Windows

Lock RDP session

rundll32.exe user32.dll,LockWorkStation

wmic Cheat SheetEdit Cheat Sheet

Useful Examples

Getting to know the system

wmic bios get Manufacturer,Name,Version
wmic diskdrive get model,name,freespace,size         # physical disks
wmic logicaldisk get name                            # logical disks

wmic printer list status
wmci printerconfig list
wmic os list brief                         # Windows version incl. serial
wmic product list brief                    # installed programs  

wmic startup list full

For interactive mode just run

wmic

from there use “quit” or “exit” to terminate again.

Process Management

List running processes

wmic process list
wmic process list brief
wmic process list brief find "calc.exe"
wmic process list full

Start and Stop

wmic process call create "calc.exe"
wmic process where name="calc.exe" call terminate

And change priority

wmic process where name="calc.exe" call setpriority 64

Check environment variables

wmic environment list

User Management

wmic group list brief
wmic useraccount list
wmic sysaccount list

Updates

wmic qfe list           # List of missing patches

Remote Access

Run any command remote, e.g.

wmic /node:<ip> /user:<user> /password:<password> os list brief

Enable RDP

wmic /node:<ip> /user:<user> /password:<password> RDToggle where ServerName=<server name> call SetAllowTSConnections 1

Registry Cheat SheetEdit Cheat Sheet

reg Usage

reg query  [domain]\[key] /v [value]       # Query a single key value
reg query  [domain]\[key] /v [value] /s    # Query a single key value recursively
  
reg add    [domain]\[key]              # Add a key
reg export [domain]\[key] output.reg   # Export subtree to file
reg import output.reg                  # Import keys from file

Remote Access

To dump a remote registry write something like

reg export \\[ip]\ [domain]\[key] output.reg

Netsh Cheat SheetEdit Cheat Sheet

Usage Examples

Wifi Troubleshooting

netsh winsock reset
netsh int ip reset

Interface Configuration

Show/dump/import active config

netsh interface ip show config
netsh interface ip show config <interface>

netsh -c interface dump > config.txt     # dump config
netsh -f config.txt                      # import config

Static IP

netsh interface ip set address local static [ip] [netmask] [gw] 1

DHCP

netsh interface ip set address local dhcp
netsh interface ip set dns <NIC name> dhcp        # Ensure to get DNS servers via DHCP

DNS

Overwrite currrent DNS config with a single static DNS server

netsh interface ipv4 set dns <NIC name> static <dns server> primary

Add DNS servers

netsh interface ipv4 add dnsserver <NIC name> address=<dns server> index=<nr>

Routes

netsh interface ipv4 show route

netsh interface ipv4 add    route x.x.x.x/x <interface name> <gw>
netsh interface ipv4 delete route x.x.x.x/x <interface name> <gw>

Firewall

Note “netsh firewall” is deprecated since Vista. Use “netsh advfirewall firewall” instead!

CONFIG DUMPING

netsh advfirewall firewall export c:\temp\wfas.wfw
netsh advfirewall firewall import c:\temp\wfas.wfw

netsh advfirewall firewall reset [export  c:\temp\wfas.wfw]

TOGGLING STATES

netsh advfirewall firewall set [profiletype]state on
netsh advfirewall firewall set [profiletype]state off

CHANGING RULES

netsh advfirewall firewall add rule name="newrule" dir=in action=allow program="%ProgramFiles%\some\program.exe"

netsh advfirewall firewall show rule "newrule" verbose

netsh advfirewall firewall set rule group=”Windows Firewall Remote Management” new enable =yes

WSL Cheat SheetEdit Cheat Sheet

For a thorough description see this heise.de article

Setup

Install WSL from CLI

dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart

Enable virtualisation support for WSLv2

dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Enforce WSLv2 as default

wsl --set-default-version 2

Manage Distros

wsl -l [-v]                    # List installed distros
wsl --set-default <name>       # Set default distro
wsl --set-version <name> 1     # Force distro to run in WSLv1

wsl --unregister <name>        # Uninstall distro

GUI Setup

Probably easiest is to install GWSL from the MS app store.

LDAPSEARCH