Skip to main content

Posts

Showing posts with the label CMD

Backup SystemState Windows Server to a network share

Backup SystemState of a server to a network share is preferable rather than backing up to another partition within the local server.
Backing up to a network share is quite a good practice, so just in case anything goes wrong to the local server the system state is still safe since the backup is on a network share.
So, it’s like the old adage. Don’t put eggs in one basket. If all eggs are in one basket and if the basket is broken then everything is gone. Same logic goes to a server backup, protecting a server with a backup but then putting the backup to a local partition does not really protect the server from hard disk failure.
How to backup system state using wbadmin to a network share?
It’s quite straight forward but command prompt must be run at an elevated mode, and a network share that is accessible by the server and has enough space to hold the backup.
Command below will work with Windows 2008 and Windows 2012; newer version of Windows may still work but not tested.
wbadmin star…

Empty log or replace large files

Log files can easily occupy the space of a drive.

If the log files is collecting or monitoring multiple system then chances are it will grow in size very quickly.

If it the log file is in a text format, even if it comes in Giga or Tera bytes size it can be emptied very quickly in a command line.

If the log files has been analyzed or not in use anymore, then it is a good candidate to get rid of it rather than occupy the space of a drive for nothing.

To empty a log file or a text file:

In Windows open command prompt and type:

echo "First Line" > Packets_2018.log

The log file will be replace with the word "First Line" and only a few bytes in size. Whatever was the content before on that log file is ditch away. So, be careful in emptying a file it's not reversible,

In Linux open Terminal and type:

echo "Line 1" > Packet_logstash.log

Till next time..Cheers!

================================ Free Android Apps:
Click  links below to find out more:
Excel Keyb…

Add multiple drivers to a WinPE image

How to add multiple inf drivers to a Windows PE Image?

To add a single driver to a Windows PE Image  is quite straight forward but adding multiple drivers  one by one is not ideal or else it will take a definite amount of time.

Dism command provides an option to add a single driver or add multiple drivers.


To add a single driver or multiple drivers, the first thing to do is to mount the image for editing.

Dism /Mount-Image /ImageFile:"C:\WinPE_amd64\sources\boot.wim" /index:1 /MountDir:"C:\WinPE_amd64\mount"

C:\WinPE_amd64\media\sources\boot.wim -  is the image where the new drivers will be added

C:\WinPE_amd64\mount - this directory will contain the extracted files of wim images, the folder must be created if it doesn't exist

Once the image has been mounted, to add a single driver type the command below:

Dism /Add-Driver /Image:"C:\WinPE_amd64\mount" /Driver:"C:\Folder_Driver\driver.inf"

C:\WinPE_amd64\mount - the folder in which the mount i…

Move folders in command line with specific string

How to move folders in command line without selecting manually the folders?
Manually moving folders is quite ideal if there are two or three folders that needs to be moved. But if the folders are quite a lot and doing it manually is a bit tedious; besides chances are there might be folders that will be missed out.
Command lines and some basic editing in notepad can ease the process of moving folders it can be run via batch file or just simply enter the command at the command prompt window.
Assume that all folders have the word “old-data” as part of its folder name. It can be any string as long as it’s common to all the folders that needs to be moved or archived.
First step, is to open a command prompt window then change directory to the folders.
Example: c:\cd sales_data
Then at sales_data directory type:
dir *old-data* /s/b > file_old_data.txt
replace old-data with any string that is common to all folders.
* is used between the string, which basically means that look for folders with this …

Check if 32 bit or 64 bit processor from command line

How to check processor architecture whether its 32bit or 64bit?
One method is to query the registry from the command line.
Here’s a one liner command line that will check whether the PC processor is 32bit or 64bit.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" | find “ARCHITECTURE”
If the output is something like this:
PROCESSOR_ARCHITECTUREREG_SZAMD64

Then it’s a 64bit, if it shows x86 then it’s a 32 bit.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" | find “IDENTIFIER”
Above query can also identify, the output shows Intel64 for 64bit.
Sample Output: PROCESSOR_IDENTIFIERREG_SZIntel64 Family 6 Model 142 Stepping 10, GenuineIntel

Omitting the find option from the “reg query” command will show quite a few information.
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
This query command works in Windows 7, Windows 8 and Windows 10. I believe this will also work in Windows s…

How to open an elevated command prompt from a standard account?

Working in a fast pace environment, will need to get things done quickly to do other tasks that needs to be done also.
Opening a command prompt in a standard user account without signing off and without logging off is possible with the “runas” utility command in Windows environment.
Open the run box and type “cmd”, to open the command prompt window.
Then type:
Runas /user:admin_account cmd
It will ask for a password, if authentication is valid then a new command prompt window will open in an elevated mode. Command works from Windows 7+  version.
That’s it, you just open an elevated command prompt window in a user standard account. Since most users are hungry with the admin password, just watch out with the shoulder sniffing tactic.

Other useful admin commands in a windows environment:
If ever you have a custom local admin account name and you can’t remember, type: net users
It will display all the local user accounts.
To check domain name and current login user account name, type:
Who…

Ping IPv4 or IPv6 in Windows 10

Windows 7 and newer releases of Windows supports ping results of either IPv4 or IPv6.

If the remote PC or server is configured for both IPv4 and IPv6, and if you need to ping via hostname and you want to get an IPv4 address type the command below:

ping -4 -n 2 Dhoney_Srv

Output will be IPv4 address of the hostname

ping -6 -n 2 Dhoney_Srv

Output will be IPv6 address of the hostname.

-n 2 send two ICMP packet requests.


Cheers! Till next time.


================================ Free Android Apps:
Click  links below to find out more:
Excel Keyboard guide:
https://play.google.com/store/apps/details?id=chrisjoms.myexcelapplicationguide
Linux Android App cheat sheet: https://play.google.com/store/apps/details?id=com.LinuxMobileKit
Heaven's Dew Fall  Prayer app for Android :
https://play.google.com/store/apps/details?id=soulrefresh.beautiful.prayer
Catholic Rosary Guide  for Android:
https://play.google.com/store/apps/details?id=com.myrosaryapp
http://quickbytesstuff.blogspot.sg/2014/09/how-to-recite-rosary.h…

Filter MsiInstaller installation in Event viewer

How to filter or check successful msi installation on a Windows system?
There are quite a lot of ways to filter event viewer, it will solely depend on the taste of the person doing the event viewer audit.
It can be done via PowerShell, XML query, or use command line tools and other methods which the Sys Admin feels comfortable doing.
But when it comes to auditing logs, it’s a tedious task and takes a lot of time and depends on the raw data that you have so you exactly know what you’re searching for.
Command line still a useful tool since it comes handy, you just open the command prompt window and type the command and get the output.
The hardest part is how you digest or do another filtering on the output since it might be convoluted with lots of data. But don’t depend on a single tool, make use of whatever you have on your system and other tools available on the net.
This command line below filters the MsiInstaller for event ID 1033.
wevtutil qe application /q:"*[System[Provider…

PowerShell search files/folder names with regex

Searching files with regex will come in handy provided you know the pattern you want to look for.
Searching for files that you don't have any clue or idea which one to find is such a dreadful situation.
Regex will help to filter files base on the pattern set from a fragmented memory due to multi-tasking world.
For example, you are quite sure that the file you're looking for starts with s and followed by letter k.
So files like skype_password.txt, skew animation.mp4, skbanner.logo, skin.css, skilled-listing.docx or any files that begins with "sk" will be filtered.
Here's the PowerShell code to do it:
#===================
$regx_filters = get-childitem "c:\all_files_n_rumble\" -recurse | where-object {$_.name -match '^s[k]' } Write-Output $regx_filters
#===================
To get folder or directory names with regex:
#===================
$regexPattern ="^l[i]" Get-ChildItem -Path "c:\all_folder_n_mixes\" -Recurse | Where-Object {$_.PS…

Wanna disable SMBv1 to stop WannaCry

Link from Technet why SMBv1 should be disabled:

STOP using SMBv1

Link below shows how to to check whether SMBV1 is enabled and how to disable SMBV1:

How to disable SMBv1? - How to check if SMBv1 is enabled?


PowerShell codes below is from the link above:

Windows 8 and Windows Server 2012

To check whether SMB1 and SMB2 are enabled:

Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

To disable SMBv1 on the SMB server, run the following cmdlet:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

=====================

Windows 7, Windows Server 2008 R2, Windows Vista, and Windows Server 2008

Requires Windows PowerShell 2.0 or a later version of PowerShell

To disable SMBv1 on the SMB server, run the following cmdlet:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force

Or if you're not comfortable using PowerShell just open registry editor and do it manually.

PowerShell is quite straight forw…

How to insert landscape orientation in Word?

If you are writing a thesis, a report or an article that you need to insert a landscape layout in a specific page in Word document but your orientation all long is portrait and changing the orientation causes the whole layout to change.
Inserting landscape in a specific page in a word document can be done by inserting section breaks. Let’s just make a basic example.
Let’s say you have 3 page document and you want that first page in Portrait mode, second page in landscape and third page in portrait layout also.
First, click on “home” tab, click the “show/hide paragraph marks” option or see the icon below. Enabling this option the section breaks, spaces and tabs will be visible. But what we are interested is to see the “section breaks”.


In the first page position the cursor on the last area at the bottom of the page.
In Word 2010, click on “page layout” in the ribbon tab. Click on “breaks” and select “next page”. In the second page, position also the cursor at the middle or bottom of t…