Skip to main content


Showing posts with the label CMD

Add multiple drivers to a WinPE image

How to add multiple inf drivers to a Windows PE Image?

To add a single driver to a Windows PE Image  is quite straight forward but adding multiple drivers  one by one is not ideal or else it will take a definite amount of time.

Dism command provides an option to add a single driver or add multiple drivers.

To add a single driver or multiple drivers, the first thing to do is to mount the image for editing.

Dism /Mount-Image /ImageFile:"C:\WinPE_amd64\sources\boot.wim" /index:1 /MountDir:"C:\WinPE_amd64\mount"

C:\WinPE_amd64\media\sources\boot.wim -  is the image where the new drivers will be added

C:\WinPE_amd64\mount - this directory will contain the extracted files of wim images, the folder must be created if it doesn't exist

Once the image has been mounted, to add a single driver type the command below:

Dism /Add-Driver /Image:"C:\WinPE_amd64\mount" /Driver:"C:\Folder_Driver\driver.inf"

C:\WinPE_amd64\mount - the folder in which the mount i…

Move folders in command line with specific string

How to move folders in command line without selecting manually the folders?
Manually moving folders is quite ideal if there are two or three folders that needs to be moved. But if the folders are quite a lot and doing it manually is a bit tedious; besides chances are there might be folders that will be missed out.
Command lines and some basic editing in notepad can ease the process of moving folders it can be run via batch file or just simply enter the command at the command prompt window.
Assume that all folders have the word “old-data” as part of its folder name. It can be any string as long as it’s common to all the folders that needs to be moved or archived.
First step, is to open a command prompt window then change directory to the folders.
Example: c:\cd sales_data
Then at sales_data directory type:
dir *old-data* /s/b > file_old_data.txt
replace old-data with any string that is common to all folders.
* is used between the string, which basically means that look for folders with this …

Check if 32 bit or 64 bit processor from command line

How to check processor architecture whether its 32bit or 64bit?
One method is to query the registry from the command line.
Here’s a one liner command line that will check whether the PC processor is 32bit or 64bit.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" | find “ARCHITECTURE”
If the output is something like this:

Then it’s a 64bit, if it shows x86 then it’s a 32 bit.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" | find “IDENTIFIER”
Above query can also identify, the output shows Intel64 for 64bit.
Sample Output: PROCESSOR_IDENTIFIERREG_SZIntel64 Family 6 Model 142 Stepping 10, GenuineIntel

Omitting the find option from the “reg query” command will show quite a few information.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
This query command works in Windows 7, Windows 8 and Windows 10. I believe this will also work in Windows s…

How to open an elevated command prompt from a standard account?

Working in a fast pace environment, will need to get things done quickly to do other tasks that needs to be done also.
Opening a command prompt in a standard user account without signing off and without logging off is possible with the “runas” utility command in Windows environment.
Open the run box and type “cmd”, to open the command prompt window.
Then type:
Runas /user:admin_account cmd
It will ask for a password, if authentication is valid then a new command prompt window will open in an elevated mode. Command works from Windows 7+  version.
That’s it, you just open an elevated command prompt window in a user standard account. Since most users are hungry with the admin password, just watch out with the shoulder sniffing tactic.

Other useful admin commands in a windows environment:
If ever you have a custom local admin account name and you can’t remember, type: net users
It will display all the local user accounts.
To check domain name and current login user account name, type:

Ping IPv4 or IPv6 in Windows 10

Windows 7 and newer releases of Windows supports ping results of either IPv4 or IPv6.

If the remote PC or server is configured for both IPv4 and IPv6, and if you need to ping via hostname and you want to get an IPv4 address type the command below:

ping -4 -n 2 Dhoney_Srv

Output will be IPv4 address of the hostname

ping -6 -n 2 Dhoney_Srv

Output will be IPv6 address of the hostname.

-n 2 send two ICMP packet requests.

Cheers! Till next time.

================================ Free Android Apps:
Click  links below to find out more:
Excel Keyboard guide:
Linux Android App cheat sheet:
Heaven's Dew Fall  Prayer app for Android :
Catholic Rosary Guide  for Android:…

Filter MsiInstaller installation in Event viewer

How to filter or check successful msi installation on a Windows system?
There are quite a lot of ways to filter event viewer, it will solely depend on the taste of the person doing the event viewer audit.
It can be done via PowerShell, XML query, or use command line tools and other methods which the Sys Admin feels comfortable doing.
But when it comes to auditing logs, it’s a tedious task and takes a lot of time and depends on the raw data that you have so you exactly know what you’re searching for.
Command line still a useful tool since it comes handy, you just open the command prompt window and type the command and get the output.
The hardest part is how you digest or do another filtering on the output since it might be convoluted with lots of data. But don’t depend on a single tool, make use of whatever you have on your system and other tools available on the net.
This command line below filters the MsiInstaller for event ID 1033.
wevtutil qe application /q:"*[System[Provider…

PowerShell search files/folder names with regex

Searching files with regex will come in handy provided you know the pattern you want to look for.
Searching for files that you don't have any clue or idea which one to find is such a dreadful situation.
Regex will help to filter files base on the pattern set from a fragmented memory due to multi-tasking world.
For example, you are quite sure that the file you're looking for starts with s and followed by letter k.
So files like skype_password.txt, skew animation.mp4, skbanner.logo, skin.css, skilled-listing.docx or any files that begins with "sk" will be filtered.
Here's the PowerShell code to do it:
$regx_filters = get-childitem "c:\all_files_n_rumble\" -recurse | where-object {$ -match '^s[k]' } Write-Output $regx_filters
To get folder or directory names with regex:
$regexPattern ="^l[i]" Get-ChildItem -Path "c:\all_folder_n_mixes\" -Recurse | Where-Object {$_.PS…

Wanna disable SMBv1 to stop WannaCry

Link from Technet why SMBv1 should be disabled:

STOP using SMBv1

Link below shows how to to check whether SMBV1 is enabled and how to disable SMBV1:

How to disable SMBv1? - How to check if SMBv1 is enabled?

PowerShell codes below is from the link above:

Windows 8 and Windows Server 2012

To check whether SMB1 and SMB2 are enabled:

Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

To disable SMBv1 on the SMB server, run the following cmdlet:

Set-SmbServerConfiguration -EnableSMB1Protocol $false


Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008

Requires Windows PowerShell 2.0 or a later version of PowerShell

To disable SMBv1 on the SMB server, run the following cmdlet:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force

Or if you're not comfortable using PowerShell just open registry editor and do it manually.

PowerShell is quite straight forw…

How to insert landscape orientation in Word?

If you are writing a thesis, a report or an article that you need to insert a landscape layout in a specific page in Word document but your orientation all long is portrait and changing the orientation causes the whole layout to change.
Inserting landscape in a specific page in a word document can be done by inserting section breaks. Let’s just make a basic example.
Let’s say you have 3 page document and you want that first page in Portrait mode, second page in landscape and third page in portrait layout also.
First, click on “home” tab, click the “show/hide paragraph marks” option or see the icon below. Enabling this option the section breaks, spaces and tabs will be visible. But what we are interested is to see the “section breaks”.

In the first page position the cursor on the last area at the bottom of the page.
In Word 2010, click on “page layout” in the ribbon tab. Click on “breaks” and select “next page”. In the second page, position also the cursor at the middle or bottom of t…

Svchost process in task manager

Svchost.exe contains generic host processes.

If the svchost.exe is accidentally close or intentionally close, then the system might crash or shutdown.

There are times that svchost.exe does consume quite a lot of resources and eats up the memory on the system. Thus, it's quite tempting to close or kill the process.

To kill or close a process forcefully via command line can be done using taskkill command plus the process id.

Ex: Taskkill /pid 1234

How to know exactly which service or process the svchost is running?

To check the pid and the process that svchost is running, type:

tasklist /svc

Tasklist /svc command will display the image name, pid and the services.

Output example for tasklist /svc command:

svchost.exe                   1172 EventSystem, fdPHost, FontCache, netprofm,
                                   nsi, W32Time, WdiServiceHost
svchost.exe                   1200 Appinfo, BITS, Browser, CertPropSvc,
                                   EapHost, IKEEXT, iphlpsvc, LanmanSe…