How To Cheat At Windows System Administration Using Command Line Scripts

481 Pages·2006·4.58 MB·English

405_Script_FM.qxd 9/5/06 11:37 AM Page i
How to Cheat at
Windows System
Administration
Using Command Line Scripts
Pawan K. Bhardwaj
405_Script_FM.qxd 9/5/06 11:37 AM Page ii
Syngress Publishing,Inc.,the author(s),and any person or firm involved in the writing,editing,or produc-
tion (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be
obtained from the Work.
There is no guarantee of any kind,expressed or implied,regarding the Work or its contents.The Work is
sold AS IS and WITHOUT WARRANTY.You may have other legal rights,which vary from state to
state.
In no event will Makers be liable to you for damages,including any loss of profits,lost savings,or other
incidental or consequential damages arising out from the Work or its contents.Because some states do not
allow the exclusion or limitation of liability for consequential or incidental damages,the above limitation
may not apply to you.
You should always use reasonable care,including backup and other appropriate precautions,when working
with computers,networks,data,and files.
Syngress Media®,Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author
UPDATE®,”and “Hack Proofing®,”are registered trademarks of Syngress Publishing,Inc.“Syngress:The
Definition of a Serious Security Library”™,“Mission Critical™,”and “The Only Way to Stop a Hacker is
to Think Like One™”are trademarks of Syngress Publishing,Inc.Brands and product names mentioned
in this book are trademarks or service marks of their respective companies.
KEY SERIAL NUMBER
001 HJIRTCV764
002 PO9873D5FG
003 829KM8NJH2
004 94287PLK49
005 CVPLQ6WQ23
006 VBP965T5T5
007 HJJJ863WD3E
008 2987GVTWMK
009 629MP5SDJT
010 IMWQ295T6T
PUBLISHED BY
Syngress Publishing,Inc.
800 Hingham Street
Rockland,MA 02370
How to Cheat at Windows System Administration Using Command Line Scripts
Copyright © 2006 by Syngress Publishing,Inc.All rights reserved.Except as permitted under the
Copyright Act of 1976,no part of this publication may be reproduced or distributed in any form or by
any means,or stored in a database or retrieval system,without the prior written permission of the pub-
lisher,with the exception that the program listings may be entered,stored,and executed in a computer
system,but they may not be reproduced for publication.
1 2 3 4 5 6 7 8 9 0
ISBN:1-59749-105-5
Publisher:Andrew Williams Page Layout and Art:Patricia Lupien
Acquisitions Editor:Gary Byrne Copy Editor:Audrey Doyle
Technical Editor:Kimon Andreou Indexer:Odessa&Cie
Cover Designer:Michael Kavish
Distributed by O’Reilly Media,Inc.in the United States and Canada.
For information on rights,translations,and bulk sales,contact Matt Pedersen,Director of Sales and Rights,
at Syngress Publishing;email [email protected] fax to 781-681-3585.
405_Script_FM.qxd 9/5/06 11:37 AM Page iii
Lead Author
Pawan K. Bhardwaj (MCSE,MCT,Security+,Network+,I-Net+
and A+) is an independent technical trainer and author.He has been
actively involved in Windows administration ever since Windows
NT 3.51 was released.In the past 16 years he has worked at various
system and network support levels for small and medium-sized
companies.Some of his major projects included working for one of
India’s largest newspaper groups and a large e-commerce organiza-
tion in the United States where he had an active involvement in
design and implementation of large-scale LAN and WAN solutions
based on Windows technologies.
Pawan was one of the first 100 in India to attain MCSE certifi-
cation back in 1997.He teaches Windows administration and net-
working classes and also acts as a consultant to training institutions.
He has authored or contributed to more than 12 certification books
by Syngress/McGraw Hill.He also coauthored MCSE 2003 Electives
Exams in a Nutshell (O’Reilly Media,Inc.,2006).
This book is dedicated to the loving memory of my father,Sudershan
Bhardwaj,and my father-in-law,Ghanshyam Pandit,both of whom passed
away during the writing of this book.
—Pawan K.Bhardwaj
Technical Editor and Reviewer
Kimon Andreou is IT Portfolio Manager at Royal Caribbean
International in Miami,FL.His expertise is in software develop-
ment,software quality assurance,data warehousing,and data security.
Kimon’s experience includes positions as CTO for Secure Discovery
Solutions,an e-Discovery company;Manager of Support & QA at
S-doc,a software security company;and as Chief Solution Architect
iii
405_Script_FM.qxd 9/5/06 11:37 AM Page iv
for SPSS in the Enabling Technology Division.He also has led pro-
jects in Asia,Europe,North America,and South America.Kimon
holds a Bachelor of Science in Business Administration from the
American College of Greece and a Master of Science in
Management Information Systems from Florida International
University.
Kimon wrote Chapter 12.
Contributing Authors
Brian Barber (MCSE,MCP+I,MCNE,CNE-5,CNE-4,CNA-3,
CNA-GW) is coauthor of Syngress Publishing’s Configuring Exchange
2000 Server (ISBN:1-928994-25-3),Configuring and Troubleshooting
Windows XP Professional (ISBN:1-928994-80-6),and two study
guides for the MSCE on Windows Server 2003 track (exams 70-296
[ISBN:1-932266-57-7] and 70-297 [ISBN:1-932266-54-2]).He is a
Senior Technology Consultant with Sierra Systems Consultants Inc.in
Ottawa,Canada.He specializes in IT service management and tech-
nical and infrastructure architecture,focusing on systems management,
multiplatform integration,directory services,and messaging.In the
past he has held the positions of Senior Technical Analyst at MetLife
Canada and Senior Technical Coordinator at the LGS Group Inc.
(now a part of IBM Global Services).
Brian wrote Chapter 11.
Dave Kleiman (CAS,CCE,CIFI,CISM,CISSP,ISSAP,ISSMP,
MCSE) has worked in the Information Technology Security sector
since 1990.Currently,he is the owner of SecurityBreach
Response.com.A former Florida Certified Law Enforcement
Officer,he specializes in litigation support,computer forensic inves-
iivv
405_Script_FM.qxd 9/5/06 11:37 AM Page v
tigations,incident response,and intrusion analysis.He has developed
a Windows Operating System lockdown tool,S-Lok (www.s-
doc.com/products/slok.asp),which surpasses NSA,NIST,and
Microsoft Common Criteria Guidelines.
Dave was a contributing author for Microsoft Log Parser Toolkit
(Syngress Publishing,ISBN:1-932266-52-6) and Security Log
Management:Identifying Patterns in the Chaos (Syngress Publishing,
ISBN:1-59749-042-3).He was also technical editor for Perfect
Passwords:Selection,Protection,Authentication (Syngress Publishing,
ISBN:1-59749-041-5) and Winternals Defragmentation,Recovery,and
Administration Field Guide (Syngress Publishing,ISBN:1597490792).
He is frequently a speaker at many national security conferences and
is a regular contributor to security-related newsletters,Web sites,and
Internet forums.Dave is a member of many professional security
organizations,including the International Association of Counter
Terrorism and Security Professionals (IACSP),International Society
of Forensic Computer Examiners® (ISFCE),Information Systems
Audit and Control Association® (ISACA),High Technology Crime
Investigation Association (HTCIA),Association of Certified Fraud
Examiners (ACFE),Anti Terrorism Accreditation Board (ATAB),and
ASIS International®.He is also the Sector Chief for Information
Technology at the FBI’s InfraGard® and Director of Education at
the International Information Systems Forensics Association (IISFA).
Dave cowrote Chapter 13.
Mahesh Satyanarayana is a final-semester electronics and commu-
nications engineering student at the Visveswaraiah Technological
University in Shimoga,India.He expects to graduate this summer
and has currently accepted an offer to work for Caritor Inc.,an
SEI-CMM Level 5 global consulting and systems integration com-
pany,headquartered in San Ramon,CA.Caritor provides IT infras-
tructure and business solutions to clients in several sectors
v
405_Script_FM.qxd 9/5/06 11:37 AM Page vi
worldwide.Mahesh will be joining the Architecture and Design
domain at Caritor’s development center in Bangalore,India,where
he will develop software systems for mobile devices.His areas of
expertise include Windows security and related Microsoft program-
ming technologies.He is also currently working toward adminis-
trator-level certification on the Red Hat Linux platform.
Mahesh wrote Appendix A.
Companion Web Site
Some examples of syntax or code for the command utilities
discussed in this book are available for download from www.
syngress.com/solutions.Look for the Syngress icon in the
margins indicating which examples are available from the
companion Web site.
vi
405_Script_TOC.qxd 9/5/06 1:48 PM Page vii
Contents
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
Part I Getting Started with Command Line. . . . . . . . . . . . . . . . . . . . . . . . 1
Chapter 1 Basics of the Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
Basics of the Windows Command Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4
The MS-DOS Command Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Starting the Windows Command Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5
Customizing the Command Shell Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . .6
Customizing the Command Shell Window . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Internal Commands for the Command Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
Getting Help for Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Command History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17
Displaying Previous Commands with Arrow Keys . . . . . . . . . . . . . . . . . . . . .18
Viewing the Command History in a Pop-Up Window . . . . . . . . . . . . . . . . .18
Using Function Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
Accessing the Windows Command Reference . . . . . . . . . . . . . . . . . . . . . . . . . . .19
Installing Windows Support Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23
Chapter 2 Using Batch Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Working Safely with the Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
Configuring the Command Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .28
Using the Path Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
Using the Set and Setx Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30
Changing Environment Variables in System Properties . . . . . . . . . . . . . . . . . .31
Using Command Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Command Redirection Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
Input Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Output Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
Redirecting Output to Other Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Error Handling with Redirection Operators . . . . . . . . . . . . . . . . . . . . . . . . .36
Using Groups of Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
Using & for Sequential Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37
Using && and || for Conditional Processing . . . . . . . . . . . . . . . . . . . . . . . .37
Grouping Sets of Commands with Parentheses . . . . . . . . . . . . . . . . . . . . . . .38
Creating Batch Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .38
Batch File Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
Batch File Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
vii
405_Script_TOC.qxd 9/5/06 1:48 PM Page viii
viii Contents
Chapter 3 Managing Scheduled Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
Scheduling Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
The Task Scheduler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58
The Task Scheduler Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
Accessing the Task Scheduler Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60
Configuring the Properties of the Task Scheduler Service . . . . . . . . . . . . . . . .62
Managing Tasks Using the Task Scheduler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
Managing the Properties of Scheduled Tasks . . . . . . . . . . . . . . . . . . . . . . . . .65
Monitoring Tasks in the Scheduled Tasks Window . . . . . . . . . . . . . . . . . . . . .68
Creating New Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
Deleting a Scheduled Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Running a Scheduled Task Immediately . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
Enabling or Disabling a Scheduled Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
Ending a Running Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
Event-Based Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
The schtasks Command-Line Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
Creating and Running Tasks Using schtasks /Create . . . . . . . . . . . . . . . . . . .76
Managing Tasks with schtasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86
Using schtasks /Query to Query a Scheduled Task . . . . . . . . . . . . . . . . . . . .86
Modifying a Scheduled Task with schtasks /Change . . . . . . . . . . . . . . . . . . . .89
Running a Scheduled Task with schtasks /Run . . . . . . . . . . . . . . . . . . . . . . .91
Ending Running Tasks with schtasks /End . . . . . . . . . . . . . . . . . . . . . . . . . . .92
Deleting Scheduled Tasks with schtasks /Delete . . . . . . . . . . . . . . . . . . . . . . .93
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94
Part II Basic Windows Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Chapter 4 Managing Files and Directories . . . . . . . . . . . . . . . . . . . . . . . 97
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
Using Wildcards in Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98
File and Folder Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99
Viewing Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100
Changing Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101
Basic File and Folder Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101
Copying Files with the Copy Command . . . . . . . . . . . . . . . . . . . . . . . . . . .102
Copying Files and Directories with the Xcopy Command . . . . . . . . . . . . . .106
Renaming Files with the Rename (Ren) Command . . . . . . . . . . . . . . . . . .113
Moving Files Using the Move Command . . . . . . . . . . . . . . . . . . . . . . . . . .113
Deleting Files with the Del (Erase) Command . . . . . . . . . . . . . . . . . . . . . . .115
Comparing Files with the Comp Command . . . . . . . . . . . . . . . . . . . . . . . .116
Comparing Files with the FC Command . . . . . . . . . . . . . . . . . . . . . . . . . .118
Sorting Files with the Sort Command . . . . . . . . . . . . . . . . . . . . . . . . . . . . .121
Recovering Files with the Recover Command . . . . . . . . . . . . . . . . . . . . . .123
Decompressing Files with the Expand Command . . . . . . . . . . . . . . . . . . . .123
Duplicating and Comparing Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .125
Duplicating Disks with the Diskcopy Command . . . . . . . . . . . . . . . . . . . . .125
Comparing Two Disks with the Diskcomp Command . . . . . . . . . . . . . . . .127
Directory-Specific Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129
Displaying the Directory Structure (Tree) . . . . . . . . . . . . . . . . . . . . . . . . . .129
405_Script_TOC.qxd 9/5/06 1:48 PM Page ix
Contents ix
Creating a New Directory with MD or Mkdir . . . . . . . . . . . . . . . . . . . . . .130
Removing a Directory with RD or Rmdir . . . . . . . . . . . . . . . . . . . . . . . .131
Removing a Directory Tree with the Deltree Command . . . . . . . . . . . . . . .133
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .134
Chapter 5 Maintaining Hard Disks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Physical and Logical Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Physical Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Logical Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Understanding Basic and Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136
Basic Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .137
Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138
Tasks Common to Basic and Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . .140
Supported File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140
Formatting a Disk or Partition with the Format Command . . . . . . . . . . . . .141
Converting File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145
Converting a File System with the Convert Command . . . . . . . . . . . . . . . .147
Examining Volume Serial Numbers with the Vol Command . . . . . . . . . . . .148
Managing Volume Labels with the Label Command . . . . . . . . . . . . . . . . . . .149
Maintaining Disks and File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150
Using the Fsutil Utility for Advanced Disk Management . . . . . . . . . . . . . . .151
Checking Available Disk Space with the Freedisk Command . . . . . . . . . . . .156
Saving Disk Space with the Compact Command . . . . . . . . . . . . . . . . . . . . .157
Managing Mounted Volumes with the Mountvol Command . . . . . . . . . . . .160
Checking and Fixing Bad Sectors with the Chkdsk Command . . . . . . . . . . .161
Defragmenting Disks with the Defrag Command . . . . . . . . . . . . . . . . . . . . .165
Checking Autocheck Status with the Chkntfs Command . . . . . . . . . . . . . . .168
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .170
Chapter 6 Managing Hard Disks with the Diskpart Utility . . . . . . . . . . 171
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
The Diskpart Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
The Object in Focus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .172
Diskpart Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .174
Scripting with Diskpart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .191
Diskpart Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .192
Obtaining Volume Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194
Understanding Volume Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195
Managing Dynamic Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
Simple Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197
Striped Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Managing Fault-Tolerant Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198
Mirrored Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199
RAID 5 Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201
Part III Managing Windows Systems and Printers. . . . . . . . . . . . . . . . . 203
Chapter 7 System Services, Drivers, and the Registry . . . . . . . . . . . . . 205
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .206