Windows CMD Commands

January 14, 2017

WMIC.exe – Windows CMD Command

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 118

Notice: A non well formed numeric value encountered in /home/future4tech/public_html/wp-content/plugins/crayon-syntax-highlighter/crayon_formatter.class.php on line 119

Windows Management Instrumentation Command.Retrieve a huge range of information about local or remote computers. Make configuration changes to multiple remote machines. The ALIAS defines the component of your system that you want WMIC to interact with.The...

Windows CMD Commands

January 14, 2017

WINRM – Windows CMD Command

Windows Remote Management Secure communication with local and remote computers using web services.

Syntax
      winrm g[et] | s[et] | c[reate] | d[elete] | e[numerate] | 
            i[nvoke] |  id[entify] | quickconfig |  configSDDL |  helpmsg

   Retrieve instances of RESOURCE_URI:
      winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

      winrm get winrm/config
      winrm get winrm/config/client
      winrm get winrm/config/service

   Modify settings in RESOURCE_URI: 
      winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]
         [@{KEY="VALUE"[;KEY="VALUE"]}]
            [-file:VALUE]

   Spawn an instance of RESOURCE_URI:
      winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]
         [@{KEY="VALUE"[;KEY="VALUE"]}]
            [-file:VALUE]

   Control remote access to WinRM resources, launch a GUI to edit security settings.
      winrm configsddl RESOURCE_URI

   Enable this machine for remote management.
      winrm quickconfig [-quiet] [-transport:VALUE]

      This will start the WinRM service, set the service to auto start, create
      a listener and enable an http firewall exception for WS-Management traffic

       -q[uiet]          Don’t prompt for confirmation.

       -transport:VALUE  Perform quickconfig for either http or https.  Default = http.

   List instances of RESOURCE_URI:
      winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]
         [-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]

   Remove an instance of RESOURCE_URI:
      winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

   Execute method specified by ACTION on target object specified by RESOURCE_URI
      winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]
         [@{KEY="VALUE"[;KEY="VALUE"]}]
            [-file:VALUE]

   Display error message associate with the error code.
      winrm helpmsg errorcode

Key

   -a[uthentication]:VALUE
                    The authentication mechanism to use when communicating
                    with the remote machine.

   -defaultCreds    Allow implicit credentials when Negotiate is used.
                    Remote HTTPS operations for trusted machines.

   -dialect:VALUE   Dialect of the filter expression for enumeration or fragment.
                    Example: Use a WQL query
                      -dialect
                    Example: Use XPATH for filtering with enumeration or fragment get/set.
             
   -encoding:VALUE  The encoding type when talking to remote machine (see -remote).
                    Possible options are "utf-8" (the default) or "utf-16".

   -f[ormat]:FORMAT The format of output. FORMAT can be "xml",
                    "pretty" (better formatted XML), or "text".

   -r[emote]:VALUE  Specify the identifier of a remote endpoint/system.
                    This can be a simple host name or a complete URL.

   -skipCAcheck     The certificate issuer need not be a trusted root authority.
                    Remote HTTPS operations for trusted machines.

   -skipCNcheck     The certificate common name (CN) of the server need not match
                    the hostname of the server. HTTPS operations for trusted machines.

   -skipRevocationcheck  Do not check the revocation status of the server certificate.
                    Remote HTTPS operations for trusted machines.

   -SPNPort         Append port number to the Service Principal Name (SPN) of the
                    remote server. 
                    Service principal name is used when Negotiate or Kerberos authentication
                    mechanism is in use.

   -timeout:MS      Timeout in milliseconds. Limits duration of corresponding operation.
                    Default timeout can be configured by:
                       winrm set winrm/config @{MaxTimeoutms="XXXXXX"}
                    Where XXXXXX is an integer indicating milliseconds.

   -file:VALUE

   @{KEY="VALUE"[;KEY="VALUE"]}
                    Input from an XML file or via key/value pairs.
                    Applies to set, create, and invoke operations

   -fragment:VALUE  Specify a section inside the instance XML that is to be updated or
                    retrieved for the given operation.
                     Example: Get the status of the spooler service
                       winrm get wmicimv2/Win32_Service?name=spooler -fragment:Status/text()
                     
                     -options:{KEY="VALUE"[;KEY="VALUE"]}

                     Key/value pairs for provider-specific options.
                     
                     Example:
                       -options:{key1="value1";key2=$null}

100

101

102

103

104

105

106

107

108

Syntax

i[nvoke] | id[entify] | quickconfig | configSDDL | helpmsg

Retrieve instances of RESOURCE_URI:

winrm get RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

winrm get winrm/config

winrm get winrm/config/client

winrm get winrm/config/service

Modify settings in RESOURCE_URI:

winrm set RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

[@{KEY="VALUE"[;KEY="VALUE"]}]

[-file:VALUE]

Spawn an instance of RESOURCE_URI:

winrm create RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

[@{KEY="VALUE"[;KEY="VALUE"]}]

[-file:VALUE]

Control remote access to WinRM resources, launch a GUI to edit security settings.

winrm configsddl RESOURCE_URI

Enable this machine for remote management.

winrm quickconfig [-quiet] [-transport:VALUE]

This will start the WinRM service, set the service to auto start, create

a listener and enable an http firewall exception for WS-Management traffic

-q[uiet] Don’t prompt for confirmation.

-transport:VALUE Perform quickconfig for either http or https. Default = http.

List instances of RESOURCE_URI:

winrm enumerate RESOURCE_URI [-ReturnType:Value] [-Shallow]

[-BasePropertiesOnly] [-SWITCH:VALUE [-SWITCH:VALUE] ...]

Remove an instance of RESOURCE_URI:

winrm delete RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

Execute method specified by ACTION on target object specified by RESOURCE_URI

winrm invoke ACTION RESOURCE_URI [-SWITCH:VALUE [-SWITCH:VALUE] ...]

[@{KEY="VALUE"[;KEY="VALUE"]}]

[-file:VALUE]

Display error message associate with the error code.

winrm helpmsg errorcode

Key

-a[uthentication]:VALUE

The authentication mechanism to use when communicating

with the remote machine.

-defaultCreds Allow implicit credentials when Negotiate is used.

Remote HTTPS operations for trusted machines.

-dialect:VALUE Dialect of the filter expression for enumeration or fragment.

Example: Use a WQL query

-dialect

Example: Use XPATH for filtering with enumeration or fragment get/set.

-encoding:VALUE The encoding type when talking to remote machine (see -remote).

Possible options are "utf-8" (the default) or "utf-16".

-f[ormat]:FORMAT The format of output. FORMAT can be "xml",

"pretty" (better formatted XML), or "text".

-r[emote]:VALUE Specify the identifier of a remote endpoint/system.

This can be a simple host name or a complete URL.

-skipCAcheck The certificate issuer need not be a trusted root authority.

Remote HTTPS operations for trusted machines.

-skipCNcheck The certificate common name (CN) of the server need not match

the hostname of the server. HTTPS operations for trusted machines.

-skipRevocationcheck Do not check the revocation status of the server certificate.

Remote HTTPS operations for trusted machines.

-SPNPort Append port number to the Service Principal Name (SPN) of the

remote server.

Service principal name is used when Negotiate or Kerberos authentication

mechanism is in use.

-timeout:MS Timeout in milliseconds. Limits duration of corresponding operation.

Default timeout can be configured by:

winrm set winrm/config @{MaxTimeoutms="XXXXXX"}

Where XXXXXX is an integer indicating milliseconds.

-file:VALUE

@{KEY="VALUE"[;KEY="VALUE"]}

Input from an XML file or via key/value pairs.

Applies to set, create, and invoke operations

-fragment:VALUE Specify a section inside the instance XML that is to be updated or

retrieved for the given operation.

Example: Get the status of the spooler service

winrm get wmicimv2/Win32_Service?name=spooler -fragment:Status/text()

-options:{KEY="VALUE"[;KEY="VALUE"]}

Key/value pairs for provider-specific options.

Example:

-options:{key1="value1";key2=$null}

WinRM is the Microsoft implementation of WS-Management Protocol, a standard Simple Object Access Protocol (SOAP)-based, firewall-friendly protocol that allows hardware and...

Windows CMD Commands

January 14, 2017

WinDiff – Windows CMD Command

Compare the contents of two files or sets of files with a graphical interface.

Syntax
      windiff [path1] [path2]

Key
    path   Individual files to compare
           or a directory of files to compare

Syntax

windiff [path1] [path2]

Key

path Individual files to compare

or a directory of files to compare

If either path is not specified it will default to the current directory (or a matching file in the current directory)...

Windows CMD Commands

January 14, 2017

WHOAMI.exe – Windows CMD Command

Display user, group and privileges for the current user.

Syntax
      whoami [/upn | /fqdn | /logonid]

      whoami {[/user] [/groups] [/priv]} [/fo Format] [/nh]

      whoami /all [/fo Format] [/nh]

Key

   /upn      Display the user name in user principal name (UPN) format.

   /fqdn     Display the user name in fully qualified domain name (FQDN) format.

   /logonid  Display the logon ID of the current user.

   /user     Display the current domain and user name and the security identifier (SID).

   /groups   Display the user groups to which the current user belongs.

             Includes the <a href="https://en.wikipedia.org/wiki/Mandatory_Integrity_Control">Integrity Control</a> level:
             Mandatory Label\Low Mandatory Level    = Low.
             Mandatory Label\Medium Mandatory Level = Medium/Standard.
             Mandatory Label\High Mandatory Level   = Elevated.

   /priv     Display the security privileges of the current user.

   /fo       The output format. Valid values:
                table  Table format (default)
                list   List format.
                csv    Comma-separated value (CSV) format.

   /all      Display all information in the current access token, including
             the current user name, security identifiers (SID), privileges,
             and groups that the current user belongs to.

   /nh       Don't display the column header in the output.
             This is valid only for table and CSV formats.

   /?        Help

Syntax

whoami [/upn | /fqdn | /logonid]

whoami {[/user] [/groups] [/priv]} [/fo Format] [/nh]

whoami /all [/fo Format] [/nh]

Key

/upn Display the user name in user principal name (UPN) format.

/fqdn Display the user name in fully qualified domain name (FQDN) format.

/logonid Display the logon ID of the current user.

/user Display the current domain and user name and the security identifier (SID).

/groups Display the user groups to which the current user belongs.

Includes the <a href="https://en.wikipedia.org/wiki/Mandatory_Integrity_Control">Integrity Control</a> level:

Mandatory Label\Low Mandatory Level = Low.

Mandatory Label\Medium Mandatory Level = Medium/Standard.

Mandatory Label\High Mandatory Level = Elevated.

/priv Display the security privileges of the current user.

/fo The output format. Valid values:

table Table format (default)

list List format.

csv Comma-separated value (CSV) format.

/all Display all information in the current access token, including

the current user name, security identifiers (SID), privileges,

and groups that the current user belongs to.

/nh Don't display the column header in the output.

This is valid only for table and CSV formats.

/? Help

Examples Display the domain and user name of the current user:whoami Display the user groups to which the current user belongs:whoami /groups Display all...

Windows CMD Commands

January 14, 2017

WHERE.exe – Windows CMD Command

Locate and display files in a directory tree. The WHERE command is roughly equivalent to the UNIX ‘which’ command. By default, the search is done in the current directory and in the PATH.

Syntax
      WHERE [/r Dir] [/q] [/f] [/t] Pattern ...

      WHERE [/q] [/f] [/t] [$ENV:Pattern

      In PowerShell:
      C:\Windows\System32\WHERE.exe ..options as above

key
   /r      A recursive search, starting with the specified Dir directory.

   /q      Don’t display the files but return either an exit code of 0 for success
           or 1 for failure.

   /f      Display the output file name in quotation marks.

   /t      Display the size, time stamp, and date stamp of the file.

  pattern  The Drive\Directory\file, or set of files to be found.
           you can use wildcard characters ( ? * ) and UNC paths.

   ENV     Path to search where ENV is an existing environment variable containing one or more paths.

Syntax

WHERE [/r Dir] [/q] [/f] [/t] Pattern ...

WHERE [/q] [/f] [/t] [$ENV:Pattern

In PowerShell:

C:\Windows\System32\WHERE.exe ..options as above

key

/r A recursive search, starting with the specified Dir directory.

/q Don’t display the files but return either an exit code of 0 for success

or 1 for failure.

/f Display the output file name in quotation marks.

/t Display the size, time stamp, and date stamp of the file.

pattern The Drive\Directory\file, or set of files to be found.

you can use wildcard characters ( ? * ) and UNC paths.

ENV Path to search where ENV is an existing environment variable containing one or more paths.

By default, WHERE...

Windows CMD Commands

January 14, 2017

WEVTUTIL – Windows CMD Command

Retrieve information about event logs and publishers. Archive logs in a self-contained format, Enumerate the available logs, Install and uninstall event manifests, run queries, Exports events (from an event log, from a log file,...

Windows CMD Commands

January 14, 2017

wecutil.exe – Windows CMD Command

Windows Event Collector Utility.Create and manage subscriptions to events forwarded from remote event sources that support WS-Management protocol.

Syntax
      wecutil command [Argument [Argument] ...] [/Option:VALUE [/Option:VALUE] ...]

Key
   List all existent remote event subscriptions:
   es (enum-subscription)

   Get subscription configuration:
   gs (get-subscription) SUBSCRIPTION_ID [/Option:VALUE [/Option:VALUE] ...]
       /f:VALUE
       /format:VALUE
        VALUE can be XML or Terse name-value pairs(default). 

       /u:VALUE
       /unicode:VALUE
       Display output in unicode (UTF-16).
       VALUE can be true or false. If VALUE is true then output is in Unicode.

   Get subscription runtime status:
   gr (get-subscriptionruntimestatus)  SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]
       where EVENT_SOURCE identifies a machine serving as a source of events

   Set subscription configuration: 
   ss (set-subscription) SUBSCRIPTION_ID [/Option:VALUE [/Option:VALUE] ...]

   ss (set-subscription) /c:CONFIG_FILE [/cus:Username [/cup:Password] ...]
   
   Create new subscription:
   cs (create-subscription) CONFIGURATION_FILE [/Option:VALUE [/Option:VALUE] ...]

   Delete subscription:
   ds (delete-subscription) SUBSCRIPTION_ID
   
   Retry subscription:
   rs (retry-subscription) SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]
   
   Configure Windows Event Collector service:
   qc (quick-config)  /quiet:{true|false}                

   /help | ?  Help for the wecutil program.

For a full list of subscriptions/options for specific commands:
   wecutil COMMAND -?

Syntax

wecutil command [Argument [Argument] ...] [/Option:VALUE [/Option:VALUE] ...]

Key

List all existent remote event subscriptions:

es (enum-subscription)

Get subscription configuration:

gs (get-subscription) SUBSCRIPTION_ID [/Option:VALUE [/Option:VALUE] ...]

/f:VALUE

/format:VALUE

VALUE can be XML or Terse name-value pairs(default).

/u:VALUE

/unicode:VALUE

Display output in unicode (UTF-16).

VALUE can be true or false. If VALUE is true then output is in Unicode.

Get subscription runtime status:

gr (get-subscriptionruntimestatus) SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]

where EVENT_SOURCE identifies a machine serving as a source of events

Set subscription configuration:

ss (set-subscription) SUBSCRIPTION_ID [/Option:VALUE [/Option:VALUE] ...]

ss (set-subscription) /c:CONFIG_FILE [/cus:Username [/cup:Password] ...]

Create new subscription:

cs (create-subscription) CONFIGURATION_FILE [/Option:VALUE [/Option:VALUE] ...]

Delete subscription:

ds (delete-subscription) SUBSCRIPTION_ID

Retry subscription:

rs (retry-subscription) SUBSCRIPTION_ID [EVENT_SOURCE [EVENT_SOURCE] ...]

Configure Windows Event Collector service:

qc (quick-config) /quiet:{true|false}

/help | ? Help for the wecutil program.

For a full list of subscriptions/options for specific commands:

wecutil COMMAND -?

You can use either the short or long (shown in parentheses) version of each command...

Windows CMD Commands

January 14, 2017

wbadmin.exe – Windows CMD Command

Windows Backup Administration.The syntax below is for Windows Server 2008 R2 or later, other than where stated. See technet for earlier versions.

Syntax
           --Create and enable a daily backup schedule or modify an existing backup schedule:
      WBADMIN enable backup [-addtarget:BackupTarget] [-removetarget: BackupTarget]
         [-schedule:TimeToRunBackup] [-exclude:ItemsToExclude]
            [-include:VolumesToInclude]
               [-nonRecurseInclude:ItemsToInclude] [-nonRecurseExclude:ItemsToExclude]
                  [-systemState] [-allCritical]
                     [-hyperv:HyperVComponentsToExclude]     *Server 2012 or greater
                        [-vssFull | -vssCopy]                *Server 2012 or greater
                           [-user:UserName][-password:Password] [-quiet]
                              [-allowDeleteOldBackups]       *Server 2012 or greater

      WBADMIN disable backup [-quiet]    --Stop running the existing scheduled daily backups.

      WBADMIN start backup [-backupTarget:{BackupTargetLocation | TargetNetworkShare}]
         [-include:ItemsToInclude] [-exclude:ItemsToExclude]
            [-nonRecurseInclude:ItemsToInclude] [-nonRecurseExclude:ItemsToExclude]
               [-systemState] [-allCritical] [-noVerify]
                  [-user:UserName] [-password:Password]
                     [-noInheritAcl]
                        [-vssFull | -vssCopy]      *Server 2012 or greater
                           [-quiet]

      WBADMIN stop job [-quiet]    --Cancel the backup or recovery operation that is currently running.

      WBADMIN get disks            --List the internal and external disks that are currently online for the local computer.

      WBADMIN get items -version:VersionIdentifier [-backupTarget:{BackupDestinationVolume | NetworkSharePath}]
        [-machine:BackupMachineName]       --List the items included in a specific backup.

      WBADMIN get status   --Report the status of the backup or recovery operation that is currently running.

      WBADMIN get versions [-backupTarget:{BackupTargetLocation | NetworkSharePath}]
        [-machine:BackupMachineName]       --List details about the available stored backups. 

      WBADMIN start recovery -version:VersionIdentifier -items:{VolumesToRecover | AppsToRecover | FilesOrFoldersToRecover}
         -itemtype:{Volume | App | File} [-backupTarget:{VolumeHostingBackup | NetworkShareHostingBackup}]
            [-machine:BackupMachineName] [-recoveryTarget:{TargetVolumeForRecovery | TargetPathForRecovery}]
               [-recursive] [-overwrite:{Overwrite | CreateCopy | Skip}]
                  [-notRestoreAcl] [-skipBadClusterCheck] [-noRollForward] [-quiet]

      WBADMIN start systemstatebackup -backupTarget:VolumeName [-quiet]

      WBADMIN start systemstaterecovery -version:VersionIdentifier -showsummary
        [-backupTarget:{BackupDestinationVolume | NetworkSharePath}]
           [-machine:BackupMachineName] [-recoveryTarget:TargetPathForRecovery] [-authsysvol] [-autoReboot] [-quiet]

      WBADMIN delete systemstatebackup {-keepVersions:NumberofCopies | -version:VersionIdentifier | -deleteOldest}
        [-backupTarget:VolumeName] [-machine:BackupMachineName] [-quiet]

      WBADMIN start sysrecovery -version:VersionIdentifier -backupTarget:{BackupDestinationVolume | NetworkShareHostingBackup}
        [-machine:BackupMachineName] [-restoreAllVolumes] [-recreateDisks] [-excludeDisks] [-skipBadClusterCheck] [-quiet]

      WBADMIN delete catalog [-quiet]    --Delete the backup catalog from the local computer.
                                         --Use when the catalog is corrupt and cannot be restored with 'wbadmin restore catalog'.

      WBADMIN restore catalog -backupTarget:{BackupDestinationVolume | NetworkShareHostingBackup}
        [-machine:BackupMachineName] [-quiet]    --Recovers a backup catalog for the local computer from a storage location that you specify.

Key
  -addtarget     Storage location for backups. A disk, volume, or UNC path.
  -allCritical   Include all critical volumes in the backups. Use only with -backupTarget. Can be used with -include.
  -allowDeleteOldBackups  Overwrite any backups made before the computer was upgraded.
  -authsysvol    If used, performs an authoritative restore of SYSVOL (the System Volume shared directory).
  -autoReboot    Restart the system at the end of the system state recovery operation.
                 This parameter is valid only for a recovery to the original location.
                 We do not recommend you use this parameter if you need to perform steps after the recovery operation.

  -backupTarget  The storage location for this backup. Requires an HD drive letter, a volume GUID-based path or UNC path.

  -exclude       A comma-delimited list of items to exclude from the backup: files, folders, or volumes.
  -include       A comma-delimited list of items to include in the backup: multiple files, folders, or volumes.

  -excludeDisks  Valid only when specified with -recreateDisks and must be input as a comma-delimited list of disk identifiers
                 (as listed in the output of wbadmin get disks). Excluded disks are not partitioned or formatted.
                 This parameter helps preserve data on disks that you do not want modified during the recovery operation.

  -hyperv        A comma-delimited list of components to be included in backup.
                 The identifier could be a component name or component GUID (with or without braces).

  -machine       The computer that you want backup details for. Use when backups of multiple computers are stored together.

  -nonRecurseExclude   Non-recursive, comma-delimited list of items to exclude from the backup.
  -nonRecurseInclude   Non-recursive, comma-delimited list of items to include in the backup. 
                       Use only with the -backupTarget parameter.

  -noRollForward Valid only when recovering applications. Allows for previous point-in-time recovery of an application
                 if the latest version from the backups is selected.
                 For other versions of the application that are not the latest, previous point-in-time recovery is done as the default.

  -noVerify      Specifies that backups saved to removable media (such as a DVD) are not verified for errors.
  -noInheritAcl  Apply the access control list (ACL) permissions that correspond to the credentials provided by the
                  -user and -password parameters to the folder that contains the backup.

  -overwrite     Valid only when recovering files. If a file being recovered already exists:
                     Skip       - Skip the existing file and continue with recovery of the next file.
                     CreateCopy - Create a copy of the existing file so that the existing file is not modified.
                     Overwrite  - Overwrite the existing file with the file from the backup.

  -recoveryTarget  The location to restore to. Use if this location is different than the location that was previously backed up.

  -recreateDisks Recover a disk configuration to the state that existed when the backup was created.
                 Warning: This parameter deletes all data on volumes that host operating system components.
                 It might also delete data from data volumes.

  -recursive     Valid only when recovering files. Recover the files in the folders and all sub-folders.
                 By default, only files which reside directly in the specified folders are recovered.

  -restoreAllVolumes  Recover all volumes from the selected backup. If this parameter is not specified, only critical volumes
                 (volumes that contain the system state and operating system components) are recovered.
                 This parameter is useful when you need to recover non-critical volumes during system recovery.

  -schedule      Times of day to create a backup, formatted as HH:MM and comma delimited.
  -showsummary   Report the summary of the last system state recovery (after the restart required to complete the operation).
                 This parameter cannot be accompanied by any other parameters.

  -skipBadClusterCheck   Skip checking the recovery disks for bad cluster information. If you are restoring to an alternate
                 server or hardware, we recommend that you do not use this parameter.
                 You can manually run chkdsk /b on your recovery disks at any time to check them for bad clusters, and then
                 update the file system information accordingly.
                 Warning: Until you run chkdsk the bad clusters reported on your recovered system may not be accurate.

  -systemState   Create a backup that includes the system state in addition to items specified with the -include.

  -user          The user with write permission to the backup storage destination.
                 A member of the Administrators group or Backup Operators group on the computer being backed up.
  -password      The password for -user.

  -version       The version of the backup in MM/DD/YYYY-HH:MM format. To view version information, type 'wbadmin get versions'.

  -vssFull       Perform a full back up using the Volume Shadow Copy Service (VSS).
                 All files are backed up, each file's history is updated to reflect that it was backed up, and the logs
                 of previous backups may be truncated.
                 Do not use this parameter if you are using a product other than Windows Server Backup to back up applications
                 that are on the volumes included in the current backup. Doing so can potentially break the incremental,
                 differential, or other type of backups that the other backup product is creating because the history that
                 they rely on might be missing and they might perform a full backup unnecessarily.

  -vssCopy       Perform a copy backup using VSS. All files are backed up but the history of the files being backup up
                 is not updated so you preserve the all the change information and log files.
                 This is the default value. A copy backup cannot be used for incremental or differential backups or restores.

  -quiet         Run the subcommand with no prompts to the user.

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

Syntax

--Create and enable a daily backup schedule or modify an existing backup schedule:

WBADMIN enable backup [-addtarget:BackupTarget] [-removetarget: BackupTarget]

[-schedule:TimeToRunBackup] [-exclude:ItemsToExclude]

[-include:VolumesToInclude]

[-nonRecurseInclude:ItemsToInclude] [-nonRecurseExclude:ItemsToExclude]

[-systemState] [-allCritical]

[-hyperv:HyperVComponentsToExclude] *Server 2012 or greater

[-vssFull | -vssCopy] *Server 2012 or greater

[-user:UserName][-password:Password] [-quiet]

[-allowDeleteOldBackups] *Server 2012 or greater

WBADMIN disable backup [-quiet] --Stop running the existing scheduled daily backups.

WBADMIN start backup [-backupTarget:{BackupTargetLocation | TargetNetworkShare}]

[-include:ItemsToInclude] [-exclude:ItemsToExclude]

[-nonRecurseInclude:ItemsToInclude] [-nonRecurseExclude:ItemsToExclude]

[-systemState] [-allCritical] [-noVerify]

[-user:UserName] [-password:Password]

[-noInheritAcl]

[-vssFull | -vssCopy] *Server 2012 or greater

[-quiet]

WBADMIN stop job [-quiet] --Cancel the backup or recovery operation that is currently running.

WBADMIN get disks --List the internal and external disks that are currently online for the local computer.

WBADMIN get items -version:VersionIdentifier [-backupTarget:{BackupDestinationVolume | NetworkSharePath}]

[-machine:BackupMachineName] --List the items included in a specific backup.

WBADMIN get status --Report the status of the backup or recovery operation that is currently running.

WBADMIN get versions [-backupTarget:{BackupTargetLocation | NetworkSharePath}]

[-machine:BackupMachineName] --List details about the available stored backups.

WBADMIN start recovery -version:VersionIdentifier -items:{VolumesToRecover | AppsToRecover | FilesOrFoldersToRecover}

-itemtype:{Volume | App | File} [-backupTarget:{VolumeHostingBackup | NetworkShareHostingBackup}]

[-machine:BackupMachineName] [-recoveryTarget:{TargetVolumeForRecovery | TargetPathForRecovery}]

[-recursive] [-overwrite:{Overwrite | CreateCopy | Skip}]

[-notRestoreAcl] [-skipBadClusterCheck] [-noRollForward] [-quiet]

WBADMIN start systemstatebackup -backupTarget:VolumeName [-quiet]

WBADMIN start systemstaterecovery -version:VersionIdentifier -showsummary

[-backupTarget:{BackupDestinationVolume | NetworkSharePath}]

[-machine:BackupMachineName] [-recoveryTarget:TargetPathForRecovery] [-authsysvol] [-autoReboot] [-quiet]

WBADMIN delete systemstatebackup {-keepVersions:NumberofCopies | -version:VersionIdentifier | -deleteOldest}

[-backupTarget:VolumeName] [-machine:BackupMachineName] [-quiet]

WBADMIN start sysrecovery -version:VersionIdentifier -backupTarget:{BackupDestinationVolume | NetworkShareHostingBackup}

[-machine:BackupMachineName] [-restoreAllVolumes] [-recreateDisks] [-excludeDisks] [-skipBadClusterCheck] [-quiet]

WBADMIN delete catalog [-quiet] --Delete the backup catalog from the local computer.

--Use when the catalog is corrupt and cannot be restored with 'wbadmin restore catalog'.

WBADMIN restore catalog -backupTarget:{BackupDestinationVolume | NetworkShareHostingBackup}

[-machine:BackupMachineName] [-quiet] --Recovers a backup catalog for the local computer from a storage location that you specify.

Key

-addtarget Storage location for backups. A disk, volume, or UNC path.

-allCritical Include all critical volumes in the backups. Use only with -backupTarget. Can be used with -include.

-allowDeleteOldBackups Overwrite any backups made before the computer was upgraded.

-authsysvol If used, performs an authoritative restore of SYSVOL (the System Volume shared directory).

-autoReboot Restart the system at the end of the system state recovery operation.

This parameter is valid only for a recovery to the original location.

We do not recommend you use this parameter if you need to perform steps after the recovery operation.

-backupTarget The storage location for this backup. Requires an HD drive letter, a volume GUID-based path or UNC path.

-exclude A comma-delimited list of items to exclude from the backup: files, folders, or volumes.

-include A comma-delimited list of items to include in the backup: multiple files, folders, or volumes.

-excludeDisks Valid only when specified with -recreateDisks and must be input as a comma-delimited list of disk identifiers

(as listed in the output of wbadmin get disks). Excluded disks are not partitioned or formatted.

This parameter helps preserve data on disks that you do not want modified during the recovery operation.

-hyperv A comma-delimited list of components to be included in backup.

The identifier could be a component name or component GUID (with or without braces).

-machine The computer that you want backup details for. Use when backups of multiple computers are stored together.

-nonRecurseExclude Non-recursive, comma-delimited list of items to exclude from the backup.

-nonRecurseInclude Non-recursive, comma-delimited list of items to include in the backup.

Use only with the -backupTarget parameter.

-noRollForward Valid only when recovering applications. Allows for previous point-in-time recovery of an application

if the latest version from the backups is selected.

For other versions of the application that are not the latest, previous point-in-time recovery is done as the default.

-noVerify Specifies that backups saved to removable media (such as a DVD) are not verified for errors.

-noInheritAcl Apply the access control list (ACL) permissions that correspond to the credentials provided by the

-user and -password parameters to the folder that contains the backup.

-overwrite Valid only when recovering files. If a file being recovered already exists:

Skip - Skip the existing file and continue with recovery of the next file.

CreateCopy - Create a copy of the existing file so that the existing file is not modified.

Overwrite - Overwrite the existing file with the file from the backup.

-recoveryTarget The location to restore to. Use if this location is different than the location that was previously backed up.

-recreateDisks Recover a disk configuration to the state that existed when the backup was created.

Warning: This parameter deletes all data on volumes that host operating system components.

It might also delete data from data volumes.

-recursive Valid only when recovering files. Recover the files in the folders and all sub-folders.

By default, only files which reside directly in the specified folders are recovered.

-restoreAllVolumes Recover all volumes from the selected backup. If this parameter is not specified, only critical volumes

(volumes that contain the system state and operating system components) are recovered.

This parameter is useful when you need to recover non-critical volumes during system recovery.

-schedule Times of day to create a backup, formatted as HH:MM and comma delimited.

-showsummary Report the summary of the last system state recovery (after the restart required to complete the operation).

This parameter cannot be accompanied by any other parameters.

-skipBadClusterCheck Skip checking the recovery disks for bad cluster information. If you are restoring to an alternate

server or hardware, we recommend that you do not use this parameter.

You can manually run chkdsk /b on your recovery disks at any time to check them for bad clusters, and then

update the file system information accordingly.

Warning: Until you run chkdsk the bad clusters reported on your recovered system may not be accurate.

-systemState Create a backup that includes the system state in addition to items specified with the -include.

-user The user with write permission to the backup storage destination.

A member of the Administrators group or Backup Operators group on the computer being backed up.

-password The password for -user.

-version The version of the backup in MM/DD/YYYY-HH:MM format. To view version information, type 'wbadmin get versions'.

-vssFull Perform a full back up using the Volume Shadow Copy Service (VSS).

All files are backed up, each file's history is updated to reflect that it was backed up, and the logs

of previous backups may be truncated.

Do not use this parameter if you are using a product other than Windows Server Backup to back up applications

that are on the volumes included in the current backup. Doing so can potentially break the incremental,

differential, or other type of backups that the other backup product is creating because the history that

they rely on might be missing and they might perform a full backup unnecessarily.

-vssCopy Perform a copy backup using VSS. All files are backed up but the history of the files being backup up

is not updated so you preserve the all the change information and log files.

This is the default value. A copy backup cannot be used for incremental or differential backups or restores.

-quiet Run the subcommand with no prompts to the user.

Volume paths can be specified using volume drive letters, mount points, or GUID-based...

Windows CMD Commands

January 14, 2017

WAITFOR.exe – Windows CMD Command

Wait for or send a signal. Waitfor is used to synchronize events between one or more networked computers.

Syntax
   Wait for a signal:
      waitfor [/t Timeout] SignalName

   Send a signal:
      waitfor [/s Computer [/u [Domain\]User [/p [Password]]]] /si SignalName

Key
   /s Computer  The name or IP address of the computer to signal
                (do not include backslashes).

   /u User      Run the script using the credentials of the specified user account.
                By default, waitfor uses the current user's credentials.

   /p [Password] The password of the user account specified with /u

   /si          Send the signal across the network to waiting machines.

   /t Timeout   Number of seconds to wait for a signal.
                The valid range is 1 - 99999 (27.7 hours)
                default = wait indefinitely.

   SignalName   The signal that waitfor waits for or sends.
                SignalName is not case-sensitive.

   /?           Display help.

Syntax

Wait for a signal:

waitfor [/t Timeout] SignalName

Send a signal:

waitfor [/s Computer [/u [Domain\]User [/p [Password]]]] /si SignalName

Key

/s Computer The name or IP address of the computer to signal

(do not include backslashes).

/u User Run the script using the credentials of the specified user account.

By default, waitfor uses the current user's credentials.

/p [Password] The password of the user account specified with /u

/si Send the signal across the network to waiting machines.

/t Timeout Number of seconds to wait for a signal.

The valid range is 1 - 99999 (27.7 hours)

default = wait indefinitely.

SignalName The signal that waitfor waits for or sends.

SignalName is not case-sensitive.

/? Display help.

Signal names cannot exceed 225 characters. Valid characters include a-z, A-Z, 0-9, the SignalName is...

Windows CMD Commands

January 14, 2017

W32TM.exe – Windows CMD Command

Time Service Utility.

Syntax

  Register the time service, and add default config to the registry
      W32TM /register

  Unregister the time service, and remove config from the registry
      W32TM /unregister

  The domain/computers to monitor
      W32TM /monitor [/domain:domain_name] [/computers:name[,name[,name...]]] [/threads:num]

  Convert a Windows NT system time, in (10^-7)s intervals from 0h 1-Jan 1601, into a readable format.
      W32TM /ntte NT_Time_Epoch

  Converts a Network Time Protocol (<a href="https://en.wikipedia.org/wiki/Network_Time_Protocol">NTP</a>) time, in (2^-32)s intervals from 0h 1-Jan 1900, into a readable format
      W32TM /ntpte Network_Time

  Tell a computer that it should resynchronize its clock as soon as possible, discarding all accumulated error stats
      W32TM /resync [/computer:computer] [/nowait] [/rediscover] [/soft]

  Display a strip chart of the offset between this computer and another computer
      W32TM /stripchart /computer:target [/period:refresh] [/dataonly]
              [/samples:count] [/packetinfo] [/ipprotocol:&lt;4|6&gt;

  Adjust the configuration of target
      W32TM /config [/computer:target] [/update] [/manualpeerlist:peers]
              [/syncfromflags:source] [/LocalClockDispersion:seconds]
                 [/reliable:(YES|NO)] [/largephaseoffset:milliseconds]

  Display the current time zone settings.
      W32TM /tz

  Display the values that are associated with a given registry key.
      (default/root key is HKLM\System\CurrentControlSet\Services\W32Time)
      W32TM /dumpreg [/subkey:key] [/computer:target]

  Display a computer's Windows Time service information.
      W32TM /query [/computer:target] {/source | /configuration | /peers | /status} [/verbose]

  Enable or disable a local computer Windows Time service private log.
      W32TM /debug {/disable | {/enable /file:name /size:bytes /entries:value [/truncate]}}


Options:

   Domain  The domain to monitor. If no domain name is specified, or neither the domain nor
            computers option is specified, the default domain is used.
            This option might be used more than once.

   computers Monitor the given list of computers. Computer names are separated by commas, with
            no spaces. If a name has a prefix of a ‘*’, it is treated as a primary domain
            controller (PDC). You can use this option more than once.

   computer The computer to act upon, by default the local computer.

   threads  The number of computers to analyze simultaneously. 1-50, default=3.

   NT_Time_Epoch
            A hex value representing a 64 bit integer that represents the number of seconds
            elapsed since 1900-01-01 00:00:00 (can be supplied as either Hex or integer)
            In reverse byte order, the first hex byte is the least significant:
            (1900-01-01 00:00:01 is encoded as 0x01000000)

   /nowait  Do not wait for the resynchronization to occur; return immediately.
            Otherwise, wait for the resynchronization to complete before returning.

   /rediscover  Redetect the network configuration and rediscover network sources;
            then, resynchronize.

   /soft    This option is only provided for compatibility with older time servers and will
            resynchronize using existing error statistics..

   /period:refresh
            The time between samples, in seconds. The default value is 2 seconds.

   /DataonlyDisplay only the data, without graphics.

   /samples:count
            Collect count samples; then, stop.
            If a value is not specified, samples will be collected until Ctrl+C is pressed.

   /packetinfo
            Print out NTP packet response message.

   /Ipprotocol 4|6
            Specify the IP protocol to use. Default = use whatever is available.

   /update  Notify the time service that the configuration has changed, causing the changes
            to take effect.

   /manualpeerlist:peers
            Set the manual peer list to peers, which is a space-delimited list of Domain Name
            System (DNS) and/or IP addresses. When you are specifying multiple peers, this option
            must be enclosed in quotation marks (").

   /syncfromflags:source
            Sets what sources the NTP client should synchronize from. source should be a
            comma-separated list of these keywords (not case sensitive):
              MANUAL — Include peers from the manual peer list.
              DOMHIER — Synchronize from a domain controller in the domain hierarchy.
              NO     — Do not synchronize from any server.
              ALL    — Synchronize from both manual and domain peers.

   /LocalClockDispersion:seconds
            Configures the accuracy of the internal clock that W32time will assume when
            it cannot acquire time from its configured sources.

   /reliable:(YES|NO)
            Set whether this computer is a reliable time source. This setting is meaningful only on domain controllers.

   /largephaseoffset:milliseconds
            Sets the time difference between local time and network time that W32time will consider to be a spike. 

   /source  Display the time source.

   /configuration
            Display the configuration of run time and where the setting comes from.
            In verbose mode, display the undefined or unused setting also.

   /peers   Display a list of peers and their status.

   /status  Display Windows Time service status.

   /verbose Set the verbose mode to display more information.

   /disable Disable the private log.

   /enable  Enable the private log.
              file:name   The absolute file name.
              size:bytes  The maximum size for circular logging.
              entries:value  Contains a list of flags, specified by number and separated by commas, that specify
                             the types of information that should be logged. Valid numbers are 0 to 300.
                             A range of numbers is valid, in addition to single numbers, such as 0 through 100,103,106.
                             Value 0-300 is for logging all information.
   /truncate Truncate the file if it exists.

   /?       Display help.

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

Syntax

W32TM /register

Unregister the time service, and remove config from the registry

W32TM /unregister

The domain/computers to monitor

W32TM /monitor [/domain:domain_name] [/computers:name[,name[,name...]]] [/threads:num]

Convert a Windows NT system time, in (10^-7)s intervals from 0h 1-Jan 1601, into a readable format.

W32TM /ntte NT_Time_Epoch

Converts a Network Time Protocol (<a href="https://en.wikipedia.org/wiki/Network_Time_Protocol">NTP</a>) time, in (2^-32)s intervals from 0h 1-Jan 1900, into a readable format

W32TM /ntpte Network_Time

Tell a computer that it should resynchronize its clock as soon as possible, discarding all accumulated error stats

W32TM /resync [/computer:computer] [/nowait] [/rediscover] [/soft]

Display a strip chart of the offset between this computer and another computer

W32TM /stripchart /computer:target [/period:refresh] [/dataonly]

[/samples:count] [/packetinfo] [/ipprotocol:<4|6>

Adjust the configuration of target

W32TM /config [/computer:target] [/update] [/manualpeerlist:peers]

[/syncfromflags:source] [/LocalClockDispersion:seconds]

[/reliable:(YES|NO)] [/largephaseoffset:milliseconds]

Display the current time zone settings.

W32TM /tz

Display the values that are associated with a given registry key.

(default/root key is HKLM\System\CurrentControlSet\Services\W32Time)

W32TM /dumpreg [/subkey:key] [/computer:target]

Display a computer's Windows Time service information.

W32TM /query [/computer:target] {/source | /configuration | /peers | /status} [/verbose]

Enable or disable a local computer Windows Time service private log.

W32TM /debug {/disable | {/enable /file:name /size:bytes /entries:value [/truncate]}}

Options:

Domain The domain to monitor. If no domain name is specified, or neither the domain nor

computers option is specified, the default domain is used.

This option might be used more than once.

computers Monitor the given list of computers. Computer names are separated by commas, with

no spaces. If a name has a prefix of a ‘*’, it is treated as a primary domain

controller (PDC). You can use this option more than once.

computer The computer to act upon, by default the local computer.

threads The number of computers to analyze simultaneously. 1-50, default=3.

NT_Time_Epoch

A hex value representing a 64 bit integer that represents the number of seconds

elapsed since 1900-01-01 00:00:00 (can be supplied as either Hex or integer)

In reverse byte order, the first hex byte is the least significant:

(1900-01-01 00:00:01 is encoded as 0x01000000)

/nowait Do not wait for the resynchronization to occur; return immediately.

Otherwise, wait for the resynchronization to complete before returning.

/rediscover Redetect the network configuration and rediscover network sources;

then, resynchronize.

/soft This option is only provided for compatibility with older time servers and will

resynchronize using existing error statistics..

/period:refresh

The time between samples, in seconds. The default value is 2 seconds.

/DataonlyDisplay only the data, without graphics.

/samples:count

Collect count samples; then, stop.

If a value is not specified, samples will be collected until Ctrl+C is pressed.

/packetinfo

Print out NTP packet response message.

/Ipprotocol 4|6

Specify the IP protocol to use. Default = use whatever is available.

/update Notify the time service that the configuration has changed, causing the changes

to take effect.

/manualpeerlist:peers

Set the manual peer list to peers, which is a space-delimited list of Domain Name

System (DNS) and/or IP addresses. When you are specifying multiple peers, this option

must be enclosed in quotation marks (").

/syncfromflags:source

Sets what sources the NTP client should synchronize from. source should be a

comma-separated list of these keywords (not case sensitive):

MANUAL — Include peers from the manual peer list.

DOMHIER — Synchronize from a domain controller in the domain hierarchy.

NO — Do not synchronize from any server.

ALL — Synchronize from both manual and domain peers.

/LocalClockDispersion:seconds

Configures the accuracy of the internal clock that W32time will assume when

it cannot acquire time from its configured sources.

/reliable:(YES|NO)

Set whether this computer is a reliable time source. This setting is meaningful only on domain controllers.

/largephaseoffset:milliseconds

Sets the time difference between local time and network time that W32time will consider to be a spike.

/source Display the time source.

/configuration

Display the configuration of run time and where the setting comes from.

In verbose mode, display the undefined or unused setting also.

/peers Display a list of peers and their status.

/status Display Windows Time service status.

/verbose Set the verbose mode to display more information.

/disable Disable the private log.

/enable Enable the private log.

file:name The absolute file name.

size:bytes The maximum size for circular logging.

entries:value Contains a list of flags, specified by number and separated by commas, that specify

the types of information that should be logged. Valid numbers are 0 to 300.

A range of numbers is valid, in addition to single numbers, such as 0 through 100,103,106.

Value 0-300 is for logging all information.

/truncate Truncate the file if it exists.

/? Display help.

The W32Time service is not a full-featured Network Time Protocol (NTP) solution that meets time-sensitive needs. By default the Windows Time service (w32time) will synchronize it’s time once per week.This can be extended to...