat-ar will tell you open ports on that machinenslookup connects you to a DNS server on the net for lookups of IP's and names. STARTING AND STOPPING THE PRINT SPOOLER If you find yourself having to start and stop the print spooler frequently, you can use the "netsvc" command from the Windows NT 4.0 Resource Kit to manage services on remote computers. You can write a command such as netsvc spooler \servername /start netsvc spooler \servername /stop Put these two commands in two individual batch files, with shortcuts on your desktop. Simply double-click one or the other, and the print spooler starts or stops as desired!
Modify the Command Prompt to work the way you want it to. Nice article at TechRepublic.
DirectX info
Want information on the DirectX that is installed on your computer... From a run prompt type: dxdiag
Systernals provides a nice freeware command line tool , called PSloggedon, that provides a comprehensive listing of who's logged on to a Windows NT system at a given time.
Foundstone has some nice freeware tools including Fport which identifies which applications are listening on which ports. (A great way to uncover Trojan horses installed on your system.)
Browstat is a part of the Windows 2000 support Tools set. To install it run the setup in the \support\tools directory on the Win2K install disk. This tool is excellent for helping to find browsing issues on your network. You may also want to checkout Windows magazines Instant Doc ID 25643 for more information on browsing network issues.
ADDING USER ACCOUNTS FROM A WINDOWS NT COMMAND LINE: You can add or delete computer accounts from the command line. Thistype of functionality is essential if you use script or bat files to automate tasks. From the command prompt, use the Net command:Net computer \\computername /Add /Del. You must have the appropriate permissions to add or delete an account in order for this to work. To obtain a list of accounts in the domain that a computer is a member of, use the NET USER /DOMAIN command-line option. You can, of course, redirect the output of the NET USER command to a file for printing or other editing FILE BY ASSOCIATION Users sometimes accidentally associate the wrong application with a file. Two commands, ASSOC and FTYPE, allow you to correct this problem by managing file associations from a command prompt (or in a batch file). Typing assoc, without parameters, displays the currently defined file extensions. Type assoc .wav to display the .wav file association. Typing assoc .wav= will delete the .wav association. Typing ftype without options displays the file types that have defined open command strings. Enter ftype SoundRec to display the open command string for the file type SoundRec. Typing ftype SoundRec= will delete the open command string. To define a new association for .log files that you want to open with Notepad, use the following syntax: assoc .log=LogFile ftype LogFile=%Systemroot%\System32\notepad.exe %1 You can use a combination of these command-line utilities in a batch file or to re-associate files across your network if you run it as a logon script. For more information, type ftype /? at the command prompt.
Win 9X commands: winipcfg on a Win 9x machine give you IP address info sysedit bring up a system editor for INI files msconfig will give you some configuration optionswindiff for comparing files and directories HWinfo /ui ran from the run command on a Windows 98 machine gives you a wealth of information on the software and hardware on a WIndows 98 machine.
SEARCHING FOR NETWORK SHARES WITH NET VIEW You can use the NET VIEW command-line utility to display a list of a computer's network shares. However, if a server or workstation has several or perhaps even dozens of shares, the list may scroll off your screen. Obviously, you can prevent the list from scrolling by piping the list results through the MORE command, but you would still have to search through a long list for the share you seek. Instead, try piping the NET VIEW results through the FIND command, and specify a search string of characters that appears in the name of the share you're looking for. Consider the following command where %computername% is the name of the target computer and %string% is the search string: NET VIEW \\%computername% | find "%string%" With this command, a list of only the target computer's shares that contain the characters found in the search string will be displayed. For example, NET VIEW \\server1 | find "docs" will find any shares on server1 containing docs. (Keep in mind that the search string is case sensitive.)
TROUBLESHOOTING NETWORK CONNECTIONS WITH W2K's PATHPING UTILITY If you're experiencing packet loss on your network, Windows 2000's PATHPING utility can help you pinpoint the problem. Here's a look at how to generate and read reports and why they're useful.
if
you type a command on a command line and follow dir c:\ && Echo Drive Exists || Echo Drive Doesn't Exist displays
the listing followed by 'Drive Exists' when used with a defined
Making a BootDisk A 3.5" MS-DOS 6.22 boot disk that lets you boot a computer and access shared files across a TCP/IP network is a useful administrative tool. A TCP/IP boot disk is handy when you're using imaging software to roll out a standard client image across the network, running an unattended installation of Windows NT 4.0, or troubleshooting a machine that has a FAT partition. The main problem with a TCP/IP boot disk is fitting onto one disk all the files that you need to access a share across a TCP/IP-based network. Few administrators have access to a machine that they can use to directly format an MS-DOS TCP/IP boot disk. However, you can use the following procedure to make such a disk. You need only a blank 144MB 3.5" disk, an NT Server 4.0 CD-ROM, MS-DOS network adapter drivers, and a Windows workstation. You need to create a separate boot disk for every different type of network adapter you use. Step 1 Step 2 Step 3 Step 4 Step 5 @echo off prompt $p$g SET PATH=A:\DOS Step 6 DEVICE=A:\DOS\HIMEM.SYS DEVICE=A:\DOS\EMM386.EXE FRAME=NONE DOS=HIGH,UMB FILES=30 BUFFERS=20 LASTDRIVE=Z STACKS=9,256 SHELL=A:\COMMAND.COM A:\ /E:512 /P This step completes the creation of the MS-DOS boot disk. Step 7 Step 8 Step 9 Step 10 Type C:\netsetup\setup.exe at the command prompt, then press Enter to start the setup program for Microsoft Network Client 3.0 for MS-DOS. Press Enter again to set up the Network Client software on your boot disk. Step 11 Step 12 If you found in Step 8 that your network adapter doesn't include an oemsetup.inf file, you can select any network adapter from the list, manually copy the nic_card.dos driver for your network adapter into the A:\net folder, and copy into A:\net\protocol.ini the entries in the sample protocol.ini file that comes with your nic_card.dos driver. You also need to change the netcard, lana0, and bindings entries in A:\net\protocol.ini to point to the new driver section. Listing 1, page 72, contains a sample protocol.ini file. After you adjust the protocol.ini file, edit the netcard entry in A:\net\system.ini to point to the new nic_card.dos driver. Listing 2, page 72, shows an example of a system.ini file's [network drivers] section. Step 13 Step 14 Press Enter, and the program returns you to the setup menu. Select Change Setup Options, and on the resulting screen, set Change Logon Validation to Logon to Domain, as Figure 2 shows. Press Enter to return to the setup menu, then select Change Network Configuration. The resulting screen, which Figure 3 shows, contains two boxes; you can press Tab to toggle between the boxes. By default, the NWLink IPX protocol is bound to the network adapter. To add the TCP/IP protocol, shift to the lower box, select Add Protocol, and press Enter. A list of protocols appears. From the list, select Microsoft TCP/IP and press Enter. You return to the previous screen. To remove the NWLink IPX protocol, toggle to the upper box and choose NWLink IPX Compatible Transport. Then, move to the lower box, select Remove, and press Enter. The resulting window will look similar to Figure 3. If your network doesn't use DHCP to configure clients, you need to change the TCP/IP settings to give your network adapter a static IP address. Select Microsoft TCP/IP in the upper box, then toggle to the lower box and select Change Settings. Press Enter. The resulting screen lets you specify an IP address, subnet mask, and default gateway. To disable the DHCP client, you also need to set Disable Automatic Configuration to 1. Step 15 Step 16 C:\net\setup.exe C:\net\sockets.exe C:\net\nwlink.exe C:\net\expand.exe C:\net\ping.exe C:\net\ipconfig.exe C:\net\addname.exe C:\net\win_sock.dll C:\net\winsock.dll C:\net\wsockets.dll C:\net\rascopy.bat C:\net\vbapi.386 C:\net\vsockets.386 C:\net\readme.txt C:\net\*.inf Step 17 Step 18 After you complete these 18 steps, you have a TCP/IP boot disk with about 200KB of space to spare. I've used this method successfully with Ethernet and Token-Ring LAN adapters. If you need boot disks for more than one computer, use the diskcopy.exe command to make copies of your new boot disk. To avoid an identity crisis on your network, you need to change the computername entry in A:\net\system.ini to make each disk unique. If you specified a fixed IP address instead of using DHCP, you need to change the IP address in the TCP/IP section of the A:\net\protocol.ini file to a unique address on each disk you copy. Your TCP/IP boot disk will let you boot clients to your TCP/IP network and use the Netuse command to map network drives. I commonly use TCP/IP boot disks to roll out a standard client image to multiple machines. When client machines have different hardware, I can map a drive to a network share that contains NT 4.0 installation media and use a boot disk to perform a manual or unattended installation of NT 4.0 onto a machine that doesn't have a CD-ROM drive. Putting all the files I need for booting on one disk makes performing these administrative tasks much easier.
USING A BATCH FILE TO CHECK FOR FILE EXISTENCE :check for file existence This routine checks for the existence of the Ftpfile.txt file
every 200
CALLING A BATCH FILE FROM WITHIN A BATCH FILE
To call a batch file from within another batch file, you can use the Call command. This command enables control to be returned to the original batch file when the command is finished. For example, the file below is named Batch.bat: Batch.bat @echo off echo Running First.bat First.bat echo Return control to First.bat call Second.bat echo Running Second.bat Once First.bat finishes, Second.bat will be called. After Second.bat finishes, control will be turned over to Batch.bat. The transfer of control back to Batch.bat enables it to continue with further instructions.
DefPrint is a small utility which allows you to set the default printer from the
At the end of the logon script,
you can run 'defprint lpt1' which sets the
A couple of examples...
How can I maintain printer information for my domain?
Retrieve the date and time in batch files
Sometimes you need to retrieve the current date and
time from within a batch for a command file. For example, say you create a batch
file to perform a backup or copy operation and want the program to write the
current date and time for specific actions to a log file. Or maybe you've
created a batch file that, among other tasks, copies several folders from one
location to another, and you want to export the date and time the action is
completed to a log file. You have a couple of options for extracting that
information: the ECHO command and the Now.exe tool.
Extract with the ECHO command
Handy diagnostic tools Windows 2000 carries forward many of Windows NT's familiar TCP/IP diagnostic commands, but the more recent OS also adds several new commands. Whether you're an experienced or novice Win2K administrator, you'll learn a thing or two from this list of top 10 TCP/IP diagnostic commands. 10. Hostname—Hostname is one of the most basic TCP/IP utilities. It displays the name of the system running the command. C:\>hostname 9. Lpq—The Lpq command displays the status of a remote Line Print Daemon (LPD) print queue. To display the status of a printer named HPLJ4 (identified by the -P switch) on a system named teca4 (identified by the -S switch), enter C:\>lpq -Steca4 -PHPLJ4 8. Arp—You use the Arp command to view, add, or delete entries in the IP-address-to-physical-network-address translation tables that the Address Resolution Protocol (ARP) uses. To display the cached IP and MAC addresses on your system, enter C:\>arp —a 7. Ipconfig—The Ipconfig command displays your system's current TCP/IP configuration settings. Ipconfig can also report your current DNS servers' addresses. C:\>ipconfig /all 6. Netstat—The Netstat command displays your current TCP/IP or UDP connection's status and statistics. Netstat shows both the local and remote name and port of your active network connections. The ? switch displays all the available Netstat switches. To display all active connections in port order, enter: C:\>netstat -n 5. Route—You can use the Route command to edit or view the IP routing table from the command prompt. Win2K uses the routing table when it needs to find a path to another TCP/IP host. The ? switch displays all the available Route command-line options. To use Route Print to view your system's routing table, enter C:\>route print 4. Nslookup—The primary command for diagnosing DNS problems, Nslookup is an interactive utility that displays a special command prompt. To display the Nslookup commands, you can enter help at this command prompt. The ls subcommand lists the DNS domain information. C:\>nslookup 3. Tracert—You use this command to verify that a router path exists between your system and a remote system. Tracert reports the number of hops necessary to reach a given destination. For example, to trace the route to http://www.winnetmag.com, you would enter C:\>tracert www.winnetmag.com 2. Ping—The Ping command is the most basic TCP/IP network diagnostic tool. If you can't ping a system, you probably won't be able to communicate with that system. To ping a system with the IP address 192.168.100.1, for example, you would enter C:\>ping 192.168.100.1 1. Pathping—One of Win2K's coolest new TCP/IP tools, Pathping combines the functionality of the Ping and Tracert commands into one handy and robust diagnostic utility. Pathping pings each router between the originating computer and a target destination, then records each hop's duration and packet loss. To use Pathping against http://www.winnetmag.com, enter C:\>pathping www.winnetmag.com
GRAB THE GUI VERSION OF IPCONFIG
Making A Win 9X Boot Disk:
You’ll first need to make your disk bootable so you can boot from the disk and
use it to access the hard drives on unbootable machines. Open a command prompt
window and enter the command Format A: /S. However, you must consider what
version of Windows is running on the machine that you’re using to make the
disk.
Running the Format+ A: /S command copies the Io.sys, Msdod.sys, and Command.com files from the PC to the floppy. These files make the disk bootable and enable the disk to access the contents of a local hard drive. Just remember that different hard drives use different types of partitions. I recommend using a machine running either Windows Me or Windows 98 to create your boot disk. Both of these versions of Windows support FAT-16 and FAT-32 file systems. Although there are versions of Windows 95 that support FAT-32, you’re usually better off using a newer version of Windows for the repair disk creation. But no matter which of these Windows versions you choose, the disk won’t be able to access the contents of NTFS partitions, such as those created by Windows NT, Windows 2000, and Windows XP. If you need NTFS access, I recommend going to the Winternals Software Web site and checking out ERD Commander or NTFSDOS.
Add CD-ROM capabilities
Once you’ve created a bootable disk, you must next make the disk capable of accessing a CD-ROM drive. This is by far the most difficult part of the process, because it involves finding a suitable driver. You need a DOS-based driver that's universally compatible with all IDE CD-ROM drives. But some manufacturers don’t even include DOS drivers with their CD-ROM drives any more. I’ve had the best luck by calling up friends who have old PCs in their offices and copying drivers off of those machines.
I’ve been unable to find a single driver that works with every single drive,
but I have a Hitachi driver that comes close. To get around the compatibility
problem, I placed several different CD-ROM drivers on my emergency repair
disk. I set the disk up so that when I boot the system, I get a boot menu that
lists several different choices for drives.
Creating the Config.sys file
So how do you create the Config.sys file? Begin by copying the Mscdex.exe file from the Windows machine’s \WINDOWS\COMMAND folder to the disk. Next, copy the drivers you’ve selected to the disk. Then, create a Config.sys file on the disk that sets up the menu system.
Below is the actual Config.sys file from my emergency repair disk. The [MENU]
section sets up the menu colors and the menu items. Notice that each menu item
has a two-letter code followed by a description. The description is actually
displayed. The code corresponds to one of the bracketed sections below. When
you select a menu option, the operating system looks at the code associated
with the option and jumps to that section of the file.
The [COMMON] section is reserved for any commands that should be processed
regardless of menu choice.
[MENU] MENUCOLOR=15,1 MENUITEM=AZ, AZI CD-ROM Drivers MENUITEM=HP, Goldstar CD-ROM Drivers for HP Vectra MENUITEM=MC, Hitachi CD-ROM Drivers MENUITEM=BP, Back Pack CD-ROM Drivers MENUITEM=SY, Sony External CD-ROM Drivers MENUITEM=NN, No CD-ROM Drivers
[COMMON]
device=himem.sys device=drvspace.sys
[AZ]
REM AZI CD-ROM Drivers DEVICEHIGH=a:\SGIDECD.SYS /D:MSCD000
[HP]
rem The following line is for the HP Vectra DEVICEHIGH=a:\gscdrom.SYS /D:MSCD000
[MC]
REM Standard Hitache CD-ROM Drivers DEVICEHIGH=a:\d011v110.SYS /D:MSCD000
[BP]
rem the following line is for the backpack CD-ROM device=a:\bpcddrv.sys /d:bpcddrv$
[SY]
rem the following line is for the external Sony CD-ROM DEVICE=SLCD.SYS /D:SONY_000 /B:340 /M:P /V /C /E:2
[NN]
rem No CD-ROM Drivers Tips for creating the perfect Windows boot disk Page 2 of 2
Creating the Autoexec.bat file
The contents of the Autoexec.bat file will differ widely depending on what you want your disk to do. If you need to be able to use a CD-ROM drive, the Autoexec.bat file must contain a line that loads the Mscdex.exe file.
Below, I’ve included my actual Autoexec.bat file. Notice that I’ve begun the
file with a few common commands, followed by the Goto %Config% command. This
command tells the file that the Config.sys file contained a menu. Below that
line, you’ll see the same two letter codes that I used before. Below each code
is the appropriate Mscdex.exe command for the given driver. At the end of the
file is an End statement. This statement simply tells Autoexec.bat that this
is the end of the menu choices, not the end of the file. So you can place
additional commands that would be processed regardless of menu choice below
the End command.
@echo off prompt $p$g path=a:\;c:\windows\command;c:\windows GOTO %CONFIG% :AZ REM AZI CD-ROM Driver mscdex /d:mscd000 GOTO END
:HP
REM Goldstar CD-ROM Driver for HP Vectra mscdex /d:mscd000 GOTO END
:MC
REM Hitachi CD-ROM Driver mscdex /d:mscd000 GOTO END
:BP
REM Back Pack CD-ROM Driver MSCDEX /D:BPCDDRV$ GOTO END
:SY
REM Sony CD-ROM Driver MSCDEX /D:SONY_000 GOTO END
:NN
REM No CD-ROM Driver GOTO END
:END
Rem End of file
Add utility files
The last step of the process is to put some files on the disk that will be beneficial to you in crisis situations. Ideally, it would be nice to include the entire contents of the \WINDOWS\COMMAND folder. However, a floppy disk has a very limited capacity, so you must pick and choose which files to include. I’ve experimented a lot over the years, and determined the following files to be of the most benefit to me:
Attrib.exe
Chkdsk.exe Deltree.exe Device.com Diskcopy.com Doskey.com Edit.com Edit.hlp Extract.exe Fdisk.exe Format.com Himem.sys Mem.exe Mode.com More.com Mscdex.exe Scandisk.exe Sys.com Xcopy32.exe Xcopy.exe
|
