windows-administration.md 2.1 KB


title: Windows Administration categories: [cheatsheets]

tags: [windows]

Windows Administration Stuff

System information

cmd> systeminfo
cmd> hostname
cmd> echo %username%

Listing users on a System

cmd> net user
cmd> net user "<Username>"
cmd> net user /domain

With more information (using wmic):

cmd> wmic useraccount get /All

Adding/Deleting a new User

cmd> net user <username> <password> /ADD [/domain]
cmd> net user <username> /DELETE [/domain]

Adding a user to a group

cmd> net localgroup <groupname> <username> /ADD

Listing Members of a Group

cmd> net localgroup
cmd> net localgroup administrators
cmd> net group /domain

Listing open ports

cmd> netstat -a
cmd> netstat -ano

More networking information

cmd> arp -a
cmd> ipconfig /all
cmd> route print

Firewall configuration

cmd> netsh firewall show config
cmd> netsh firewall show state

Group policies

cmd> grpresult /SCOPE USER /Z
cmd> grpresult /SCIPE COMPUTER /Z

Wlan Infors

cmd> netsh wlan show networks mode=bssid
cmd> netsh wlan show profiles
cmd> netsh wlan show profile <profile-name>
cmd> netsh wlan show drivers
cmd> netsh wlan show interfaces

Scheduled Tasks, Tasklist, Services

cmd> schtasks /query /fo LIST /v        ## list all scheduled tasks as a list
cmd> tasklsit /SVC                      ## get services linked to its executables
cmd> net start                          ## started services
cmd> DRIVERQUERY                        ## Get Driver, can be interesting for 3rd Party drivers
cmd> sc query                          ## get all services

Getting services that are not in C:\Windows

wmic service get name, displayname, pathname,startmode|findstr /i "auto"|findstr /i /v "C:\windows\"

-> Can be used to check for too liberal access rights (write access)

wmic service get name,displayname,pathname,startmode|findstr /i "auto" |findstr /i /v "c:\windows\" |findstr /i /v """

-> Additionaly search for paths not containing quotes -> Unquoted Service Paths