Skip to content

Instantly share code, notes, and snippets.

@githubfoam

githubfoam/windows_administrator_daily_tasks

Last active August 12, 2025 07:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save githubfoam/80647016e3955c5820f8a61cc630708e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save githubfoam/80647016e3955c5820f8a61cc630708e to your computer and use it in GitHub Desktop.
Download ZIP
windows_administrator_daily_tasks
Raw
windows_administrator_daily_tasks
==========================================================================================================
problem:
The action can't be completed because the folder or a file in it is open in
another program
Close the folder or file and try again.
fix:
Option 1 – Use Resource Monitor (built-in)
Press Ctrl + Shift + Esc to open Task Manager.
Go to the Performance tab.
At the bottom, click Open Resource Monitor.
In Resource Monitor, go to the CPU tab.
In the Associated Handles search box (bottom right), type part of the folder or file name.
Wait for results — you’ll see the Process Name and PID that has it open.
You can:
Right-click the process → End Process (careful — it closes whatever the app is doing).
Or just close the application normally.
Option 2 – Use Sysinternals Handle.exe (Command-Line)
Microsoft Sysinternals tools are very powerful for this.
Download Handle.exe from Microsoft:
https://learn.microsoft.com/sysinternals/downloads/handle
Extract it somewhere, e.g., C:\Tools.
Open Command Prompt as Administrator.
Run:
cd C:\Tools
handle.exe "folder_or_file_name"
It will list all processes that have a handle open to that file/folder.
Note the PID and close/kill the process with:
taskkill /PID 1234 /F
Option 3 – Use Process Explorer (GUI, recommended)
Download Process Explorer from Microsoft:
https://learn.microsoft.com/sysinternals/downloads/process-explorer
Run procexp.exe as Administrator.
Press Ctrl + F and type part of the file/folder name.
Process Explorer will list which processes have it open.
Double-click the result → it highlights the process.
You can right-click the handle and Close Handle (careful — closing the wrong one can cause app crashes).
==========================================================================================================
#Command Prompt
cls #type: cls and press Enter. clears the entire application screen
Escape #Clear Text on the Command Prompt Screen
Backspace #Delete one character to the left of your curso
Ctrl+Backspace #Delete one word to the left of your cursor.
Ctrl+C #Stop the line from being typing or running command and move to a new prompt on the following line.
==========================================================================================================
# show computer name/device name/machine name
#cmd
>hostname
>systeminfo /s %computername% | findstr /c:"Model:" /c:"Host Name" /c:"OS Name
>echo %computername%
>net config workstation | findstr /C:"Full Computer name"
>wmic computersystem get name
------------------------------------------------------------------------------------------
#Hosts File
Windows 10 - "C:\Windows\System32\drivers\etc\hosts"
Linux - "/etc/hosts"
Mac OS X - "/private/etc/hosts"
==========================================================================================================
setx REQUESTS_CA_BUNDLE /path/to/my-ca.pem
echo %REQUESTS_CA_BUNDLE% #confirm that the environment variable was set correctly
==========================================================================================================
#add to the PATH, set environment variable,restart cmd
>setx /m PATH "C:\myfolder;%PATH%" #set the system variable (elevated cmd)
>setx PATH "C:\myfolder;%PATH%" #set local environment variable
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment #set the system variable
HKEY_CURRENT_USER\Environment #set local environment variable
------------------------------------------------------------------------------------------
\\192.168.60.61\f$\tmp #browsing with admin credentials
-----------------------------------------------------------------------------------------------------------------
#create scheduled task with command prompt/powershell
schtasks /create /tn "FailedLogins" /tr "C:\scripts\failed_logins.ps1" /sc DAILY /st 00:00 /st 12:00
schtasks /create /tn "Failed Login Attempts" /tr "C:\tmp\pwsh scripts\Failed Login Attempts.ps1" /sc DAILY /st 00:00 /st 09:06
schtasks /create /tn "MyDailyScript" /tr "powershell.exe -File C:\Scripts\MyScript.ps1" /sc daily /st 10:00
schtasks /create /tn "Failed Login Attempts" /tr "powershell.exe -File C:\tmp\pwsh scripts\Failed Login Attempts.ps1" /sc daily /st 09:10
-----------------------------------------------------------------------------------------------------------------
#ChatGPT
To schedule a PowerShell script on a Windows 10 computer that is a member of a domain and write its output into a file, you can use the Task Scheduler. The Task Scheduler allows you to automate the execution of tasks, including running PowerShell scripts, at specified times or events.
When scheduling the task, you need to choose the appropriate account to run the task. Here are the steps to schedule a PowerShell script:
Open the Task Scheduler: Press Win + X on your keyboard, then select "Task Scheduler" from the menu.
In the Task Scheduler window, click on "Create Basic Task" or "Create Task" in the Actions pane on the right, depending on your version of Windows.
Provide a name and description for the task, then click "Next."
Choose the trigger that specifies when the task should run. You can schedule it to run daily, weekly, at system startup, or based on specific events. Select the appropriate trigger and click "Next."
Choose "Start a program" as the action to perform, then click "Next."
In the "Program/script" field, browse and select the PowerShell executable (powershell.exe). The default path is usually C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.
In the "Add arguments" field, specify the path to your PowerShell script. For example: -File "C:\Path\to\YourScript.ps1"
In the "Start in" field, specify the directory where your script is located. For example: "C:\Path\to\Script\Directory"
Optionally, you can set additional conditions or settings for the task, such as defining the user account to run the task under, setting up security options, or configuring the task to run with highest privileges.
Click "Finish" to create the scheduled task.
To specify the account that runs the task, you can choose between the following options:
Use a specific user account: You can specify a domain user account that has the necessary permissions to execute the PowerShell script and write to the desired directory. This account should have appropriate access rights to access the script, write to the output directory, and any other resources required by the script.
Use the system account: Choosing the system account (NT Authority\System) allows the script to run with the highest privileges, but it may have limited access to domain resources. This option is suitable if your script does not require access to network resources or if it runs with minimal interaction with the system.
It's generally recommended to use a specific user account with the necessary permissions to execute the script and access the required resources. This allows for better control and traceability of the task execution.
After scheduling the task, it will run automatically based on the specified trigger and the output of the PowerShell script will be written to the specified file in the directory you provided.
-----------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------
#Microsoft Bing
To schedule a PowerShell script silently using Task Scheduler on Windows 11, you can follow these steps:
Press Windows key + R to open the Run dialog box.
Type taskschd.msc and press Enter.
In Task Scheduler, click on “Create Basic Task” under “Actions” in the right pane.
Name your task and click “Next”.
Choose when you want the task to start and click “Next”.
Choose “Start a program” and click “Next”.
In the “Program/script” field, enter the path to your PowerShell executable (usually C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe).
In the “Add arguments (optional)” field, enter -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Path\To\Your\Script.ps1" where C:\Path\To\Your\Script.ps1 is the path to your PowerShell script.
Click “Next” and then click “Finish”.
Your PowerShell script will now run automatically according to your schedule without displaying a window.
-----------------------------------------------------------------------------------------------------------------
#create scheduled task with elevated privilleges
Run - "task scheduler"
Task-Properties-"Run with Highest Privileges"
Task-Properties-"Run whether user is logged on or not"
==========================================================================================================
Windows Key + "Task Scheduler"
#Scheduled task to kill App1.exe
#kill_app1.bat file
@ECHO OFF
taskkill /F /IM App1.exe /T
ECHO Alpemix gone
==========================================================================================================
Server Manager-File and Storage Services-Shares-Tasks-New share-"SMB Share – Quick"-Type a custom path-"access-based enumeration" #Share Folder, netlogon and sysvol shared by default
==========================================================================================================
Windows key + R to open the Run box + Type ServerManager #Launch Server Manager
Open PowerShell + Type ServerManager Type ServerManager #Launch Server Manager
==========================================================================================================
C:\Windows\System32\winevt\Logs #windows event logs
==========================================================================================================
Event Viewer-Windows Logs-System-Filter Current Log-All Event IDs-41,1074,1076,6005,6006,6008,6009,6013 #Shutdown Logs in Event Viewer
PS C:\> Get-EventLog System -Newest 10000 | `
Where EventId -in 41,1074,1076,6005,6006,6008,6009,6013 | `
Format-Table TimeGenerated,EventId,UserName,Message -AutoSize -wrap
==========================================================================================================
>wmic path win32_computersystemproduct get uuid #A universally unique identifier (UUID) is a 128-bit label used for information in computer systems.
==========================================================================================================
"To sign in remotely, you need the right to sign in through Remote Desktop Services. By default members of the Administrators group have this right. If the group you're in does not have the right, or if the right has been removed from the Administrators group, you need to be granted the right manually."
2012 Server
The user account is a member of the local group Remote Desktop Users or Administrators;
The user group is allowed to connect in the local Group Policy parameter Allow the log on through Remote Desktop Services
==========================================================================================================
Control Panel-System-Advanced system settings-Environment Variables-System Variables #Set environment variables
#run as administrator
set the "JAVA_HOME" system variable to "C:\Program Files\Java\jdk-17.0.1"
setx JAVA_HOME "C:\Program Files\Java\jdk-17.0.1" /m
setx REQUESTS_CA_BUNDLE "C:\path\to\my\certificate.pem" /m
set | findstr REQUESTS_CA_BUNDLE
==========================================================================================================
#ChatGPT
To check the zone transfer security settings for a domain on the Windows DNS server, follow these steps:
Open the DNS Manager on your Windows DNS server.
Expand the server name and then click on the "Forward Lookup Zones" folder.
Right-click on the domain that you want to check and select "Properties" from the context menu.
Click on the "Zone Transfers" tab in the Properties window.
Under the "Zone Transfers" section, you will see the options for allowing or denying zone transfers to different servers.
Check that the "Allow zone transfers" checkbox is selected, and then check the "Only to servers listed on the Name Servers tab" option.
Ensure that only the authorized DNS servers are listed in the "Name Servers" tab.
If you want to further restrict zone transfers, you can select the "Only to the following servers" option and add specific IP addresses or hostnames of the servers that are allowed to perform zone transfers.
By following these steps, you can check and adjust the zone transfer security settings for a domain on your Windows DNS server to ensure that only authorized servers are allowed to perform zone transfers. This helps to prevent unauthorized access to your DNS zone information and protects the security of your network.
==========================================================================================================
#DNS Server : Add MX record
DNS Manager-Forward Lookup Zones-right-click the own domain name-select New Mail Exchanger(MX)- Hostname and FQDN of Mail exchanger-checkbox [Create associated pointer (PTR) record]
#verify
>nslookup
> set type=mx
> example.com
> exit
==========================================================================================================
#DNS Server : Add A/PTR record, create a new A-record
DNS Manager-Forward Lookup Zones-right-click the own domain name-select [New Host(A or AAA)-Hostname and IP address-checkbox [Create associated pointer (PTR) record]
#verify
nslookup 8.8.8.8 #PTR Record Lookup (IP to Domain Name), know the IP address and find the domain name,reverse DNS lookup, verify if an IP address is related to a specific domain
nslookup adpros.com #A Record Lookup (Domain to IP Address)
==========================================================================================================
# Enable Remote Desktop
(Get-WmiObject Win32_TerminalServiceSetting -Namespace rootscimv2\TerminalServices).SetAllowTsConnections(1,1) | Out-Null
(Get-WmiObject -Class "Win32_TSGeneralSetting" -Namespace root\cimv2\TerminalServices -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0) | Out-Null
Get-NetFirewallRule -DisplayName "Remote Desktop*" | Set-NetFirewallRule -enabled true
==========================================================================================================
Control Panel\Network and Internet\Internet Options\Content\Clear SSL state # Windows 10 clear SSL cache
==========================================================================================================
==========================================================================================================
#Virtualbox
VT-x is disabled in the BIOS for both all CPU modes
fix: Restart - F10 - BIOS - Security - System Security - Virtualization Technology(VTx - VTd) - enable
==========================================================================================================
#cmd
reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP" /s
reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s #make sure that version 4.x is installed
cd C:\Windows\Microsoft.NET\Framework #use File Explorer to check the .NET Framework version
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP #regedit
==========================================================================================================
Physical Address, MAC Address
>ipconfig /all #the Ethernet Adapter Local Area Connection,Physical Address, MAC Address
>getmac
>getmac /v
>getmac /S remotepc.domain.com /u administrator /p adminpassword
>getmac /s computername
>getmac /s 192.168.1.1
>getmac /s localhost
>arp -a #remote
>arp -a 172.24.0.112
>nbtstat -a 10.63.71.55
==========================================================================================================
>2>&1 java -XshowSettings:properties -version | findstr "java\.home" #find the JRE path
>java.exe -XshowSettings:properties -version 2>&1 | findstr "java\.home"
>java -XshowSettings:properties -version | findstr "java.home"
==========================================================================================================
#ChatGPT
==========================================================================================================
dir /b /s /a:-D > dirlist.txt & more dirlist.txt #The output is redirected to the file dirlisting.txt and displayed on screen
dir /al /s #List all junctions, symlinks and symlink directories in the current directory and its subdirectories
dir /al /s | findstr "<JUNCTION>" #List all junctions in the current directory and its subdirectories
dir /al /s | findstr "<SYMLINK>" #List all symlinks in the current directory and its subdirectories:
dir /al /s | findstr "<SYMLINKD>" #List all symlink directories in the current directory and its subdirectories
fsutil.exe hardlink list C:\Windows\System32\notepad.exe
#delete directory problem
> dir /x
03/05/2020 18:17 <DIR> LOOK%2~1 Look%20at%20the%20guy,%20people%20love%20him.
>rd /q /s LOOK%2~1
==========================================================================================================
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/rapid7/metasploitable3/master/Vagrantfile" -OutFile "Vagrantfile"
--------------------------------------------------------------------------------------------------------------------------
%USERPROFILE% # user home dir windows
cd~ #user home dir linux
.bash_history # all executed commands in user shell
==========================================================================================================
cd %USERPROFILE% #when debugging a command
echo cd %USERPROFILE% #when debugging a command
==========================================================================================================
set USERPROFILE #query the value of %USERPROFILE%
set #see all currently defined environment variables
mkdir %USERPROFILE%\.kube
==========================================================================================================
#show history
function key(fn) on keyboard + F7 #1st option
doskey/history #2nd option
==========================================================================================================
#Active Directory
To quickly list all the groups in your domain, with members
dsquery group -limit 0 | dsget group -members –expand
To find all users whose accounts are set to have a non-expiring password
dsquery * domainroot -filter “(&(objectcategory=person)(objectclass=user)(lockoutTime=*))” -limit 0
To list all the FSMO role holders in your forest
netdom query fsmo
==========================================================================================================
To refresh group policy settings
gpupdate
list all applied GPO on client machine
gpresult /H c:/tmp/policy.html
#all the policies applied to the user account(cmd)
gpresult /Scope User /v
#all policies applied to your Computer (cmd)
gpresult /Scope Computer /v
#verify the resultant set of policy (RSoP) for the computer and the user.
#This console displays a list of all policies that are currently applied to the computer and user.
RUN "rsop.msc"
==========================================================================================================
#ChatGPT
You can check whether a Windows 10 installed computer is joined to a domain using the following steps:
Open the Start menu and type "Control Panel" in the search box. Select "Control Panel" from the results.
In the Control Panel, select "System and Security".
Select "System". This will display basic information about the computer.
Look for the "Domain" information under "Computer name, domain, and workgroup settings". If the computer is joined to a domain, the domain name will be displayed. If the computer is not joined to a domain, the workgroup name will be displayed instead.
Alternatively, you can use PowerShell to check whether a Windows 10 installed computer is joined to a domain using the following steps:
Open PowerShell by typing "PowerShell" in the Start menu search box and selecting "Windows PowerShell" from the results.
Type the following command and press Enter: Get-WmiObject -Class Win32_ComputerSystem | Select-Object Domain
If the computer is joined to a domain, the domain name will be displayed. If the computer is not joined to a domain, no information will be displayed for the Domain property.
These methods can be used to quickly check whether a Windows 10 installed computer is joined to a domain or not.
==========================================================================================================
#ChatGPT
#troubleshooting latency on client computerbetween Active Directory (AD) and
#a client computer when a Group Policy Object (GPO) is applied,
1-Check the network connectivity; ping
2-Verify DNS settings; nslookup
3-Check AD replication;repadmin /replsummary
4-Verify GPO settings;gpresult
5-Check the client computer's event logs;Event ID of 1058 or 1030
6-Group Policy Management Console (GPMC) > Group Policy Results Wizard
7-Group Policy Management Console (GPMC) > Group Policy Modeling Wizard
8-Network troubleshooting; wireshark etc network connectivity or DNS resolution
==========================================================================================================
To check Active Directory replication on a domain controller
repadmin /replsummary
To force replication from a domain controller without having to go through to Active Directory Sites and Services
repadmin /syncall
To see what server authenticated you (or if you logged on with cached credentials) you can run either of these commands:
set l
echo %logonserver%
whoami #To see what security groups you belong to
whoami /groups #To see what security groups you belong to
whoami /all #display all of the information in the current access token
To see the domain account policy (password requirements, lockout thresholds, etc)
net accounts
To add an entry to your routing table that will be permanent, run the route add command with the –p option
route add 0.0.0.0 mask 0.0.0.0 172.16.250.5 –p
To quickly reset your NIC back to DHCP with no manual settings,
netsh int ip reset all
Need to run a trace
netsh trace start capture=yes tracefile=c:\capture.etl
netsh trace stop
To see all network connections your client has open
net use
To see your routing table, run either of these commands
route print
netstat -r
netstat –ano 1 #“o” will show the owning process ID that is related to each of the connections
netstat –ano 8 #“n” will show the addresses and port numbers as numericals.
netstat –ano 40 #“a” will display all connections and listening ports
netstat –ano | findstr 216.134.217.20 #add a | findstr value to watch for only a specific connection, like a client ip.addr or port
netstat -ab | findstr ":443" #“b” will display all executables that are involved in creating each listening port
netstat –ano 1| findstr 216.134.217.20
netstat –ano 50| findstr 216.134.217.20
netstat -ano 1 | findstr :139
netstat -ano 50 | findstr :139
List out all connections
netstat -a
List only TCP connections
netstat -at
List only UDP connections
netstat -au
Disable reverse dns lookup for faster output
netstat -ant
List out only listening connections
netstat -tnl
Get process name/pid and user id
netstat -nlpt
netstat -ltpe
Print statistics
netstat -s
Display kernel routing information
netstat -rn
Print network interfaces
netstat -i
Get netstat output continuously
netstat -ct
https://benohead.com/blog/2013/07/21/tcp-about-fin_wait_2-time_wait-and-close_wait/ #state transition diagrams
View and Manage the Local IPv4 Routing Table
view the IPv4 routing table
netstat –r
route print
add a route to the IPv4 routing table
route add
modify an existing route
route change
remove an existing route
route delete
## look for unusual network usage
# displays shared folders that are on the system, shared folders that are not supposed to be there
net view \\127.0.0.1
net view localhost
# displays open sessions with other systems on the network
net session
# which sessions this machine has opened with other systems
net use
# display NetBIOS activity over TCP/IP
nbstat –S
# Look for unusual listening TCP and UDP ports
netstat –na
# continuously updated and scrolling output of this command every 5 seconds
netstat –na 5
# The –o flag shows the owning process id
netstat –nao
netstat –nao 5
# The –b flag shows the executable name and the DLLs loaded for the network connection
netstat –naob5
ipconfig /all IP Configuration (Display Connection Configuration)
ipconfig /displaydns IP Configuration (Display DNS Cache Contents)
ipconfig /flushdns IP Configuration (Delete DNS Cache Contents)
ipconfig /release IP Configuration (Release All Connections)
ipconfig /renew IP Configuration (Renew All Connections)
ipconfig /registerdns IP Configuration (Refreshes DHCP & Re-Registers DNS)
ipconfig /showclassid IP Configuration (Display DHCP Class ID)
ipconfig /setclassid IP Configuration (Modifies DHCP Class ID)
netsh interface ip set
netsh interface ip set address -> configure the address type (DHCP or manually configured), the IPv4 address, subnet mask, and default gateway.
netsh interface ip set dns -> configure the source of DNS server addresses (DHCP or manually configured), a DNS server address, and DNS registration behavior.
netsh interface ip set wins -> configure the source of WINS server addresses (DHCP or manually configured) and a WINS server address.
netsh interface ip show config
netsh –r filesrv1 interface ip show config -> display the configuration of the remote computer named FILESRV1
arp –a -> display the current contents of the ARP cache
arp –d * -> flush the ARP cache
==========================================================================================================
Windows provides the following tools for
TCP/IP problems:
Arp
Hostname
Ipconfig
Nbtstat
Netsh
Netstat
Nslookup
Ping
Route
Tracert
Pathping
SNMP service
Event Viewer
Performance Logs and Alerts
Network Monitor
Netdiag.
obtain the IPv4 address of your default gateway
ipconfig
netsh interface ip show config
route print
==========================================================================================================
Repair the Connection
Click Start, click Control Panel, and then double-click Network Connections. Right-click the connection that you want to repair, and then click Repair.
The tasks that are performed by Network Connection Repair are the following:
Checks whether DHCP is enabled and, if enabled, sends a broadcast DHCPRequest message to refresh the IPv4 address configuration.
Flushes the ARP cache. This is equivalent to the arp -d * command.
Flushes and reloads the DNS client resolver cache with entries from the Hosts file. This is equivalent to the ipconfig /flushdns command.
Re-registers DNS names using DNS dynamic update. This is equivalent to the ipconfig /registerdns command.
Flushes and reloads the NetBIOS name cache with #PRE entries in the Lmhosts file. This is equivalent to the nbtstat -R command.
Releases and then re-registers NetBIOS names with the Windows Internet Name Service (WINS). This is equivalent to the nbtstat -RR command.
Verify Configuration
ipconfig /all
The display of the ipconfig /all command includes IPv4 addresses, default gateways, and DNS settings for all interfaces. The Ipconfig tool only works on the local computer.
netsh interface ip show config
The display of the netsh interface ip show config command includes DNS and WINS servers per interface.
netsh –r filesrv1 interface ip show config
display the configuration of the remote computer named FILESRV1
Manage Configuration
netsh interface ip set address
configure the address type (DHCP or manually configured), the IPv4 address, subnet mask, and default gateway
netsh interface ip set dns
configure the source of DNS server addresses (DHCP or manually configured), a DNS server address, and DNS registration behavior
netsh interface ip set wins
configure the source of WINS server addresses (DHCP or manually configured) and a WINS server address
Ipconfig commands to manage DHCP addresses
ipconfig /release
ipconfig /renew
ipconfig /showclassid
ipconfig /setclassid
#troubleshoot DHCP,on DHCP clients
#no firewall blocking ports 67 and 68 UDP on the client computer
#MAC filtering is enabled on the switches to which the client is connected
#collect data from the server and affected client, use Wireshark etc.
>net start | findstr "DHCP" #cmd,DHCP Client service is started and running
ipconfig /release #cmd
ipconfig /renew #cmd
Event Viewer-Windows Logs-System-Create Custom View-By source-Event sources-Dhcp Client #add DHCP client logs
Event Viewer-Windows Logs-System-Create Custom View-By source-Event sources-Dhcp Client #add DHCPv6 client logs
Event Viewer-Windows Logs-System-Create Custom View-By log-Applications and Services Logs › Microsoft › Windows › Microsoft-Windows-DHCP client-DHCP Client Events/Operational #
Event Viewer-Windows Logs-System-Create Custom View-By log-Applications and Services Logs › Microsoft › Windows › Microsoft-Windows-DHCP Client Events/Admin #
#interpret the events that are listed in the logs. For example, Interface ID, MAC address, and so on.
Get-NetIPAddress | where {$_.PrefixOrigin -eq "DHCP" -or $_.SuffixOrigin -eq "DHCP"} #whether the DNS client on a machine is configured as static or dynamic
Get-NetAdapter –Physical #list of physical network adapters
Get-NetAdapter –IncludeHidden #show any hidden network adapters
Get-NetAdapter | Where {$_.Virtual –eq $True} #only the virtual network adapters
Verify Reachability
arp –a
display the current contents of the ARP cache
arp –d *
flush the ARP cache.This command also removes static ARP cache entries
Ping the default gateway
obtain the IPv4 address of your default gateway
ipconfig
netsh interface ip show config
route print
Ping a remote destination by its IPv4 address
This step might not succeed if the destination is filtering all ICMP messages
Trace the route to the remote destination
tracert –d
–d command line option prevents the Tracert tool from performing a DNS reverse query on every near-side router interface in the routing path
This step might not succeed if the intermediate routers or the destination are filtering all ICMP messages
Check Packet Filtering
On the source node, check for the following:
Active IPsec policies with the IP Security Monitor snap-in
Verify Router Reliability
suspect a problem with router performance
trace the route a packet takes to a destination and display information on packet losses for each router and link in the path
pathping –d IPv4Address
Verifying DNS Name Resolution for IPv4 Addresses
Verify DNS configuration
Display and flush the DNS client resolver cache
Test DNS name resolution with the Ping tool
Use the Nslookup tool to view DNS server responses
==========================================================================================================
#troubleshooting DNS Server #https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup
A: Specifies a computer's IP address.
ANY: Specifies a computer's IP address.
CNAME: Specifies a canonical name for an alias.
GID Specifies a group identifier of a group name.
HINFO: Specifies a computer's CPU and type of operating system.
MB: Specifies a mailbox domain name.
MG: Specifies a mail group member.
MINFO: Specifies mailbox or mail list information.
MR: Specifies the mail rename domain name.
MX: Specifies the mail exchanger.
NS: Specifies a DNS name server for the named zone.
PTR: Specifies a computer name if the query is an IP address; otherwise, specifies the pointer to other information.
SOA: Specifies the start-of-authority for a DNS zone.
TXT: Specifies the text information.
UID: Specifies the user identifier.
UINFO: Specifies the user information.
WKS: Describes a well-known service.
#verify dns server
nslookup akadia.com 193.247.121.196 #dns query via server,optional
nslookup #Start nslookup for DNS Server
> server 193.247.121.196
#Check Start of Authority (SOA)
> set q=SOA
> akadia.com
Check the Nameservers (NS)
> set q=NS
> akadia.com
Check E-Mail MX-Records (MX)
> set q=MX
> akadia.com
Check everything (ANY)
> set q=any
> akadia.com
Lookup all hosts within a domain
> ls -d akadia.com
#query
>akadia.com
ipconfig /all #Verify DNS Configuration
netsh interface ip show dns #obtain information about which DNS names should be registered in DNS
ipconfig /registerdns #register the appropriate DNS names as IPv4 address resource records (also known as A resource records) with DNS dynamic update
#Display and Flush the DNS Client Resolver Cache
ipconfig /displaydns #display the contents of the DNS client resolver cache
/flushdns #flush the contents of the DNS client resolver cache and reload it with the entries in the Hosts file
Test DNS Name Resolution with Ping
If the Ping tool is using the wrong IPv4 address,
flush the DNS client resolver cache with the ipconfig /flushdns command
and use the Nslookup tool to determine the set of addresses returned in the DNS Name Query Response message
Nslookup > prompt, use the set d2
display the maximum amount of information about the DNS response messages.
look up the desired FQDN and display the details of the DNS response message.
Look for A records in the detailed display of the DNS response messages
#Authoritative answer,the answer that originates from the DNS Server which has the information about the zone file
#Non-authoritative answer,When a nameserver is not in the list for the domain,nslookuped on
#By default, the DNS servers use port 53
>nslookup #get default DNS server and its IP address
#Non-authoritative answer;when the reply comes from a source which is not considered authoritative for the domain which it’s returning a record for
#the response is coming from local default DNS server which would come as non-authoritative because it is not listed in the list of nameservers for microsoft.com
>nslookup microsoft.com #nslookup microsoft.com and get the DNS server name and its IP address
Nslookup > prompt, use the set d2 #determine the set of addresses returned in the DNS Name Query Response message
#PTR Record Lookup (IP to Domain Name), know the IP address and find the domain name,reverse DNS lookup,
#verify if an IP address is related to a specific domain
nslookup 8.8.8.8
nslookup adpros.com #A Record Lookup (Domain to IP Address),how many A records are there and see the IP Addresses of each one
>nslookup yahoo.com #pick up IP
>nslookup 74.6.231.20 #Verify the rDNS record:
#find out the rDNS record of a subdomain in a Windows DNS server
DNS Manager > Reverse Lookup Zones >
#check the PTR record that links an IP address to a domain name
# verify if an IP address belongs to a domain name by performing a reverse DNS quer
#put the IP address in reverse,add in-addr.arpa because it is stored in arpa’s top-level-domain
>nslookup -type=ptr 20.231.6.74.in-addr.arpa
type nslookup hit enter, set q=mx hit enter
#mx record lookup,find mail server that is responsible for accepting email for the domain.
nslookup -query=mx example.com
type nslookup hit enter, set q=soa hit enter,type domain hit enter
#The Start of Authority record,return the primary name server, responsible mail addresses, default ttl etc,get information about the zone
nslookup -type=soa example.com
type nslookup hit enter, set q=cname hit enter,type domain hit enter
type nslookup hit enter, set q=ns hit enter,type domain hit enter #return the name servers a domain is using
nslookup -type=ns example.com #see which is the authoritative server for a specific domain
nslookup -type=any example.com #find all of the available DNS records of a domain,specific lookups for different types of DNS records
nslookup example.com ns1.nsexample.com # review a particular DNS server and how it works
nslookup example.com 208.67.222.222 #performs a DNS lookup on the example.com domain using an OpenDNS server (which has IP address 208.67.222.222)
#Using an alternative DNS Server,troubleshooting,a website isn’t loading on internal network but does on external network
type nslookup hit enter,server=DNS-Server-IP hit enter,type domain name hit enter #see if internal DNS is returning different results than an external DNS server,use ISP DNS server or google
ipconfig /all #verify the IP address, subnet mask, and default gateway,check what DNS is set on a Windows system,the IP listed for the DNS server and see if the client can ping
ipconfig /flushdns #Flush DNS Cache,The client’s cache could be the problem
nslookup www.yahoo.com 8.8.8.8 #Check whether the DNS server is authoritative for the name that is being looked up.
#If server does not forward queries to another server, test whether server can query a root server
type nslookup hit enter, server <IP address of server being examined> hit enter,set q=NS, type domain hit enter
#querying all the DNS servers from the root down to the server for a broken delegation
type nslookup hit enter, server <IP address of server being examined> hit enter,set norecursion,set querytype= <resource record type>, <FQDN> hit enter
nslookup <client name> <server IP address> #check whether the DNS server is reachable from client computers,If the resolver returns the IP address of the client, the server does not have any problems
nslookup -port=56 example.com #check the connection through different ports, see if there are open ports that are not used, close ports for security reasons
nslookup -timeout=20 example.com #give more time for the server to respond
type nslookup hit enter, set debug hit enter,type domain hit enter #Using Verbose,more details
> set d2 #Turns the verbose debugging mode on or off.
> debug yahoo.com
nslookup -debug example.com #detailed information both for the question and for the received answer
#restart the DNS Server service
net start DNS #If the resolver returns a "Request to server timed out" or "No response from server" response, the DNS service probably is not running
dnscmd /clearcache #Flush the resolver cache,administrative Command Prompt
Clear-DnsServerCache #run the following cmdlet, administrative PowerShell window
dig +trace(unix command!! not windows) #test DNS Forwarders,shows which servers are queried in the process
==========================================================================================================
#Dcdiag is a Microsoft Windows command line utility that can analyze the state of domain controllers in a forest or enterprise
#If Remote Server Administration Tools (RSAT) tools is installed then Dcdiag is installed,If AD DS role is installed then Dcdiag is installed
#list domain controllers in Active Directory
PS > Get-ADDomainController -Filter * | Select-Object Name, Domain, Site, IPv4Address
dcdiag /s:DC1 #run all the DC tests
dcdiag /s:DC1 /v #display more details
dcdiag /s:DC1 /f #save to a log file
dcdiag /s:DC1 /a #run against all domain controllers
dcdiag /s:DC1 /c /v /f:c:\it\dcdiag_test.txt
dcdiag /s:dc1 /test:dns #run a DNS test
dcdiag /s:DC1 /c /v /f:c:\it\dcdiag_test.txt #run all tests, displays all the details, and outputs its to a file
dcdiag /s:DC1 /q #only display the errors
#Verify DNS Functionality to Support Directory Replication,run a DNS test
>dcdiag /test:dns /v /s:DC1 /DnsBasic /f:C:\tmp\dcdiag_reports\reports_dc1_diagreport.txt
#test DNS with DCDiag, https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731968(v=ws.11)
dcdiag /test:DNS [/DnsBasic | /DnsForwarders | /DnsDelegation | /DnsDynamicUpdate | /DnsRecordRegistration | /DnsResolveExtName [/DnsInternetName:<InternetName>] | /DnsAll] [/f:<LogFile>] [/x:<XMLLog.xml>] [/xsl:<XSLFile.xsl> or <XSLTFile.xslt>] [/s:<DomainController>] [/e] [/v]
/DnsBasic Performs basic DNS tests, including network connectivity, DNS client configuration, service availability, and zone existence.
/DnsForwarders Performs the /DnsBasic tests, and also checks the configuration of forwarders.
/DnsDelegation Performs the /DnsBasic tests, and also checks for proper delegations.
/DnsDynamicUpdate Performs /DnsBasic tests, and also determines if dynamic update is enabled in the Active Directory zone.
/DnsRecordRegistration Performs the /DnsBasic tests, and also checks if the address (A), canonical name (CNAME) and well-known service (SRV) resource records are registered.
/DnsResolveExtName **[/DnsInternetName:<**InternetName>] Performs the /DnsBasic tests, and also attempts to resolve InternetName.
If /DnsInternetName is not specified, attempts to resolve the name www.microsoft.com.
If /DnsInternetName is specified, attempts to resolve the Internet name supplied by the user.
/DnsAll Performs all tests, except for the /DnsResolveExtName test, and generates a report.
==========================================================================================================
#troubleshooting DNS Client
#Check IP configuration
#Verify that the client has a valid IP address, subnet mask, and default gateway for the network to which it is attached and being used
#Check the DNS servers that are listed in the output, and verify that the IP addresses listed are correct.
#Check the connection-specific DNS suffix in the output and verify that it is correct
ipconfig /all
#If the client does not have a valid TCP/IP configuration
#For statically configured clients, modify the client TCP/IP properties to use valid configuration settings or complete its DNS configuration for the network
ipconfig /renew #For dynamically configured clients,manually force the client to renew its IP address configuration with the DHCP server
#Check network connection
#ICMP traffic must be allowed through the firewall in order for the ping command to work.
ping 10.0.0.1 #Verify that the client can contact a preferred (or alternate) DNS server by pinging the preferred DNS server by its IP address.
==========================================================================================================
#Install Remote Server Administration Tools (RSAT) tools windows 11
Settings - Apps & Features - Optional features-Add a feature
Server Manager - Tools
==========================================================================================================
#Install Remote Server Administration Tools (RSAT) tools windows 10
Settings - Apps - Optional features - Add an optional feature - View Features
Control Panel\System and Security\Administrative Tools #verify
> Get-WindowsCapability -Online -Name "Rsat*" | select name,description | fl # find the list of optional features that contain the phrase RSAT
> Get-WindowsCapability -Online -Name "Rsat*" | select name,description | fl
> Get-WindowsCapability -Online -Name "Rsat.WSUS.Tools~~~~0.0.1.0" | Add-WindowsCapability -Online
#Fix RSAT install failed
C:\Windows\Logs\DISM\dism.log #the WindowsCapability logs
gpedit.msc - Computer Configuration - Administrative Templates - System - Specify settings for optional component installation and component repair
select Enabled - Check Download repair content and optional features directly from Windows Updates instead of Windows Server Updates Services (WSUS)
#elevated powershell
gpupdate /force #Powershell Window
Get-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0" | Add-WindowsCapability -Online #add feature
Get-WindowsCapability -Online -Name "Rsat*" | where -Property state -eq installed | select displayname,name,description #verify
Get-WindowsCapability -Online -Name "Rsat*" | Add-WindowsCapability -Online #install a group of related packages
==========================================================================================================
Verifying NetBIOS Name Resolution
Verify NetBT configuration
Display and reload the NetBIOS name cache
Test NetBIOS name resolution with Nbtstat
Verify NetBIOS over TCP/IP configuration
obtain this information
NetBIOS computer name
NetBIOS node type
Primary WINS server
Secondary WINS server
Whether NetBIOS over TCP/IP is disabled
ipconfig /all
obtain information about the NetBIOS scope ID assigned to each interface
nbtstat -c
verify whether Lmhosts lookup is enabled
check the WINS tab for the advanced properties of the Internet Protocol (TCP/IP) component
display the local NetBIOS name table
nbtstat –n
display the NetBIOS name table of a remote computer
nbtstat –a ComputerName
nbtstat –A IPv4Address
release and re-register the NetBIOS names of the node in WINS
nbtstat -RR
Display and Reload the NetBIOS Name Cach
display the contents of the NetBIOS name cache
nbtstat -c
flush the contents of the NetBIOS name cache and reload it with the #PRE entries in the Lmhosts file
nbtstat -R
Test NetBIOS Name Resolution with Nbtstat
test NetBIOS name resolution
nbtstat –a ComputerName
Verifying IPv4-based TCP Sessions
Check for packet filtering
Verify TCP session establishment
Verify NetBIOS sessions
==========================================================================================================
#Test SMTP Services client computer running Windows Server
command prompt - type Telnet - type set LocalEcho - type open <machinename> 25 - press ENTER
Type quit - press ENTER
==========================================================================================================
View message headers in Outlook
Double-click an email message to open it outside of the Reading Pane - File > Properties - Header information appears in the Internet headers box
X-Originating-IP header #the IP address of the computer that sends the email
Message-id #A unique string assigned by the mail system when the message is first created
==========================================================================================================
#troubleshoot connectivity PowerShell
#The Test-NetConnection cmdlet is the successor of Test-Connection
#supports ping test, TCP test, route tracing, and route selection diagnostics.
#set to detailed it will do basically a nslookup on the destination address and it will add the first hop in the lookup
test-netconnection Google.com -InformationLevel "Detailed"
Test-NetConnection -ComputerName "www.contoso.com" -InformationLevel "Detailed"
#Perform route diagnostics to connect to a remote host
Test-NetConnection -ComputerName www.contoso.com -DiagnoseRouting -InformationLevel Detailed
Test-NetConnection -ComputerName "www.contoso.com" -ConstrainInterface 5 -DiagnoseRouting -InformationLevel "Detailed"
#By default, Test-NetConnection uses TCP protocol to test the connection
# check if we are connected to the local network, have access to internet and are able to resolve DNS names
Test-NetConnection -ComputerName 192.168.0.1 -Port 80 -Protocol UDP -InformationLevel Detailed
Test-NetConnection -ComputerName 192.168.0.1 -Port 80 -InformationLevel Detailed
#Run Test-NetConnection without any parameters.
Test-NetConnection
Test-NetConnection -InformationLevel "Detailed"
Test-NetConnection -Port 80 -InformationLevel "Detailed"
# PowerShell TraceRoute with Test-NetConnection
Test-NetConnection 172.217.17.87 -traceRoute
#test the latency of each hop
Test-NetConnection 172.217.17.78 -traceRoute -Hops 3 | select-object TraceRoute | foreach-object {test-connection $_.TraceRoute -count 1}
==========================================================================================================
#troubleshoot connectivity PowerShell
# Send echo requests to a remote computer
Test-Connection -TargetName Server01 -IPv4
Destination: Server01
Ping Source Address Latency BufferSize Status
(ms) (B)
---- ------ ------- ------- ---------- ------
1 ADMIN1 10.59.137.44 24 32 Success
2 ADMIN1 10.59.137.44 39 32 Success
3 ADMIN1 * * * TimedOut
4 ADMIN1 10.59.137.44 28 32 Success
if (Test-Connection -TargetName srv-lab02 -Quiet) { New-PSSession -ComputerName srv-lab02}
Test-Connection -Source srv-lab02 -ComputerName 8.8.8.8
Test-Connection -ComputerName 8.8.8.8, 1.1.1.1
#Send echo requests to several computers
Test-Connection -TargetName Server01, Server02, Server12
Test-Connection -TargetName Server01 -Count 3 -Delay 2 -MaxHops 255 -BufferSize 256
#run a Test-Connection command as a PowerShell background job
$job = Start-Job -ScriptBlock { Test-Connection -TargetName (Get-Content -Path "Servers.txt") }
$Results = Receive-Job $job -Wait
#creates a session on the Server01 computer only if at least one of the pings sent to the computer succeeds
if (Test-Connection -TargetName Server01 -Quiet) { New-PSSession -ComputerName Server01 }
Test-Connection -TargetName www.google.com -Traceroute
==========================================================================================================
Verify TCP Session Establishment
# how to check if a port is open on the remote server
telnet IPv4Address TCPPort #verify that a TCP connection can be established using the known destination TCP port number
verify whether the Web server service on the computer with the IPv4 address of 131.107.78.12 is accepting TCP connections
telnet 131.107.78.12 80
Verify NetBIOS Sessions
verify that you have established NetBIOS sessions
nbtstat –s
==========================================================================================================
#Troubleshooting IPv6
The following sections describe the tools and techniques used to identify a problem at successive layers of the TCP/IP protocol stack using an IPv6 Internet layer. Depending on the type of problem, you might do one of the following:
Start at the bottom of the stack and move up.
Start at the top of the stack and move down.
The following sections are organized from the top of the stack
Verify IPv6 connectivity.
Verify DNS name resolution for IPv6 addresses.
Verify IPv6-based TCP sessions.
Verifying IPv6 Connectivity
the tasks to troubleshoot problems with IPv6 connectivity:
Verify configuration
Manage configuration
Verify reachability
View and manage the IPv6 routing table
Verify router reliability
Verify Configuration
ipconfig /all #MAC address,DHCP enabled,Default Gateway,IPv6 addresses, default routers, and DNS settings for all interfaces
netsh interface ipv6 show address
displays the IPv6 addresses assigned to each interface
netsh –r filesrv1 interface ipv6 show address
display the configuration of the remote computer named FILESRV1
Manage Configuration
netsh interface ipv6 set address
manually configure IPv6 addresses
netsh interface ipv6 set interface
make changes to the configuration of IPv6 interfaces
netsh interface ipv6 add dns
add the IPv6 addresses of DNS servers
option of the Netsh tool to manage the IPv6 configuration of a remote computer
–r RemoteComputerName
Verify Reachability
Check and flush the neighbor cache
netsh interface ipv6 show neighbors
display the current contents of the neighbor cache
netsh interface ipv6 delete neighbors
flush the neighbor cache
Check and flush the destination cache
netsh interface ipv6 show destinationcache
display the current contents of the destination cache
netsh interface ipv6 delete destinationcache
flush the destination cache
Ping the default router
obtain the link-local IPv6 address of your default router
ipconfig
netsh interface ipv6 show routes
route print
nbtstat -r
When you ping the default router, you must specify the zone identifier (ID) for the interface on which you want the ICMPv6 Echo Request messages to be sent
The zone ID is the interface index of the default route (::/0) with the lowest metric
This step might not succeed if the default router is filtering all ICMPv6 messages.
netsh interface ipv6 show route
route print
Ping a remote destination by its IPv6 address
tracert –d IPv6Address
trace the routing path to the remote destination
–d command line option prevents the Tracert tool from performing a DNS reverse query on every near-side router interface in the routing path, which speeds up the display of the routing path
Check Packet Filtering
IPsec for IPv6 policies that have been configured with the Ipsec6 tool
The simple IPv6 firewall
Windows Firewall
View and Manage the Local IPv6 Routing Table
view the IPv6 routing table
route print
netstat –r
netsh interface ipv6 show route
add a route to the IPv6 routing table
netsh interface ipv6 add route
modify an existing route
netsh interface ipv6 set route
remove an existing route
netsh interface ipv6 delete route
Verify Router Reliability
trace the path to a destination and display information on packet losses for each router and link in the path
–d command line option prevents the Pathping tool from performing a DNS reverse query on every near-side router interface in the routing path, which speeds up the display of the routing path.
pathping –d IPv6Address
Verifying DNS Name Resolution for IPv6 Addresses
the following tasks to troubleshoot problems with DNS name resolution
Verify DNS configuration
Display and flush the DNS client resolver cache
Test DNS name resolution with the Ping tool
Use the Nslookup tool to view DNS server responses
Verify DNS Configuration
On the node having DNS name resolution problems, verify the following:
Host name
The primary DNS suffix
DNS suffix search list
Connection-specific DNS suffixes
DNS servers
obtain this information
ipconfig /all
obtain information about which DNS names should be registered in DNS
netsh interface ip show dns
add the IPv6 addresses of additional DNS servers
netsh interface ipv6 add dns
register the appropriate DNS names as IPv6 address resource records (also known as AAAA resource records) with DNS dynamic update,
ipconfig /registerdns
Display and Flush the DNS Client Resolver Cache
display the contents of the DNS client resolver cache
ipconfig /displaydns
flush the contents of the DNS client resolver cache and reload it with the entries in the Hosts file
ipconfig /flushdns
Test DNS Name Resolution with Ping
To test DNS name resolution, use the Ping tool and ping a destination by its host name or FQDN. The Ping tool display shows the FQDN and its corresponding IPv6 address.
Use the Nslookup Tool to View DNS Server Responses
If the Ping tool is using the wrong IPv6 address, flush the DNS client resolver cache and use the Nslookup tool to determine the set of addresses returned in the DNS Name Query Response message
At the Nslookup > prompt, use the set d2
display the maximum amount of information about the DNS response messages
use Nslookup to look up the desired FQDN.
Look for AAAA records in the detailed display of the DNS response messages.
Verifying IPv6-based TCP Sessions
If reachability and name resolution are working but you cannot establish a TCP connection with a destination host, use the following tasks:
Check for packet filtering
Verify TCP connection establishment
Verify TCP Session Establishment
verify that a TCP connection can be established using a known destination TCP port number
telnet IPv6Address TCPPort
verify whether the Web server service on the computer with the IPv6 address of 3FFE:FFFF::21AD:2AA:FF:FE31:AC89 is accepting TCP connections on TCP port 80
telnet 3ffe:ffff::21ad:2aa:ff:fe31:ac89 80
https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb727023(v=technet.10)
==========================================================================================================
to shutdown or reboot a machine, including your own, in a simple scheduled task
shutdown –r –t 0 –m \\localhost
Scan for open ports for specific IP/host
nmap -n -sV 192.168.1.4
Scan for open ports for a network
nmap -n -sV 192.168.1.0/24
#System
enable the local administrator account
net user administrator * /active:yes
see all the open files on a system
openfiles /query
==========================================================================================================
>findstr "0x800f0954" C:\WINDOWS\Logs\DISM\dism.log
>findstr "Apple Orange" fruits.txt #print a line if it has has either the word ‘Apple’ or the word ‘Orange’ or both the words
>findstr /C:"word1 word2 word3..." filename #/C indicates that the search pattern has to be matched literally
>findstr /R [a-z]*xyz filename.txt #Search for the occurrence of all words ending with ‘xyz’ in a file
>findstr /I "searchstring" C:\data\*.txt #search all the text files in the directory C:\data
>findstr /N /I searchstring C:\data\*.txt #/N switch to the findstr command to print line numbers for the matched lines
findstr /s /i /c:"JndiLookup.class" C:\*.jar #Detect the presence of Log4j
findstr /I "diploma" *
Get-ChildItem -Recurse | Select-String -Pattern "diploma" #Search for text in all the files in a current directory
Get-ChildItem -Recurse -Filter *.txt | Select-String -Pattern "text"
==========================================================================================================
/S: Searches for matching files in the current directory and all subdirectories.
/I: Performs a case-insensitive search.
/M: Displays only the file names with the matching strings.
findstr /S /I /M "your_search_string" *.pptx
==========================================================================================================
type filename.txt | findstr -i keyword
Systeminfo | findstr /i model #cmd,check if server is virtual
systeminfo /s %computername% | findstr /c:"Model:" /c:"Host Name" /c:"OS Name
gwmi -q "select * from win32_computersystem" #powershell
systeminfo | more #osfingerprinting.generate a text summary of your system
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
systeminfo | findstr /C:"OS"
Systeminfo | findstr /i Memory
determine if the current version of Windows is either 32-bit or 64-bit from the command line
echo %PROCESSOR_ARCHITECTURE%
check the PROCESSOR_ARCHITECTURE environment variable. 64-bit systems will say AMD64 and 32-bit systems should say "x86"
C:\>wmic OS get OSArchitecture
OSArchitecture
32-bit
--------------------------------------------------------------------------------------------------------------------
To display the MD5/SHA256 etc. hash of a file, type the following command at a command prompt:
# downloaded files
04/06/2019 11:39 3,353,227,264 kali-linux-2019.2-amd64.iso
04/06/2019 11:38 94 kali-linux-2019.2-amd64.iso.txt.sha256sum
>certutil -hashfile kali-linux-2019.2-amd64.iso SHA256
SHA256 hash of kali-linux-2019.2-amd64.iso:
67574ee0039eaf4043a237e7c4b0eb432ca07ebf9c7b2dd0667e83bc3900b2cf
CertUtil: -hashfile command completed successfully.
>CertUtil -hashfile gpg4win-3.0.3.exe SHA1
>CertUtil -hashfile gpg4win-3.0.3.exe MD5
Powershell
Get-FileHash -Path a.txt -Algorithm SHA512
Get-FileHash .\Downloads\KeePass-2.50-Setup.exe –Algorithm MD5
--------------------------------------------------------------------------------------------------------------------
#ChatGPT
CertUtil is a built-in command line utility in Windows 10 that can be used to generate several types of checksum for an ISO file. The types of checksum that can be created with CertUtil include:
MD2
MD4
MD5
SHA1
SHA256
SHA384
SHA512
Whirlpool
To create a checksum using CertUtil, you can use the following syntax:
certutil -hashfile <path-to-iso-file> <hash-algorithm>
For example, to create an MD5 checksum for an ISO file located at C:\MyFiles\myiso.iso, you can use the following command:
certutil -hashfile C:\MyFiles\myiso.iso MD5
This will generate an MD5 checksum for the ISO file, which you can then compare with the checksum provided by the file's publisher to ensure its integrity.
--------------------------------------------------------------------------------------------------------------------
calculate the SHA-512 checksum of the file myfile.exe
certutil -hashfile myfile.exe SHA512
Compare the calculated checksum to the checksum that was provided by the download site
--------------------------------------------------------------------------------------------------------------------
#ChatGPT
To create MD5, SHA1, and SHA2 checksums of an ISO file on Windows 10, you can use a command-line utility such as CertUtil or PowerShell. Here are the steps to create these checksums using both methods:
Using CertUtil:
Open the Command Prompt by typing "cmd" in the Start menu and selecting "Command Prompt".
Navigate to the folder where the ISO file is located using the "cd" command. For example, if the ISO file is located in the "Downloads" folder, you can navigate to it using the following command: cd C:\Users\<your_username>\Downloads
To create an MD5 checksum, type the following command: CertUtil -hashfile filename.iso MD5. Replace "filename.iso" with the name of your ISO file.
To create a SHA1 checksum, type the following command: CertUtil -hashfile filename.iso SHA1. Replace "filename.iso" with the name of your ISO file.
To create a SHA256 checksum, type the following command: CertUtil -hashfile filename.iso SHA256. Replace "filename.iso" with the name of your ISO file.
Press Enter to execute each command. CertUtil will create the specified checksum and display it on the screen.
You can save the checksums to a file by adding "> filename.txt" to the end of each command. For example: CertUtil -hashfile filename.iso MD5 > filename.txt. This will save the checksum to a text file named "filename.txt" in the same folder as the ISO file.
Using PowerShell:
Open PowerShell by typing "PowerShell" in the Start menu and selecting "Windows PowerShell".
Navigate to the folder where the ISO file is located using the "cd" command. For example, if the ISO file is located in the "Downloads" folder, you can navigate to it using the following command: cd C:\Users\<your_username>\Downloads
To create an MD5 checksum, type the following command: Get-FileHash -Algorithm MD5 filename.iso. Replace "filename.iso" with the name of your ISO file.
To create a SHA1 checksum, type the following command: Get-FileHash -Algorithm SHA1 filename.iso. Replace "filename.iso" with the name of your ISO file.
To create a SHA256 checksum, type the following command: Get-FileHash -Algorithm SHA256 filename.iso. Replace "filename.iso" with the name of your ISO file.
Press Enter to execute each command. PowerShell will create the specified checksum and display it on the screen.
You can save the checksums to a file by adding "Out-File filename.txt" to the end of each command. For example: Get-FileHash -Algorithm MD5 filename.iso | Out-File filename.txt. This will save the checksum to a text file named "filename.txt" in the same folder as the ISO file.
That's it! You have now created MD5, SHA1, and SHA256 checksums of the ISO file on Windows 10 using either CertUtil or PowerShell.
--------------------------------------------------------------------------------------------------------------------
AD Shortcuts
dsa.msc Active Directory Users and Computers
adsiedit.msc ADSI Edit
AdRmsAdmin.msc Active Directory Rights Managment Services Administration
azman.msc Authorization Manager
certsrv.msc Active Directory Certificate Services
CluAdmin.msc Failover Cluster Manager
dfsmgmt.msc DFS Managment
dhcpmgmt.msc DHCP Management
dnsmgmt.msc DNS Management
domain.msc Active Directory Domains and Trusts
fsrm.msc File Server Resource Manager
gpmc.msc Group Policy Management Console
gpme.msc Group Policy Management Editor
lsdiag.msc Remote Desktop Licensing Diagnoser
remoteprograms.msc RemoteApp Manager
rrasmgmt.msc Routing and Remote Access
sbmgr.msc Remote Desktop Connection Manager
tsadmin.msc Remove Desktop Services Manager
tsconfig.msc Remove Desktop Session Host Configuration
tsmmc.msc Remote Desktops
winsmgmt.msc WINS Management
WSRM.msc Windows System Resource Manager
--------------------------------------------------------------------------------------------------------------------
Local Computer Shortcuts
gpedit.msc Local Group Policy Editor
fsmgmt.msc Shared Folders
eventvwr.msc Event viewer
certlm.msc Certificates – Local Computer
certmgr.msc Certificates – Local Users
certtmpl.msc Certificates Templates Console
appwiz.cpl Programs and Features
Firewall.cpl Windows Firewall
compmgmt.msc computer management
psr.exe steps recorder
comexp.msc Component Services
devmgmt.msc Device Manager
diskmgmt.msc Disk Management
lusrmgr.msc Local Users and Groups
ncpa.cpl Network Connections
perfmon.msc Performance Monitor
sysdm.cpl System Properties
WF.msc Windows Firewall with Advanced Security
rsop.msc all the Group Policy settings you’ve applied to your PC or user account
taskschd.msc task scheduler
--------------------------------------------------------------------------------------------------------------------
# view the certificates of Local Computer on Windows 11, the Microsoft Management Console (MMC) Certificates snap-in
windows key + R > "MMC" > File > Add/Remove Snap-in > Certificates > Add > Computer Account
--------------------------------------------------------------------------------------------------------------------
#commandprompt / power shell
compmgmt.msc
Windows Run Commands Shortcuts
Control Panel Program Shortcuts
control Control Panel
control netconnections Network Properties
control printers Printers Folders
control userpasswords2 Manager all User Accounts
control update Windows Update
control admintools Administrative Tools
control schedtasks Scheduled Tasks
appwiz.cpl Program and Features
intl.cpl Regional Settings (International)
sysdm.cpl System Properties
firewall.cpl Windows Firewall
Windows Tools
explorer Windows Explorer
regedit Registry Editor
services.msc Windows Services (local)
taskmgr Task Manager
msconfig System Configuration Utility
mstsc Remote Desktop (Microsoft Terminal Services)
logoff Log Off Windows (without confirmation!
shutdown Shuts Down Windows (don't try unless you are ready to shutdown)
msinfo32 System Information
msinfo32 /report "C:\Users\JohnDoe\Desktop\SystemInfo.txt" #PowerShell
verify file signatures
fciv gpg4win-2.2.5.exe -sha1
fciv gpg4win-2.2.5.exe -md5
fciv gpg4win-2.2.5.exe -sha1 > filedownloaded.txt
fciv gpg4win-2.2.5.exe -md5 > filedownloaded.txt
#Network Tools
Network Monitor
Nagios Core
OpenNMS
Advanced IP Scanner
Messsage Analyzer
Capsa Free
Wireshark
Fiddler
NetworkMiner
Zenoss Core
Pandora FMS
Xirrus Wi-Fi Inspector
WirelessNetView
Xymon
NetXMS
Total Network Monitor
Icinga 2
Angry IP Scanner
Splunk
The Dude
PRTG Network Monitor Freeware
System Tools
Shadow Explorer
Security Tools
Malwarebytes Anti-Malware
Hitman Pro3
Data Recovery Tools
Data Recovery Wizard Free 9.0
R-STUDIO
Recuva
#Tools
----------------------------------------------------------------------------------------------------
#ChatGPT
The PCAP-over-IP protocol has several use cases:
Remote Network Monitoring: PCAP-over-IP can be used to remotely monitor network traffic on a specific network segment or appliance, without having to be physically present at the location of the device.
Troubleshooting: When troubleshooting network issues, it can be helpful to capture network packets in real-time. PCAP-over-IP can be used to capture and transmit network packets to a remote location where they can be analyzed by network administrators or other experts.
Compliance and Security: PCAP-over-IP can be used to capture network packets for compliance and security purposes, such as monitoring network traffic for suspicious or malicious activity.
Network Testing: PCAP-over-IP can be used for network testing and validation, by capturing and analyzing network traffic in real-time to ensure that network devices and applications are functioning properly.
----------------------------------------------------------------------------------------------------
#networkminer windows 10
#PCAP-over-IP is a method for reading a PCAP stream, which contains captured network traffic, through a TCP socket instead of reading the packets from a PCAP file
Common use cases for PCAP-over-IP include:
Transmitting captured network traffic in real time to a remote machine
Transferring network traffic between two applications on the same host
Providing decrypted traffic from a TLS interception proxy to a packet analyzer or IDS.
Software that can sniff network traffic, but doesn't support PCAP-over-IP, can read packets from a PCAP-over-IP provider with help of a netcat and tcpreplay combo.
"nc [SERVER] 57012 | tcpreplay -i eth0 -t "
"nc -l 57012 < sniffed.pcap" create a PCAP-over-IP server is to simply read a PCAP file into a netcat listener
"nc 192.168.1.2 57012 | tshark -r -" The packets in “sniffed.pcap” can then be read remotely using PCAP-over-IP
#read PCAP-over-IP with Wireshark and tshark
wireshark -k -i TCP@192.168.1.2:57012
tshark -i TCP@192.168.1.2:57012
#Live Remote Sniffing
#Sniffed traffic can be read remotely over PCAP-over-IP in real-time simply by forwarding a PCAP stream with captured packets to netcat
#Tcpdump is not available for Windows, but dumpcap is since it is included with Wireshark.
tcpdump -U -w - not tcp port 57012 | nc -l 57012
dumpcap -P -f "not tcp port 57012" -w - | nc -l 57012
----------------------------------------------------------------------------------------------------------------------------------------------------------
# troubleshooting windows 11
#the code execution cannot proceed because resampledmo.dll was not found. reinstalling the program may fix this problem.
dism /online /cleanup-image /checkhealth
Cleans up system images
This line actually runs the DISM command to begin a cleanup of Windows components.
This command is used to clean up and reduce the size of the WinSxS directory, which can accumulate over time.
Dism /Online /Cleanup-Image /StartComponentCleanup
Repairs system images.
This line actually runs the DISM command to restore the health of Windows components.
It checks the integrity of system files and attempts to fix issues.
Dism /Online /Cleanup-Image /RestoreHealth
Scans and repairs system files.
SFC /scannow
----------------------------------------------------------------------------------------------------------------------------------------------------------
#save it as a .bat file and run it
#The batch file will clean up and repair system images, and it will scan and repair system files.
echo off: Disables the echoing of commands to the console.
date /t & time /t: Displays the current date and time.
echo Dism /Online /Cleanup-Image /StartComponentCleanup: Displays the command that will be used to clean up system images.
Dism /Online /Cleanup-Image /StartComponentCleanup: Cleans up system images.
echo ...: Displays a placeholder line.
date /t & time /t: Displays the current date and time.
echo Dism /Online /Cleanup-Image /RestoreHealth: Displays the command that will be used to repair system images.
Dism /Online /Cleanup-Image /RestoreHealth: Repairs system images.
echo ...: Displays a placeholder line.
date /t & time /t: Displays the current date and time.
echo SFC /scannow: Displays the command that will be used to scan and repair system files.
SFC /scannow: Scans and repairs system files.
date /t & time /t: Displays the current date and time.
pause: Pauses the batch file and waits for a key press.
----------------------------------------------------------------------------------------------------------------------------------------------------------
#Convert Windows Server Data Center From Evaluation Version to Full Version w retail product or VLSC MAK key
# Error 0xc004f069, 0xc004fc07
DISM /Online /Get-CurrentEdition #Check the current version
DISM /online /Set-Edition:<edition ID> /ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /AcceptEula
DISM /online /Set-Edition:ServerDatacenter /ProductKey:ABCDE-12345-ABCDE-12345-ABCDE /AcceptEula #the retail product key,VLSC MAK key
slmgr /ipk 12345-12345-12345-12345-12345 #VLSC MAK key
slmgr /ato #VLSC MAK key
----------------------------------------------------------------------------------------------------------------------------------------------------------
slmgr -upk #remove existing product key
slmgr -ipk <your-windows-product-key> #install new product key
DISM /online /Set-Edition:ServerDatacenter /GetEula:C:\eula.rtf #save the Microsoft Software License Terms for Windows Server
DISM /online /Get-TargetEditions #Verify which editions the current installation can be converted to by running the command below
#If the server is running Windows Server Essentials, convert it to the full retail version by entering a retail, volume license, or OEM key
slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
#Converting Windows Server Standard edition to Datacenter edition
DISM /online /Get-CurrentEdition
DISM /online /Get-TargetEditions
DISM /online /Set-Edition:ServerDatacenter /ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /AcceptEula
#At any time after installing Windows Server, convert between a retail license, a volume-licensed license, or an OEM license.
slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX #
----------------------------------------------------------------------------------------------------------------------------------------------------------
#windows 10 usb readonly troubleshooting
insert usb
run cmd
diskpart
list disk
select disk x
attributes disk clear readonly
----------------------------------------------------------------------------------------------------------------------------------------------------------
### look for anomalous behavior within the Windows environment
## look for unusual processes and services
windowskey + R + taskmgr.exe
windowskey + R + cmd
At the command prompt, type netstat -ano > netstat.txt, and then press Enter.
At the command prompt, type tasklist > tasklist.txt, and then press Ente
If you want to create a text file for services rather than programs, at the command prompt, type tasklist /svc > tasklist.txt.
Open the tasklist.txt and the netstat.txt files.
In the tasklist.txt file, write down the Process Identifier (PID) for the process you are troubleshooting.
Compare the PID with that in the Netstat.txt file
Write down the protocol that is used.
The information about the protocol used can be useful when reviewing the information in the firewall log file.
tasklist #displays a list of running services. Getting a PID can be useful for using the taskkill command to end the questionable process
taskkill /f /im OneDrive.exe #The /f parameter tells Windows to forcefully terminate the process.the /im parameter is used to identify and stop a process by typing its name
taskkill /PID 2492 #kill the process that has a PID of 2492
# display all processes, executable path and much more
wmic process list full
# will display a list of all processes along with their corresponding PID, and services that are tied to them
tasklist /svc
# look for unusual services
# GUI
services.msc
# command prompt
net start
#kill all processes with the same name
#The /F parameter tells taskkill to Force the process(es) to kill.
The /IM parameter allows you to specify the name of the process executable(s) to kill.
The /T switch specifies to terminate all child processes along with the parent process.
>taskkill /IM notepad.exe /T /F
pskill -t notepad.exe
sc query
sc query eventlog #Displays the status for the eventlog service.
sc query type= service state= all
sc query type= service state= active
sc query type= service state= inactive
sc start hope #start service hope
sc \\computer query servicename
sc \\computer start|stop servicename
sc \\computer config servicename start=auto|demand|disabled
#create and register a new binary path for the NewService service
sc.exe \\myserver create NewService binpath= c:\windows\system32\NewServ.exe
sc.exe create NewService binpath= c:\windows\system32\NewServ.exe type= share start= auto depend= +TDI NetBIOS
sc create EndecaServer displayname= "Oracle Endeca Server"
type= own error= severe obj= "CORPDEV\EndecaUser" password= banx912
binpath= "C:\Oracle\Endeca\Server\7.4.0\endeca-server\service-wrapper-7.4.exe"
# use regedit to look for unusual entries
# three registry entries will contain startup configurations for specific programs, including malware.
windowskey + R + regedit
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
----------------------------------------------------------------------------------------------------------------------------------------------------------
# check Windows Firewall configuration
netsh firewall show config
netsh advfirewall firewall set rule group="Remote Administration" new enable=yes
netsh firewall set service type=remoteadmin mode=enable #create Remote Administration group
netsh advfirewall firewall set rule group="remote administration" new enable=yes #update firewall rules
----------------------------------------------------------------------------------------------------------------------------------------------------------
#Remotely Enable Remote Desktop on Windows 10
#have Windows administrative privileges for the remote computer
#on the same LAN as the remote PC
#Step 1: Open firewall ports in Windows firewall
"c:\psexec \\remote_machine_name cmd" #get command line access for that remote box
"netsh advfirewall set currentprofile state off" #disable the firewall
"netsh advfirewall firewall set rule group=”remote desktop” new enable=Yes" #allow only Remote Desktop while still leaving the rest of the firewall as is
#Step 2: Registry Changes to enable Remote Desktop
#still in psexec, change the remote registry
"reg add “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f"
#Option 2: Manually change registry settings
Load up the Services MMC (Control Panel > Administrative Tools > Services)
right click on “Services (Local)” and choose “Connect to another computer
Enter the name of your remote machine and connect to it.
find the “Remote Registry” service and start it.
Load up regedit
File > Connect Network Registry
Enter the name of remote computer and connect to it
Navigate to HKEY_LOCAL_MACHINE > System > CurrentControlSet > Control > Terminal Server
Change the value of “fDenyTSConnections” to “0”
Step 3: Start the Remote Desktop service
the Services MMC
find the service “Remote Desktop Services”
start it (or restart if it is already running)
Start-Settings-System-Remote Desktop-Enable Remote Desktop
----------------------------------------------------------------------------------------------------------------------------------------------------------
## look for unusual start up (or scheduled) tasks
# displays all startup configurations from services to files in the startup folder
# useful for disabling anything trying startup during Windows login or boot-up
msconfig #reference to Task Manager Windows 10
Task Manager - Startup #Windows 10
# displays tasks schedule to run at specific times
schtasks
# displays all of the services and programs that startup when Windows boots and/or upon Windows login
wmic startup list full
wmic product get name,version #List of All Installed Programs
----------------------------------------------------------------------------------------------------------------------------------------------------------
## look for unusual accounts
# looking for local accounts on a machine
lusrmgr.msc
# displays all user accounts on a local machine
net user
# display all local administrator user accounts, finding administrator accounts that do not belong on a particular machine
net localgroup administrators
quser #display information about all users logged on the system
"Task Manager" - “Users” tab
quser ursula /server:Server64 # display information about the user USER1 on server Server1
WMIC /NODE:192.168.1.1 COMPUTERSYSTEM GET USERNAME #CMD, Windows Management Instrumentation COMMAND(WMIC)
query / server:remoteserver # lists all users on that server.
query user / server:remoteserver | find "username" #obtain a single user listing
----------------------------------------------------------------------------------------------------------------------------------------------------------
## look for unusual behavior is within event viewer
windowskey + R + eventvwr.msc
# Look for warnings, errors, and other events,failed logon attempts,ocked out accounts
“Event log service was stopped.”
“Windows File Protection is not active on this system.”
"The protected System file [file name] was not restored to its original, valid version because the Windows File Protection..."
“The MS Telnet Service has started successfully.”
# If the log files are missing, it is a reliable indicator that the machine has been or is compromised and the intruder is trying to hide his\her tracks
----------------------------------------------------------------------------------------------------------------------------------------------------------
# steganography, attaching a .rar file to a .jpg etc.
copy /b input.jpg + input.rar ouput.jpg
------------------------------------------------------------------------------------------
AccessChk-Allows you to see what kind of permissions users and groups have for files, directories, registry keys, and more.
AccessEnum-Overview of file system and registry security settings.
AdExplorer-Active Directory viewer and editor.
AdInsight-An LDAP real-time monitoring tool used to troubleshoot Active Directory applications.
AdRestore-Ability to restore deleted Active Directory objects.
Auto Logon-Easily configure the auto logon mechanism.
Auto-Run-Shows programs that are configured to run at startup.
BgInfo-Displays relevant information about your computer on your desktop, such as computer name and IP address.
CacheSet-An applet for manipulating the working set parameters of the system file cache.
ClockRes-Displays the resolution of the system clock.
Contig-Defragments one or more of the specified files.
Coreinfo-Shows the mapping between logical and physical processors.
Ctrl2Cap-Kernel mode device driver that filters system keyboard class drivers.
DebugView-Monitors the debug output of the local system.
Desktops-Organize up to four virtual desktops.
Disk2vhd-Create a VHD (Virtual Hard Disk) version of a physical disk.
DiskExt-Returns information about the disk on which the volume is partitioned.
DiskMon-Logs and displays all hard disk activity.
DiskView-Graphical map of your hard drive.
DiskUsage (DU)-Reports the disk space usage of the specified directory.
EFS Dump-See who can access the encrypted files.
FindLinks-Reports file indexes and hard links that exist in the specified file.
Handles-Displays information about handles that are open in any process.
Hex2dec Converts a decimal number to decimal and vice versa.
Junction-Creates a junction (a symbolic link that joins directories in multiple locations).
LDMDump-Let’s find out exactly what is stored on the disk copy of the system.
ListDLLs-Reports the DLLs loaded into the process.
You can run the LiveKd-Kd and Windbg kernel debuggers.
LoadOrder-Indicates the order in which the system loads device drivers.
LogonSessions-Lists currently active logon sessions.
MoveFile-Dumps the contents of pending rename / delete values.
NTFSInfo-Displays information about NTFS volumes.
PageDefrag-Indicates that the paging file and registry hive are fragmented.
PendMoves-Dumps the contents of pending rename / delete values.
PipeList-Lists pipes.
PortMon-Monitors and displays all serial and parallel port activity.
ProcDump-Monitor CPU spikes.
ProcessExplorer-Displays information about loaded handles and DLL processes.
Process Monitor-View real-time file system, registry, and process / thread activity.
PsExec-Allows you to run processes on remote systems.
You can convert the PsGetSid-SID to a display name and vice versa.
PsInfo-Gathers important information about local or remote systems, such as kernel builds and memory volumes.
Implement the PsPing-ping function.
PsKill-Allows you to kill processes on local and remote systems.
PsList-Displays information about processes, memory, and threads.
PsLoggedOn-This shows who is using which resource on the local or remote machine.
PsLogList-Allows you to log in to remote systems in situations where your security credentials do not allow it.
PsPasswd-Allows you to change the account password for your local or remote system.
PsService-Service viewer and controller for Windows.
PsShutdown-In particular, you can log off console users and lock the console.
PsSuspend-Allows you to suspend processes on your local or remote system.
RAMMap-A physical memory usage analysis tool for seeing how Windows allocates physical memory.
RegDelNull-Allows you to search and delete registry keys.
Registry Usage (RU)-Reports registry space usage.
RegJump-Opens Regedit directly for the specified registry path.
RootkitRevealer-Detects rootkits.
SDelete-Allows you to delete one or more files / directories and cleanse free space on your drive.
ShareEnum-Allows you to lock down a file share.
ShellRunas-You can launch programs with different accounts.
SigCheck-Displays file version numbers, timestamps, and digital signature details.
Stream-You can see which NTFS file has an alternate stream associated with it.
String-Searches the file for the specified string.
Sync-All file system data can be flushed to disk.
TCPView-Displays a detailed list of all TCP and UDP endpoints on the system.
VMMap-Process virtual and physical memory analysis tool.
VolumeID-Allows you to change the ID of FAT and NTFS disks.
WhoIs-Performs a registration record for the specified domain name or IP address.
WinObj-Displays information about the NT Object Manager namespace.
ZoomIt-Screen zoom and annotation tools for technical presentations.
------------------------------------------------------------------------------------------
#By default, msiexec.exe does not wait for the installation process to complete, since it runs in the Windows subsystem
#To wait on the process to finish and ensure that %ERRORLEVEL% is set accordingly
start /wait msiexec.exe /i elasticsearch-7.15.2.msi /qn
#As with any MSI installation package, a log file for the installation process can be found within the %TEMP% directory
#with a randomly generated name adhering to the format MSI<random>.LOG
#The path to a log file can be supplied using the /l command line argument
start /wait msiexec.exe /i elasticsearch-7.15.2.msi /qn /l install.log
msiexec.exe /help
------------------------------------------------------------------------------------------
# Using PsTools to Control Other PCs from the Command Line
PsExec – executes processes on a remote computer
psexec \\computername -u User -p Password ipconfig
psexec \\computername ipconfig
psexec \\computername <options> xxx.exe <arguments>
PsExec.exe \\computer net stop servicename && net start servicename
psexec \\computername cmd #get command prompt
psexec \\computername powershell #get command prompt
psexec \\remotecomputername msiexec /x /q pathtotheMSIfile #uninstall the program
psexec \\[computername or IP] -h cmd /c "c:\program files (x86)\uninstall.exe /silent" #'-h' switch for running an elevated session
#Run PowerShell scripts on remote PC
PsExec.exe \\<SERVER FQDN> -u <DOMAIN\USER> -p <PASSWORD> /accepteula cmd /c "powershell -noninteractive -command gci c:\"
#-i option to launch process on remote in interactive mode
PSExec \\RPC001 -i -u myID -p myPWD PowerShell C:\script\StartPS.ps1 par1 par2
#script in the location (c:\temp_ below on each remote server. servers.txt contains a list of IP addresses (one per line).
psexec @servers.txt -u <username> cmd /c "powershell -noninteractive -file C:\temp\script.ps1"
psexec \\server cmd /c "echo . | powershell script.ps1"
$computerName = 'REMOTECOMPUTER'
#calling the winrm.cmd batch file on a remote computer running as the SYSTEM account.
#the output from that command isn’t needed, it’s silenced with 2>&1> $null
psexec "\\$Computername" -s c:\windows\system32\winrm.cmd quickconfig -quiet 2&>&1> $null
psinfo \\IP
PsService.exe \\computer query servicename #the status of the service
PsService.exe \\computer config servicename #view the configuration
PsService.exe \\computer restart servicename
PsService.exe \\computer stop servicename
SysinternalsSuite> .\PsLoggedon.exe \\pc1 -l #find user logged on a remote pc
psloglist \\workstation64 -h 24 application #List everything in the application event log on \\workstation64 from the last 24 hours
PsLogList Security | More
psloglist -s -x security
PsLogList -i 861 Security | More #security log events with an event code of 861
psloglist -f ew #see only errors and warnings,The -f argument takes a string of letters that represent the starting letter of the event types
psloglist -o "windows update agent","ntservicepack" #dump event-log records generated by the Windows Update Agent and NtServicePack sources,
PsLoglist -i 861 -s -t , Security > EventListing.txt
psloglist file -c #clear an event log after extracting its contents
psloglist -s > events.csv start events.csv #redirect CSV-formatted PsLoglist output to a file,open that file in Excel
#processing logs that contain commas in text, use the -t switch to specify a different delimiter character
#the tab character is a CSV delimiter,PsLoglist to use that character
psloglist -s -t \t > events.csv
#aggregate event-log data from multiple computers
#List the computer names (with or without the double-backslash prefix) on separate lines in a text file
#append the name of that file to the @ switch
psloglist @computers.txt application
------------------------------------------------------------------------------------------
qwinsta /server:Server2 #find user logged on a remote pc,display information about all active sessions on server Server2
#need to RDP a remote Windows server and all the sessions seem to be unavailable
#use two utilities to kill offending/exceeding sessions
“Psexec \\servername –u username –p password –c cmd”
“qwinsta” #Choose a session to kill and note its id
“rwinsta id”
------------------------------------------------------------------------------------------
#RDP - Remote Desktop connection troubleshooting
#If the value of the fDenyTSConnections key is 0, then RDP is enabled
#If the value of the fDenyTSConnections key is 1, then RDP is disabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
#a GPO may be overriding the computer-level settings
gpresult /H c:\gpresult.html (cmd)
Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow users to connect remotely by using Remote Desktop Services
#Check whether a GPO is blocking RDP on a remote computer
gpresult /S <computer name> /H c:\gpresult-<computer name>.html (cmd)
#Check the status of the RDP listener
Enter-PSSession -ComputerName <computer name> (PowerShell)
#Check the status of the RDP self-signed certificate,the Certificates MMC snap-in
Certificates - Remote Desktop
#Check that another application isn't trying to use the same port
cmd /c 'netstat -ano | find "3389"' (pwsh)
#determine which application is using port 3389 (or the assigned RDP port)
cmd /c 'tasklist /svc | find "<pid listening on 3389>"' (pwsh)
#Check whether a firewall is blocking the RDP port
psping -accepteula <computer IP>:3389
------------------------------------------------------------------------------------------
"gpupdate /force" #force a group policy update on the local computer
“PsExec \\Computername Gpupdate” # remotely update group policy
#Powershell as well as the Group Policy Management Console (GPMC) installed
#The RandomDelayInMinutes 0 specifies the delay. Setting it to 0 will update group policy right away
#the clients will get a CMD screen pop up
"Invoke-GPUpdate -Computer COMPUTER02 -RandomDelayInMinutes 0"
#force an update on all computers
#pull in every computer from the domain, put them into a variable and run the commands for each object in the variable
"PS C:\> $computers = Get-ADComputer -Filter *"
"PS C:\> $computers | ForEach-Object -Process {Invoke-GPUpdate -Computer $_.name -RandomDelayInMinutes 0 -Force}"
------------------------------------------------------------------------------------------
change DNS settings
PS C:\> Set-DnsClientServerAddress -InterfaceIndex 12 -ServerAddresses ("10.0.0.1","10.0.0.2")
------------------------------------------------------------------------------------------
#windows 10 enable telnet client
Run-appwiz.cpl-Turn Windows features on or off-Telnet client
==========================================================================================================
#join windows 11 to domain
Start-Settings-Access work or school-Connect-Join this device to a local Active Directory domain
#rename computer
Start-Settings-System-Rename
==========================================================================================================
#Windows 2016 DhcpLogFilesMaxSize default=70 MB DHCP Audit Logging
PS C:\> Get-DhcpServerAuditLog -ComputerName "dhcpserver.contoso.com" #Get settings for the DHCP server service
PS C:\> Set-dhcpserverAuditLog -MaxMBFileSize <decimal> #change the size in MBs
PS C:\> Set-DhcpServerAuditLog -ComputerName "dhcpserver.contoso.com" -Enable $True -Path "D:\dhcpauditlog\" -MaxMBFileSize 100
PS C:\> restart -service dhcpserver
==========================================================================================================
#ChatGPT
Explain how to check in windows 11 whether a specific user account in Active Directory has 802.1x authentication enabled on their computer
To check in Windows 11 whether a specific user account in Active Directory has 802.1x authentication enabled on their computer, you can use the following steps:
Open the Start menu and click on "Settings".
Click on "Network & internet" from the list of settings.
Click on "Ethernet" or "Wi-Fi" depending on the type of connection you are using.
Click on "Properties" next to the connection you are using.
Under "Network profile", check if the "802.1X authentication" option is enabled.
Note that this method checks if 802.1X authentication is enabled for the current network connection on the computer, which may not necessarily be the same as the user's Active Directory account. To check if a specific user account in Active Directory has 802.1X authentication enabled on their computer, you would need to use PowerShell or another command-line tool to query Active Directory and the computer's network settings.
==========================================================================================================
#ChatGPT
# view file extensions windows 11
In Windows 10, you can easily enable the display of file extensions in File Explorer by following these steps:
Open File Explorer by pressing the Windows key + E.
Click on the "View" tab in the ribbon at the top of the window.
In the "Show/hide" section of the ribbon, check the box for "File name extensions".
==========================================================================================================
# pixel size of a png,jpg etc
Right Click > Properties > Details > Image
==========================================================================================================
# ChatGPT
To resize a PNG file into 40x40 pixels on Windows 10, you can use the built-in Paint application. Here are the steps:
Right-click on the PNG file you want to resize and select "Open with" from the context menu. Then click on "Paint" to open the file in the Paint application.
In the Paint application, click on the "Resize" button in the "Image" tab of the ribbon menu.
In the "Resize and Skew" dialog box, make sure that the "Maintain aspect ratio" option is selected. Then, change the value in the "Horizontal" box to 40 and the value in the "Vertical" box to 40. Make sure that the "Pixels" option is selected in the "Units" dropdown.
Click on the "OK" button to apply the changes.
Save the resized image by clicking on the "File" menu and selecting "Save" or "Save As". Make sure to choose a new filename or file location if you don't want to overwrite the original file.
That's it! Your PNG file should now be resized to 40x40 pixels.
==========================================================================================================
#troubleshooting, ChatGPT
Problem:
this action can't be completed because the folder or a file in it is open in another program
Fix:
If you still can't determine which program is using the file or folder, you can use the built-in Windows utility, "Resource Monitor," to track down the program that's causing the issue.
To do this, follow these steps:
Press the "Windows key + R" to open the "Run" dialog box.
Type "resmon.exe" and press "Enter" to open the "Resource Monitor" window.
In the "Resource Monitor" window, click on the "CPU" tab.
Under the "Associated Handles" section, type in the name of the file or folder you are having trouble with in the "Search Handles" box.
You should see a list of processes that are currently using the file or folder. Look for the process that's causing the issue, and then close it by right-clicking on it and selecting "End Process".
==========================================================================================================
#troubleshooting, ChatGPT
Problem:
this action can't be completed because the folder or a file in it is open in another program
Fix:
To use Process Explorer to find the program that is using the file or folder, follow these steps:
Download the Sysinternals suite from the Microsoft website and extract the zip file to a folder on your computer.
Open the folder where you extracted the Sysinternals suite and double-click on "procexp.exe" to open Process Explorer.
In Process Explorer, click on the "Find" menu and select "Find Handle or DLL".
In the "Handle or DLL substring:" field, type in the name of the file or folder that's causing the warning message and click "Search".
Process Explorer will search for all processes that have a handle or DLL associated with the file or folder. Look for the process that's causing the issue, and then right-click on it and select "Close Handle".
==========================================================================================================
#ChatGPT
To check if a local user account's password is expired on a Windows 2012 server, you can follow these steps:
Log in to the Windows 2012 server using an account with administrative privileges.
Open the "Local Users and Groups" management console by typing "lusrmgr.msc" in the Run dialog box or in the search bar on the Start menu.
In the left pane of the console, click on "Users" to view the list of local user accounts.
Right-click on the user account that you want to check and select "Properties" from the context menu.
In the "Properties" dialog box, go to the "General" tab.
Look for the "Password never expires" field. If this field is unchecked, it means that the password can expire.
To check if the password is expired, try logging in to the server using the user account's credentials. If the password has expired, you will be prompted to change the password.
If the user account's password is expired, you can reset the password from the "Properties" dialog box. Go to the "Account" tab, check the "User must change password at next logon" option, and then click "OK".
Note that if the "Password never expires" field is checked, the password will never expire, unless a group policy or other system configuration changes this setting.
==========================================================================================================
#ChatGPT
To check when a local user account's password is expired on a Windows 2012 server, you can follow these steps:
Log in to the Windows 2012 server using an account with administrative privileges.
Open the "Command Prompt" by typing "cmd" in the Run dialog box or in the search bar on the Start menu.
In the Command Prompt, type "net user [username]" and press Enter. Replace "[username]" with the name of the user account that you want to check.
Look for the "Password expires" field in the output. This field shows the date and time when the user account's password will expire.
If the "Password expires" field is blank, it means that the password will never expire, unless a group policy or other system configuration changes this setting.
If the "Password expires" field shows a date and time in the past, it means that the password has already expired.
If the "Password expires" field shows a date and time in the future, it means that the password will expire on that date and time.
Note that the "net user" command can also be used to change a user account's password and other properties. To change a user account's password, type "net user [username] *". You will be prompted to enter a new password for the user account.
==========================================================================================================
#ChatGPT
To view active Remote Desktop Protocol (RDP) connections to a Windows Server 2012, follow the steps below:
Log in to the Windows Server 2012 machine as an administrator.
Open the Task Manager by pressing Ctrl+Shift+Esc or by right-clicking the taskbar and selecting Task Manager.
Click on the "Users" tab in the Task Manager window. This will show you a list of all the users currently connected to the server via RDP.
==========================================================================================================
#troubleshooting
"some of these settings are hidden or managed by your organization" when date & time settings can not be configured on windows 11
To change the date & time settings in the registry, open the Registry Editor by pressing Windows+R and typing regedit. In the Registry Editor, navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
find out in the registry if the “Allow computers to adjust time zone automatically” policy is enabled, follow these steps:
Open the Registry Editor by pressing Windows+R and typing “regedit”.
Navigate to the following key
The value of the “Start” key indicates whether the policy is enabled or disabled. If the value is 3, the policy is enabled. If the value is 4, the policy is disabled.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tzautoupdate\Start
Check your user permissions. Make sure that you have the appropriate permissions to change the time zone. You can do this by opening the Local Security Policy (secpol.msc) and navigating to the User Rights Assignment node. Under Change the time zone, check if your user account is listed
==========================================================================================================
#ChatGPT
The "System Guard Runtime Monitor Broker Service" is a background service that runs on Windows 10 operating systems. It is a component of Windows Defender System Guard, a security feature introduced in Windows 10 version 1809 (October 2018 Update) and later.
The purpose of the System Guard Runtime Monitor Broker Service is to enhance the security of the operating system by providing runtime monitoring and protection against malicious activities. It works in conjunction with other security components, such as Windows Defender Antivirus and Windows Defender Exploit Guard, to provide advanced threat protection.
When you see the "System Guard Runtime Monitor Broker Service" listed in the Processes tab of the Task Manager, it indicates that the service is currently running on your system. The Task Manager is a built-in Windows utility that allows you to monitor and manage running processes and services.
Here are some key points to note about the System Guard Runtime Monitor Broker Service:
Security Enhancement: The service provides runtime monitoring and protection against advanced attacks and exploits. It helps identify suspicious activities and potential threats to the system's security.
Integration with Windows Defender: The System Guard Runtime Monitor Broker Service works alongside other security features provided by Windows Defender, such as real-time antivirus scanning and exploit protection.
Resource Usage: The service runs in the background and typically consumes minimal system resources. Its impact on system performance should be negligible.
Automatic Startup: The service is set to start automatically during system boot, ensuring continuous protection without user intervention.
If you encounter any issues related to the System Guard Runtime Monitor Broker Service, it is recommended to keep your Windows 10 operating system up to date with the latest updates and patches. In case of persistent problems or concerns, you can seek further assistance from Microsoft Support or consult relevant documentation related to Windows Defender System Guard.
==========================================================================================================
#Bard
The System Guard Runtime Monitor Broker Service (SgrmBroker.exe) is a Windows service that is responsible for monitoring and verifying the integrity of the Windows platform. It does this by monitoring the following:
The integrity of the system at startup
The integrity of the system after it is running
The integrity of the system through local and remote authentication
The System Guard Runtime Monitor Broker Service is a critical part of Windows security. It helps to protect your computer from malware and other attacks by ensuring that the system is running in a secure state.
If you see the System Guard Runtime Monitor Broker Service in the Processes tab of Task Manager, it is normal and should not be a cause for concern. The service will only use a small amount of resources and will not affect the performance of your computer.
However, if you notice that the System Guard Runtime Monitor Broker Service is using a lot of resources or is causing your computer to slow down, you can try the following:
Restart your computer.
Update your Windows operating system.
Update your antivirus software.
Run a malware scan.
If you are still having problems, you can contact Microsoft support for help.
Here are some additional details about the System Guard Runtime Monitor Broker Service:
It is a service that is started automatically when Windows starts up.
It is located in the C:\Windows\System32 folder.
It is a Microsoft-signed file.
It is a legitimate Windows process.
If you are still unsure about whether or not the System Guard Runtime Monitor Broker Service is a legitimate process, you can check with Microsoft support.
==========================================================================================================
#ChatGPT
Let's go over the groups that have write permissions to a specific directory in the provided PowerShell script:
NT AUTHORITY\SYSTEM: The NT AUTHORITY\SYSTEM group represents the built-in system account on a Windows system. It has extensive privileges and is typically used by operating system services and processes. Assigning write permissions to this group means that the system itself has write access to the directory.
NT AUTHORITY\Authenticated Users: The NT AUTHORITY\Authenticated Users group includes all user accounts that have been authenticated on the local system or on a domain. It is a built-in group that represents any user account with valid credentials. By granting write permissions to this group, any authenticated user can write to the specified directory.
These groups are commonly assigned write permissions to provide necessary access for system processes and authenticated users to perform write operations in the directory.
==========================================================================================================
#Bard
The option "Allow connections only from computers running Remote Desktop with Network Level Authentication" is a security setting available in the system settings of Windows platforms. When enabled, it restricts remote desktop connections to only those computers that support Network Level Authentication (NLA).
Network Level Authentication is a security protocol that adds an extra layer of authentication before a remote desktop session is established. It requires the remote computer to authenticate itself to the connecting computer before a connection is established. This helps prevent unauthorized access to the remote computer and enhances the overall security of the remote desktop connection.
Best Use Cases in Windows Platforms:
Secure Remote Access: Enabling this option ensures that only computers with Network Level Authentication support can establish remote desktop connections to your Windows computer. It is particularly useful when you want to allow remote access to your computer or network, but you also want to ensure that the connecting devices meet specific security requirements.
Protection against Brute-Force Attacks: By enforcing Network Level Authentication, you can protect your Windows computer or network against brute-force attacks. These attacks involve repeated login attempts with different username and password combinations. Requiring the additional authentication provided by NLA helps mitigate these attacks.
Compliance Requirements: Certain industries or organizations with strict compliance regulations, such as healthcare or financial institutions, may have specific security requirements for remote access. Enabling Network Level Authentication can help meet those requirements and ensure compliance with regulations such as HIPAA or PCI-DSS.
Remote Desktop Gateway: If you are using a Remote Desktop Gateway (RD Gateway) to manage remote connections to your Windows network, enabling this option adds an extra layer of security. It ensures that only authorized devices with NLA support can establish connections through the gateway, reducing the risk of unauthorized access.
Windows Server Environments: In Windows Server environments, enabling Network Level Authentication is highly recommended for remote desktop connections. It helps protect sensitive server resources and prevents unauthorized access, making it an essential security measure in server deployments.
Overall, enabling the "Allow connections only from computers running Remote Desktop with Network Level Authentication" option in Windows platforms provides an additional security measure for remote desktop connections. It reduces the risk of unauthorized access, enhances the security of your Windows system or network, and helps meet compliance requirements in specific industries.
==========================================================================================================
#ChatGPT
I can explain the option "allow connections only from computers running Remote Desktop with Network Level Authentication" in system settings and give some best use cases.
Network Level Authentication (NLA) is a security feature that adds an additional layer of security to Remote Desktop connections. When NLA is enabled, the remote computer must first authenticate with the local computer before the Remote Desktop connection can be established. This helps to protect against unauthorized access to the remote computer.
The option "allow connections only from computers running Remote Desktop with Network Level Authentication" is a security setting that can be enabled in the System Settings on Windows computers. When this option is enabled, only computers that are running Remote Desktop and have NLA enabled will be able to connect to the local computer. This helps to protect the local computer from unauthorized access.
Some best use cases for this option include:
Protecting a computer that contains sensitive data: This option can be used to protect a computer that contains sensitive data from unauthorized access. By requiring that only computers with NLA enabled can connect to the computer, you can help to ensure that only authorized users are able to access the data.
Preventing unauthorized access to a computer: This option can also be used to prevent unauthorized access to a computer. If you are concerned that someone may try to connect to your computer remotely, you can enable this option to help prevent them from doing so.
Enhancing the security of a Remote Desktop connection: By enabling this option, you can enhance the security of your Remote Desktop connections. This can help to protect your computer from unauthorized access and data breaches.
It is important to note that enabling this option may prevent some users from being able to connect to your computer. If you have users who do not have NLA enabled, you will need to disable this option or configure their computers to enable NLA.
==========================================================================================================
#ChatGPT
Implementing a Remote Desktop Gateway (RD Gateway) to manage remote connections to a Windows network involves several steps. Here's a general outline of the process:
Install the RD Gateway Role: Start by installing the RD Gateway role on a server within your Windows network. This can be done through the Server Manager console. Ensure that the server meets the necessary hardware and software requirements for RD Gateway.
Configure RD Gateway Settings: Once the RD Gateway role is installed, open the RD Gateway Manager console. Configure the general settings, including the server name, SSL certificate, and authentication methods.
Create Remote Desktop Resource Authorization Policy (RD RAP): RD RAP determines who can connect to the RD Gateway and the resources they can access. Define the RD RAP policies based on your organization's requirements and user access levels.
Create Remote Desktop Connection Authorization Policy (RD CAP): RD CAP specifies the conditions under which users can connect to the RD Gateway. Define the RD CAP policies based on factors like user groups, device types, and authentication requirements.
Configure Network Policies: Network policies control the conditions under which remote connections are allowed or denied. Configure network policies to align with your security requirements, such as specifying allowed IP ranges or enforcing specific authentication methods.
Configure User Groups and Permissions: Assign users or user groups to the appropriate RD Gateway policies based on their access requirements. This helps control who can connect to the RD Gateway and what resources they can access.
Configure Firewall and Network Settings: Ensure that the necessary ports (TCP port 443 by default) are open on your network's firewall to allow inbound connections to the RD Gateway server. Configure any additional network settings required for proper connectivity.
Test and Verify: Before deploying the RD Gateway in a production environment, perform thorough testing to ensure that remote connections are working as expected. Test different user scenarios, such as connecting from different devices and user groups, to validate the configuration.
Deployment and Monitoring: Once the RD Gateway is tested and verified, deploy it in your production environment. Monitor the RD Gateway for any issues, security events, or performance considerations and make adjustments as needed.
It's important to note that the above steps provide a general overview of implementing an RD Gateway. The specific configuration and steps may vary based on your network environment, security requirements, and organizational needs. It is recommended to consult official Microsoft documentation or seek the assistance of an experienced IT professional to ensure a successful deployment.
==========================================================================================================
#Bard
I can explain how to implement a Remote Desktop Gateway (RD Gateway) to manage remote connections to a Windows network.
A Remote Desktop Gateway (RD Gateway) is a server that allows users to connect to Remote Desktop Services (RDS) servers over the internet. This can be useful for organizations that want to allow their employees to connect to their desktop computers from home or from other remote locations.
To implement an RD Gateway, you will need to do the following:
Install the Remote Desktop Gateway role on a server.
Configure the RD Gateway server to use a certificate.
Configure the firewall to allow RD Gateway traffic.
Create a Remote Desktop Gateway user account.
Configure the RDS servers to allow connections from the RD Gateway server.
Once you have completed these steps, users will be able to connect to their RDS servers from remote locations using the RD Gateway server.
Here are some additional details about each of the steps involved in implementing an RD Gateway:
Installing the Remote Desktop Gateway role
The Remote Desktop Gateway role can be installed on any server that is running Windows Server 2012 or later. To install the role, you can use the Server Manager console.
Configuring the RD Gateway server to use a certificate
The RD Gateway server must use a certificate to authenticate to clients. You can use a self-signed certificate or a certificate that is issued by a certificate authority.
Configuring the firewall to allow RD Gateway traffic
The firewall must be configured to allow RD Gateway traffic. The specific ports that need to be opened will depend on the configuration of the RD Gateway server.
Creating a Remote Desktop Gateway user account
A Remote Desktop Gateway user account is required for users to connect to the RD Gateway server. This account must have the appropriate permissions to connect to the RDS servers.
Configuring the RDS servers to allow connections from the RD Gateway server
The RDS servers must be configured to allow connections from the RD Gateway server. This can be done by configuring the RDS servers to use the RD Gateway server as a Remote Desktop Gateway.
----------------------------------------------------------------------------------------------------
#ChatGPT
FCrDNS stands for "Forward-Confirmed Reverse DNS," and it is a method used to verify that the forward and reverse DNS entries for an IP address match. This process is commonly used to help prevent spam and improve email deliverability.
Find the Reverse DNS entry:
Use the IP address to find the corresponding Reverse DNS entry. The Reverse DNS entry is a PTR (Pointer) record that maps an IP address to a hostname. Many online tools or command-line utilities allow you to perform a Reverse DNS lookup. One common tool is the 'nslookup' command:
nslookup <IP Address>
Perform a Forward DNS lookup:
Now, you need to perform a Forward DNS lookup on the extracted hostname. This means verifying that the hostname resolves back to the original IP address. Again, you can use the 'nslookup' command:
nslookup <Hostname>
Compare results:
Compare the IP address obtained from the Forward DNS lookup with the original IP address. If they match, then the FCrDNS check is successful, and the IP address has valid FCrDNS. This means the forward and reverse DNS entries are consistent, and it may improve the reputation of the IP address for email deliverability.
==========================================================================================================
#putty logging windows 11
To configure PuTTY logging on Windows 10, follow these steps:
Download PuTTY:
If you don't have PuTTY installed on your Windows 10 system, you can download it from the official website: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
Install PuTTY:
Run the downloaded PuTTY installer and follow the installation wizard to install PuTTY on your Windows 10 computer.
Launch PuTTY:
After installation, launch PuTTY by searching for it in the Start menu or by running the executable file (usually putty.exe) from the installation location.
Configure Session Settings:
In the PuTTY configuration window, you'll see a "Session" category on the left side. Here, you can configure the connection settings for your target device, such as hostname or IP address, port, and connection type (SSH, Telnet, etc.).
Enable Logging:
Under the "Session" category, enter the necessary connection details. Then, go to the "Logging" category, which is located under the "Session" category.
Choose the Log File:
In the "Logging" category, you'll see options for logging. Select the "All session output" option to log everything from your session. Alternatively, you can choose "Printable output" to log only the printable characters (excluding control characters) or "None" to disable logging.
Choose the Log File Location:
Select a location on your computer where you want the log file to be saved. You can click the "Browse" button to choose a specific folder and filename for the log file.
Log File Name and Extension:
By default, PuTTY uses the .txt extension for log files. You can change it if desired.
Start the Session:
Once you've configured the logging settings and entered the connection details, click the "Open" button at the bottom of the configuration window to start the session.
Save Configuration (Optional):
If you want to save the logging settings and other session configurations for future use, you can give your configuration a name under the "Saved Sessions" section and click the "Save" button. Next time you run PuTTY, you can load the configuration from the list of saved sessions.
Log Session Activities:
As you work with the device through PuTTY, all session activities will be recorded in the log file at the specified location.
Stop and Save the Log:
To stop and save the log, close the PuTTY session as you would normally. The log file will be available at the location you specified earlier.
Please note that PuTTY logging records all the characters sent and received during your session, including passwords and sensitive information. Make sure to keep the log files secure and avoid logging sensitive data unless required for troubleshooting or auditing purposes.
==========================================================================================================
#check if the host is a domain member on windows server 2019 standard In the PowerShell window
Get-WmiObject -Class Win32_ComputerSystem | Select-Object Domain
#check if the host is a domain member on windows server 2019 standard In the Command Prompt window
systeminfo | findstr /B /C:"Domain"
==========================================================================================================
#Bard
To check if a Windows server is a domain member remotely without logging into the server, you can use the following PowerShell command:
Get-WmiObject -Class Win32_ComputerSystem -ComputerName <IP address of server> | Select-Object Domain
This command will return the name of the domain that the server is a member of, if the server is a domain member. If the server is not a domain member, the command will return an empty value.
To run this command, you will need to have Remote WMI (WMI-R) enabled on the server. To enable WMI-R, run the following command on the server:
winrm quickconfig -r:enable
Once you have enabled WMI-R, you can run the PowerShell command above from any computer on the domain.
Here is an example of how to use the PowerShell command to check if a Windows server is a domain member remotely:
PS C:\> Get-WmiObject -Class Win32_ComputerSystem -ComputerName 192.168.1.100 | Select-Object Domain
Domain
-------
contoso.com
In this example, the output of the command shows that the server with the IP address 192.168.1.100 is a member of the domain contoso.com.
If you do not have PowerShell available, you can also use the Active Directory Users and Computers console to check if a Windows server is a domain member remotely. To do this, follow these steps:
Open the Active Directory Users and Computers console.
Expand the Computers container.
If the server is a domain member, it will be listed in the Computers container. If the server is not a domain member, it will not be listed in the Computers container.
==========================================================================================================
#Bard
this command "Get-WmiObject -Class Win32_ComputerSystem -ComputerName <IP address of server> | Select-Object Domain' receives this error "Get-WmiObject: Access is denied." you are domain administrator. you are running command prompt with administrative privilleges.explain why
There are a few reasons why you might still get the error message "Get-WmiObject: Access is denied." even though you are running the command prompt with administrative privileges:
Remote WMI (WMI-R) is not enabled on the remote server. To enable WMI-R, run the following command on the remote server:
winrm quickconfig -r:enable
The firewall on the remote server is blocking access to the WMI service. To configure the firewall on the remote server to allow access to the WMI service, follow these steps:
Open the Windows Defender Firewall with Advanced Security console.
Click Inbound Rules.
Click New Rule.
Select Port and click Next.
Select TCP and enter the port number for the WMI service, which is 135. Click Next.
Select Allow the connection and click Next.
Select the profile that you want the rule to apply to and click Next.
Give the rule a name and description and click Finish.
The WMI service is not running on the remote server. To verify that the WMI service is running on the remote server, open the Services console and check the status of the WMI service. If the service is not running, start it.
The remote server is not a domain member. If the remote server is not a domain member, you will not be able to use WMI to access it remotely.
If you are still unable to access the WMI service on the remote server, you can contact the server's administrator for assistance.
Here are some additional tips for troubleshooting the "Get-WmiObject: Access is denied." error message:
Make sure that you are using the correct computer name or IP address for the remote server.
Make sure that you are using the correct WMI class and property.
Check the event log on the remote server for any errors related to the WMI service.
Try running the PowerShell command with the -Credential parameter to specify a different set of credentials.
I hope this information is helpful. Please let me know if you have any other questions.
==========================================================================================================
#ChatGPT
this command "Get-WmiObject -Class Win32_ComputerSystem -ComputerName <IP address of server> | Select-Object Domain' receives this error "Get-WmiObject: Access is denied." you are domain administrator. you are running command prompt with administrative privilleges.explain why
Even if you are a domain administrator and running the command prompt with administrative privileges, you may still encounter the "Access is denied" error when using the Get-WmiObject command to access a remote server via its IP address. This is because administrative privileges on your local machine do not automatically grant you the necessary permissions to access remote machines.
Here are a few common reasons why you might encounter this error even as a domain administrator:
Remote UAC (User Account Control): Windows has a feature called User Account Control (UAC) that can affect remote WMI access, even for administrators. UAC might restrict remote administrative access to certain resources.
Solution: To bypass this issue, you can try one of the following:
Disable UAC on the remote server temporarily (not recommended for production systems).
Use the -EnableAllPrivileges parameter with Get-WmiObject to enable all privileges for the remote connection.
Example:
powershell
Copy code
Get-WmiObject -Class Win32_ComputerSystem -ComputerName <IP address of server> -EnableAllPrivileges | Select-Object Domain
Firewall or Security Policies: Firewalls or security policies on the target server or network can block remote WMI queries, even for administrators.
Solution: Ensure that the necessary firewall rules and security policies are configured to allow remote WMI access.
DCOM Configuration: Distributed Component Object Model (DCOM) settings on the target server may prevent remote access.
Solution: Review and configure DCOM settings on the target server to allow remote connections.
WMI Service Configuration: The Windows Management Instrumentation (WMI) service on the target server may be misconfigured or not running.
Solution: Ensure that the WMI service is running and properly configured on the remote server.
DNS Resolution: Ensure that DNS resolution is working correctly, and the target server's hostname can be resolved to its IP address.
Network Issues: Network issues such as connectivity problems or routing issues can also cause remote access problems.
Solution: Check for network issues that might be preventing communication with the remote server.
It's essential to verify and address these issues systematically to resolve the "Access is denied" error when using Get-WmiObject for remote access, even when running with administrative privileges. If necessary, involve your network or system administrators to assist with resolving any network or security-related issues.
==========================================================================================================
#ChatGPT
It seems like you're trying to install the OpenSSH Server feature on Windows Server 2019 using the Install-WindowsFeature command but encountering an error. The error message indicates that the feature name "OpenSSH-Server" is not valid.
The command you initially mentioned (dism /online /add-capability /capabilityname:OpenSSH.Server~~~~0.0.1.0) is used to install OpenSSH as a Windows capability. This approach is different from installing a Windows feature using the Install-WindowsFeature command.
To resolve this, you can follow the steps to install OpenSSH Server using the dism command:
Open PowerShell as Administrator:
Right-click on the PowerShell icon and select "Run as administrator."
Install OpenSSH Server:
Run the following dism command to install the OpenSSH Server feature:
powershell
Copy code
dism /online /add-capability /capabilityname:OpenSSH.Server~~~~0.0.1.0
After executing the command, you should see progress as the operation completes. Once it's done, OpenSSH Server will be installed.
Start the OpenSSH Service:
The installation of OpenSSH Server doesn't automatically start the service. You can start it using the following command:
powershell
Copy code
Start-Service sshd
Configure Firewall Rules:
Configure the Windows Firewall to allow SSH traffic.
powershell
Copy code
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
Verify OpenSSH Service:
Confirm that the OpenSSH service is running:
powershell
Copy code
Get-Service sshd
If the service is running, you should see the status as "Running."
Try SSH Connection Again:
Once the OpenSSH service is up and running, you should be able to SSH into the Windows Server 2019 VM from other machines.
By using the dism command to install the OpenSSH Server capability, you can ensure that OpenSSH is properly installed on your Windows Server 2019 machine.
==========================================================================================================
Use PowerShell to check the status of the WinRM service on the remote machine.
Get-Service WinRM
Check WinRM Configuration view the current WinRM configuration
winrm get winrm/config
View WinRM Listener Configuration view the configured listeners for WinRM
winrm enumerate winrm/config/listener
==========================================================================================================
#ChatGPT
explain what the difference is between installing a software on the specific Windows 10 computer with a local administrator account and installing a software on the specific Windows 10 computer with a domain administrator account. Assume the specific Windows 10 computer is a domain member and you are domain administrator
When installing software on a specific Windows 10 computer that is a domain member, and you have both a local administrator account and a domain administrator account, there are still notable differences in how the installation process works and the scope of authority:
Local Administrator Account:
Privileges: The local administrator account has administrative privileges solely on the specific Windows 10 computer where it is used. It can make system-wide changes, install software, and configure hardware, but these changes are limited to the local machine.
Scope: The authority of the local administrator account is restricted to the local computer only. Any software installed or changes made with this account will not affect other computers in the domain.
Dependencies: Installation and configuration with a local administrator account do not require interaction with the domain controller. The local administrator has complete control over the local machine and can install software without needing any domain permissions.
Domain Administrator Account:
Privileges: The domain administrator account has administrative privileges across the entire domain. This means it can control and configure resources, user accounts, group policies, and software installations for all computers and users within the domain.
Scope: Software installations made with a domain administrator account can affect the specific Windows 10 computer where the installation occurs. However, the domain administrator can also leverage group policies to deploy software to multiple computers across the domain, ensuring consistency in software configurations.
Dependencies: Installation and configuration with a domain administrator account may rely on the presence of a domain controller and specific domain permissions. The domain administrator has authority over network-wide settings and policies, and their actions have a broader impact on the entire domain.
In summary, the primary difference between installing software on a specific Windows 10 computer using a local administrator account and a domain administrator account, both when the computer is a domain member, lies in the scope of authority.
The local administrator's control is limited to the specific computer, and the installation does not have a broader domain-wide impact.
The domain administrator has the capability to manage software installations across the domain, which can include the specific computer in question, but their authority extends to all computers in the domain, making it useful for enforcing centralized software deployment and configuration. However, this comes with greater responsibility and should be used with caution to avoid unintended consequences on the entire network.
==========================================================================================================
LAPS stands for Local Administrator Password Solution, a Microsoft tool designed to manage and secure local administrator passwords on domain-joined Windows devices.
Its main benefits include:
Randomized Passwords: LAPS automatically generates and manages unique, complex passwords for the local administrator account on each Windows device. These passwords are stored securely in Active Directory.
Regular Rotation: LAPS facilitates the scheduled rotation of local administrator passwords, ensuring that even if one password is compromised, the exposure window is limited before it gets changed.
Centralized Management: It integrates with Active Directory, enabling centralized management of local administrator passwords across the organization, providing easy retrieval of these passwords by authorized IT personnel when necessary.
Enhanced Security: By regularly rotating passwords and storing them securely in Active Directory, LAPS helps mitigate the risk of unauthorized access to systems through compromised or shared local administrator credentials, thereby improving overall security posture.
Implementing LAPS helps address common security risks associated with shared or static local administrator passwords on Windows devices, enhancing security and reducing the potential impact of credential-based attacks.
LAPS stands for Local Administrator Password Solution. It's a security management feature built into Microsoft Windows Active Directory that helps to secure local administrator accounts on domain-joined computers.
How LAPS Works:
LAPS automatically manages and rotates the passwords for local administrator accounts on domain-joined devices.
These passwords are stored securely in Active Directory with access control, restricting who can view or reset them.
Authorized users can retrieve the local administrator password using a dedicated tool or interface.
Main Benefit of LAPS:
Improves security: By regularly rotating and securely storing local administrator passwords, LAPS reduces the risk of attackers gaining unauthorized access to domain-joined computers. This is crucial because local administrator accounts have extensive privileges on a device, making them prime targets for attackers.
Additional Benefits:
Reduces password sprawl: Eliminates the need for IT teams to manually manage or share local administrator passwords, reducing the risk of unauthorized access or misuse.
Simplifies password recovery: Authorized users can easily retrieve the local administrator password if needed, without relying on IT assistance.
Complies with security best practices: Utilizing LAPS aligns with security best practices that recommend securing and rotating privileged accounts like local administrators.
Overall, LAPS is a valuable tool for improving the security posture of Windows domain-joined environments by minimizing the risk associated with hardcoded or shared local administrator passwords.
==========================================================================================================
ChatGPT
so it might not have built-in Bluetooth support. If that's the case, you'll need a Bluetooth adapter. Here’s how to check and enable Bluetooth if it’s available:
Check for Bluetooth Capability:
Device Manager: Right-click on the Start menu and select Device Manager. Look for a Bluetooth section. If it's not listed, your desktop likely doesn’t have Bluetooth hardware installed.
System Information: Open the System Information tool by typing msinfo32 in the Run dialog (Win + R) and check under Components for Bluetooth information.
Install Bluetooth Drivers:
If you see Bluetooth hardware listed in Device Manager but it’s not functioning, you might need to install or update the drivers. Go to the HP website, find the support page for your model, and download the latest Bluetooth drivers.
Enable Bluetooth in Windows:
Windows Settings: Go to Settings (Win + I) > Devices > Bluetooth & other devices. If Bluetooth is available, you should see a toggle switch to turn it on.
==========================================================================================================
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment