{"id":331,"date":"2006-11-28T05:14:21","date_gmt":"2006-11-28T13:14:21","guid":{"rendered":"http:\/\/testblog.sapien.com\/index.php\/2006\/11\/28\/command-line-one-liners\/"},"modified":"2006-11-28T05:14:21","modified_gmt":"2006-11-28T13:14:21","slug":"command-line-one-liners","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2006\/11\/28\/command-line-one-liners\/","title":{"rendered":"Command Line One-Liners"},"content":{"rendered":"

I recently did a TipSheet column<\/a>listing some of my favorite quick, one line commands. Reader Wayne waskind enough to share with me his list of oft-used one-liners which hegraciously offered to share. I have not tested many of thesepersonally, but you always test things in a non-production environmentanyway, right? The command entry should all be on one line. I’vewrapped lines just to get everything displayed in the post.
FSMO Roles <\/span>
ntdsutilroles Connections “Connect to server %logonserver%” Quit “selectOperation Target” “List roles for conn server” Quit Quit Quit
[JDH: This is really a series of steps, not a single command
expression]
Domain Controllers <\/span>
Nltest \/dclist:%userdnsdomain%
Domain Controller IP Configuration <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do psexec \\\\%i ipconfig \/all
Stale computer accounts <\/span>
dsquery computer domainroot -stalepwd 180 -limit 0
Stale user accounts <\/span>
dsquery user domainroot -stalepwd 180 -limit 0
Disabled user accounts <\/span>
dsquery user domainroot -disabled -limit 0
AD Database disk usage <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do dir \\\\%i\\admin$\\ntds
Global Catalog Servers from DNS <\/span>
dnscmd %logonserver% \/enumrecords %userdnsdomain% _tcp | find \/i “3268”
Global Catalog Servers from AD <\/span>
dsquery * “CN=Configuration,DC=forestRootDomain” -filter “(&(objectCategory=nTDSDSA)(options:1.2.840.113556.1.4.803:=1))”<\/span>
Users with no logon script <\/span>
dsquery * domainroot -filter”(&(objectCategory=Person)(objectClass=User)(!scriptPath=*))”-limit 0 -attr sAMAccountName sn givenName pwdLastSet distinguishedName
User accounts with no pwd required <\/span>
dsquery * domainroot -filter “(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=32))”
User accounts with no pwd expiry <\/span>
dsquery * domainroot -filter”(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=65536))”
User accounts that are disabled <\/span>
dsquery * domainroot -filter “(&(objectCategory=Person)(objectClass=User)(userAccountControl:1.2.840.113556.1.4.803:=2))”
DNS Information <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do dnscmd %i \/info
DNS Zone Detailed information <\/span>
dnscmd \/zoneinfo %userdnsdomain%
Garbage Collection and tombstone <\/span>
dsquery * “cn=Directory Service,cn=WindowsNT,cn=Services,cn=Configuration,DC=forestRootDomain” -attrgarbageCollPeriod tombstoneLifetime
Netsh authorised DHCP Servers <\/span>
netsh dhcp show server
DSQuery authorised DHCP Servers <\/span>
Dsquery * “cn=NetServices,cn=Services,cn=Configuration, DC=forestRootDomain” -attr dhcpServers
DHCP server information <\/span>
netsh dhcp server \\\\DHCP_SERVER show all
DHCP server dump <\/span>
netsh dhcp server \\\\DHCP_SERVER dump
WINS serer information <\/span>
Netsh wins server \\\\WINS_SERVER dump
Group Policy Verification Tool <\/span>
gpotool.exe \/checkacl \/verbose
AD OU membership <\/span>
dsquery computer -limit 0
AD OU membership <\/span>
dsquery user -limit 0
List Service Principal Names <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do setspn -L %i
Compare DC Replica Object Count <\/span>
dsastat ?s:DC1;DC2;… ?b:Domain ?gcattrs:objectclass ?p:999
Check AD ACLs <\/span>
acldiag dc=domainTree
NTFRS Replica Sets <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl sets %i
NTFRS DS View <\/span>
for \/f %i in (‘dsquery server -domain %userdnsdomain% -o rdn’) do ntfrsutl ds %i
Domain Controllers per site <\/span>
Dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -filter (objectCategory=Server)
DNS Zones in AD <\/span>
for \/f %i in (‘dsquery server -o rdn’) do Dsquery * -s %i domainroot -filter (objectCategory=dnsZone)
Enumerate DNS Server Zones <\/span>
for \/f %i in (‘dsquery server -o rdn’) do dnscmd %i \/enumzones
Subnet information <\/span>
Dsquery subnet ?limit 0
List Organisational Units <\/span>
Dsquery OU
ACL on all OUs <\/span>
For \/f “delims=|” %i in (‘dsquery OU’) do acldiag %i
Domain Trusts <\/span>
nltest \/domain_trusts \/v
Print DNS Zones <\/span>
dnscmd DNSServer \/zoneprint DNSZone
Active DHCP leases <\/span>
For \/f %i in (DHCPServers.txt) do for \/f “delims=- ” %j in (‘”netshdhcp server \\\\%i show scope | find \/i “active””‘) do netsh dhcp server\\\\%i scope %j show clientsv5
DHCP Server Active Scope Info <\/span>
For \/f %i in (DHCPServers.txt) do netsh dhcp server \\\\%i show scope | find \/i “active”
Resolve DHCP clients hostnames <\/span>
for \/f “tokens=1,2,3 delims=,” %i in (Output from ‘Find Subnets fromDHCP clients’) do @for \/f “tokens=2 delims=: ” %m in (‘”nslookup %j |find \/i “Name:””‘) do echo %m,%j,%k,%i
Find two online PCs per subnet <\/span>
Echo. > TwoClientsPerSubnet.txt & for \/f “tokens=1,2,3,4delims=, ” %i in (‘”find \/i “pc” ‘Output from Resolve DHCP clientshostnames'”‘) do for \/f “tokens=3 skip=1 delims=: ” %m in (‘”Find \/i \/c”%l” TwoClientsPerSubnet.txt”‘) do If %m LEQ 1 for \/f %p in (‘”ping -n1 %i | find \/i \/c “(0% loss””‘) do If %p==1 Echo %i,%j,%k,%l
AD Subnet and Site Information <\/span>
dsquery * “CN=Subnets,CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn siteObject description location
AD Site Information <\/span>
dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn description location -filter (objectClass=site)
Printer Queue Objects in AD <\/span>
dsquery * domainroot -filter “(objectCategory=printQueue)” -limit 0
Group Membership with user details <\/span>
dsget group “groupDN” -members | dsget user -samid -fn -mi -ln -display -empid -desc -office -tel -email -title -dept -mgr
Total DHCP Scopes <\/span>
find \/i “subnet” “Output from DHCP server information” | find \/i “subnet”
Site Links and Cost <\/span>
dsquery * “CN=Sites,CN=Configuration,DC=forestRootDomain” -attr cn costdescription replInterval siteList -filter (objectClass=siteLink)
Time gpresult <\/span>
timethis gpresult \/v
Check time against Domain <\/span>
w32tm \/monitor \/computers:ForestRootPDC
Domain Controller Diagnostics <\/span>
dcdiag \/s:%logonserver% \/v \/e \/c
Domain Replication Bridgeheads <\/span>
repadmin \/bridgeheads
Replication Failures from KCC <\/span>
repadmin \/failcache
Inter-site Topology servers per site <\/span>
Repadmin \/istg * \/verbose
Replication latency<\/span>
repadmin \/latency \/verbose
Queued replication requests <\/span>
repadmin \/queue *
Show connections for a DC <\/span>
repadmin \/showconn *
Replication summary <\/span>
Repadmin \/replsummary
Show replication partners <\/span>
repadmin \/showrepl * \/all
All DCs in the forest <\/span>
repadmin \/viewlist *
ISTG from AD attributes <\/span>
dsquery * “CN=NTDS Site Settings,CN=siteName,CN=Sites,CN=Configuration,DC=forestRootDomain” -attr interSiteTopologyGenerator
Return the object if KCC Intra\/Inter site is disabled for each site <\/span>
Dsquery site | dsquery * -attr * -filter “(|(Options:1.2.840.113556.1.4.803:=1)(Options:1.2.840.113556.1.4.803:=16))”
Find all connection objects <\/span>
dsquery * forestRoot -filter (objectCategory=nTDSConnection) ?attr distinguishedName fromServer whenCreated displayName
Find all connection schedules <\/span>
adfind -b “cn=Configuration,dc=qraps,dc=com,dc=au” -f “objectcategory=ntdsConnection” cn Schedule -csv
Software Information for each serve<\/span>r
for \/f %i in (Output from ‘Domain Controllers’) do psinfo \\\\%i &filever \\\\%i\\admin$\\explorer.exe \\\\%i\\admin$\\system32\\vbscript.dll\\\\%i\\admin$\\system32\\kernel32.dll \\\\%i\\admin$\\system32\\wbem\\winmgmt.exe\\\\%i\\admin$\\system32\\oleaut32.dll
Check Terminal Services Delete Temp on Exit flag
For \/f %i in (Output from ‘Domain Controllers’) do Reg query”\\\\%i\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\TerminalServer” \/v DeleteTempDirsOnExit
For each XP workstation, query the current site and what Group Policy info <\/span>
@dsquery * domainroot -filter”(&(objectCategory=Computer)(operatingSystem=Windows XPProfessional))” -limit 0 -attr cn > Workstations.txt & @For \/f%i in (Workstations.txt) do @ping %i -n 1 >NUL & @if ErrorLevel0 If NOT ErrorLevel 1 @Echo %i & for \/f “tokens=3” %k in (‘”regquery “\\\\%i\\hklm\\software\\microsoft\\windows\\currentversion\\grouppolicy\\history” \/v DCName | Find \/i “DCName””‘) do @for \/f %m in(‘”nltest \/server:%i \/dsgetsite | find \/i \/v “completedsuccessfully””‘) do @echo %i,%k,%m
Information on existing GPOs <\/span>
dsquery * “CN=Policies,CN=System,domainRoot” -filter”(objectCategory=groupPolicyContainer)” -attr displayName cnwhenCreated gPCFileSysPath
Copy all Group Policy .pol files <\/span>
for \/f “tokens=1-8 delims=\\” %i in (‘dir \/b \/s\\\\%userdnsdomain%\\sysvol\\%userdnsdomain%\\policies\\*.pol’) do @echo copy\\\\%i\\%j\\%k\\%l\\%m\\%n\\%o %m_%n.pol
Domain Controller Netlogon entries <\/span>
for \/f %i in (‘dsquery server \/o rdn’) do echo %i & reg query\\\\%i\\hklm\\system\\currentcontrolset\\services\\netlogon\\parameters
WINS Statistics <\/span>
for \/f “tokens=1,2 delims=,” %i in (WINSServers.txt) do netsh wins server \\\\%i show statistics
WINS Record counts per server <\/span>
for \/f “tokens=1,2 delims=,” %i in (WINSServers.txt) do netsh wins server \\\\%i show reccount %i<\/span>
WINS Server Information <\/span>
for \/f “tokens=2 delims=,” %i in (WINSServers.txt) do netsh wins server \\\\%i show info
WINS Server Dump <\/span>
for \/f “tokens=2 delims=,” %i in (WINSServers.txt) do netsh wins server \\\\%i dump
WINS Static Records per Server <\/span>
netsh wins server \\\\LocalWINSServer show database servers={} rectype=1
Find policy display name given the GUID <\/span>
dsquery * “CN=Policies,CN=System,DC=domainRoot” -filter (objectCategory=groupPolicyContainer) -attr Name displayName
Find empty groups <\/span>
dsquery * -filter “&(objectCategory=group)(!member=*)” -limit 0-attr whenCreated whenChanged groupType sAMAccountNamedistinguishedName memberOf
Find remote NIC bandwidth <\/span>
wmic \/node:%server% path Win32_PerfRawData_Tcpip_NetworkInterface GET Name,CurrentBandwidth
Find remote free physical memory <\/span>
wmic \/node:%Computer% path Win32_OperatingSystem GET FreePhysicalMemory
Find remote system information <\/span>
SystemInfo \/s %Computer%
Disk statistics, including the number of files on the filesystem <\/span>
chkdsk \/i \/c
Query IIS web sites <\/span>
iisweb \/s %Server% \/query “Default Web Site”
Check port state and connectivity <\/span>
portqry -n %server% -e %endpoint% -v
Forest\/Domain Functional Levels <\/span>
ldifde -d cn=partitions,cn=configuration,dc=%domain% -r”(|(systemFlags=3)(systemFlags=-2147483648))” -lmsds-behavior-version,dnsroot,ntmixeddomain,NetBIOSName -p subtree -fcon
Forest\/Domain Functional Levels <\/span>
dsquery * cn=partitions,cn=configuration,dc=%domain% -filter”(|(systemFlags=3)(systemFlags=-2147483648))” -attrmsDS-Behavior-Version Name dnsroot ntmixeddomain NetBIOSName
Find the parent of a process <\/span>
wmic path Win32_Process WHERE Name=’notepad.exe’ GET Name,ParentProcessId
Lookup SRV records from DNS <\/span>
nslookup -type=srv _ldap._tcp.dc._msdcs.{domainRoot}
Find when the AD was installed <\/span>
dsquery * cn=configuration,DC=forestRootDomain -attr whencreated -scope base
Enumerate the trusts from the specified domain <\/span>
dsquery * “CN=System,DC=domainRoot” -filter “(objectClass=trustedDomain)” -attr trustPartner flatName
Find a DC for each trusted domain <\/span>
for \/f “skip=1” %i in (‘”dsquery * CN=System,DC=domainRoot -filter(objectClass=trustedDomain) -attr trustPartner”‘) do nltest \/dsgetdc:%i
Check the notification packages installed on all DCs <\/span>
for \/f %i in (‘dsquery server \/o rdn’) do @for \/f “tokens=4″ %m in(‘”reg query\\\\%i\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa \/v”Notification Packages” | find \/i “Notification””‘) do @echo %i,%m
List ACLs in SDDL format <\/span>
setacl -on %filepath% -ot file -actn list -lst f:sddl
Find out if a user account is currently enabled or disabled <\/span>
dsquery user DC=%userdnsdomain:.=,DC=% -name %username% | dsget user -disabled -dn
Find servers in the domain <\/span>
dsquery * domainroot -filter “(&(objectCategory=Computer)(objectClass=Computer)(operatingSystem=*Server*))” -limit 0
Open DS query window <\/span>
rundll32 dsquery,OpenQueryWindow<\/p>\n","protected":false},"excerpt":{"rendered":"

I recently did a TipSheet column listing some of my favorite quick, one line commands. Reader Wayne was kind enough to share with me his list of oft-used one-liners which he graciously offered to share.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[18,2],"tags":[],"class_list":["post-331","post","type-post","status-publish","format-standard","hentry","category-batchcmd","category-general"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=331"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/331\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}