How to list open ports and application using them in Windows

 

1. netstat -abn

or

2. netstat -a -n -p tcp -o

Gerenciar usuários por linha de comando no Windows

 Para criar usuários locais com net user, digite:
1 net user nome_usuario senha /add

Substitua nome_usuario e senha pelos dados desejados. Você também pode ir além e
digitar o nome completo e a descrição do usuário com:
1 net user nome_usuario senha /add /fullname:"Nome Completo" /comment:"Descrição do usuário"

Caso queira alterar a senha de um usuário local, simplesmente digite:
1 net user nome_usuario nova_senha

Ou se quiser editar o nome completo ou a descrição, digite:
1 net user nome_usuario /fullname:"Novo nome Completo" /comment:"Nova descrição do usuário"

Utilizando este método, você vai criar usuários “Padrão”, ou seja, sem privilégios
administrativos. Para dar privilégios de administrador para determinado usuário,
simplesmente digite:
1 net localgroup administradores nome_usuario /add
 

Caso tenha pensado melhor e acha que o usuário não merece ser um administrador,
digite:
1 net localgroup administradores nome_usuario /delete

 

 

Rename windows computer command

Command Prompt:

netdom renamecomputer Thecomputernamehere /newname:newnamehere /force /userd:domain\username /passwordd:***** /reboot

 

Powershell:

Example 1: Rename the local computer

This command renames the local computer to Server044 and then restarts it to make the change effective.
PowerShell

Rename-Computer -NewName "Server044" -DomainCredential Domain01\Admin01 -Restart

Example 2: Rename a remote computer

This command renames the Srv01 computer to Server001. The computer is not restarted.

The DomainCredential parameter specifies the credentials of a user who has permission to rename computers in the domain.

The Force parameter suppresses the confirmation prompt.
PowerShell

Rename-Computer -ComputerName "Srv01" -NewName "Server001" -DomainCredential Domain01\Admin01 -Force

 

Robocopy - copy only folder structure

 

To use Robocopy to clone a directory without files, use the following syntax:

robocopy "C:\Your Folder" "C:\New Folder" /e /xf *

same as above but without displaying the status:

robocopy "C:\Your Folder" "C:\New Folder" /e /xf * >nul

same as first example and creates a log (overwrites existing log):

robocopy "C:\Your Folder" "C:\New Folder" /e /xf * /log:yourlogfile.log

same as first example and appends to log (appends to existing log):

robocopy "C:\Your Folder" "C:\New Folder" /e /xf * /log+:yourlogfile.log

Copy only the top level sub-folders (sub-folders in the source directory)

robocopy "C:\Your Folder" "C:\New Folder" /e /LEV:2 /xf *

/e = Copies subdirectories, including empty ones.

/LEV: n = Copy only the n LEVels of the source. For n=2, only the top level sub-folders will be copied

/xf = Excludes files matching the specified names or paths. Wildcards “*” and “?” are accepted

List folders and files

 

List folders and files:

dir ..\myfolder /b /s /o:gn>list.txt

  

When you do not want to list the folders, only the files in the subfolders, use /A-D switch like this:

dir ..\myfolder /b /s /A-D /o:gn>list.txt

 

Get remote logged user

 wmic /node:(hostname ou IP) computersystem get username

 

C:\Users\douglastos>wmic /node:desk0191 computersystem get username

UserName

grupo\userteste

 

Robocopy fast copy with multithreading

 

robocopy "D:\SOURCE" "\\10.20.30.40\F$\DESTINY" /E /ZB /SEC /COPYALL /R:3 /W:3 /V /ETA /TEE /MT:16 /XD "D:\SOURCE\EXCLUDE"

/E — Copy Subdirectories, including empty ones.

/ZB — Uses restartable mode. If access is denied, use backup mode.

/R:3 — Retry 3 times (you can specify a different number, default is 1 million).

/W:3 — Wait 3 seconds before retrying (you can specify a different number, the default is 30 seconds).

/V — Produce verbose output, showing skipped files.

/COPYALL — copy all file information.

/SEC — copy security information.

/TEE — open console.

/MT:16 — Do multi-threaded copies with n threads (default is 8, max 128).

/XD -  exclude folder. 

 

Windows file system block size

 

- Click Start, type cmd.exe, right-click on the link to cmd.exe and select "Run as administrator" -- respond as needed to any UAC prompt
- Type the following command into the Command Prompt window and press Enter (where C: is the drive you are interested in examining)
 

fsutil fsinfo ntfsinfo c:

Example:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>fsutil fsinfo ntfsinfo g:
NTFS Volume Serial Number :       0x2c60f2b460f2843c
Version :                         3.1
Number Sectors :                  0x000000015d4ba7de
Total Clusters :                  0x000000002ba974fb
Free Clusters  :                  0x0000000002aad21f
Total Reserved :                  0x0000000000000000
Bytes Per Sector  :               512
Bytes Per Physical Sector :       4096
Bytes Per Cluster :               4096
Bytes Per FileRecord Segment    : 1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length :           0x00000000001c0000
Mft Start Lcn  :                  0x00000000000c0000
Mft2 Start Lcn :                  0x0000000000000002
Mft Zone Start :                  0x0000000005d93c20
Mft Zone End   :                  0x0000000005da0440
RM Identifier:        4A0E2B47-1266-11E7-B8A6-BC5FF43AE72F

Domain controller verbose mode

Put the domain controller in verbose logging for the netlogon service to actually find out where the logon attempt was coming from. First, open up command prompt as an administrator and execute the following command:
nltest /dbflag:0x2080ffff

Once done, execute the following command to turn off the debugging:
nltest /dbflag:0x0

This logs every transaction made to the file: %windir%\debug\netlogon.log (note, you need to run notepad as an administrator to read this file).


source: https://support.microsoft.com/en-us/help/109626/enabling-debug-logging-for-the-netlogon-service

Delete DfrsPrivate folder

md d:\empty

Robocopy.exe d:\empty "D:\System Volume Information\dfsr\Private" /purge

rd d:\empty

I found that at:
https://superuser.com/questions/78434/how-to-delete-directories-with-path-names-too-long-for-normal-delete

Enable/disable windows firewall

Win XP
(desativar FW) netsh firewall set opmode disable
(habilitar FW) netsh firewall set opmode enable

Win 7
(desativar FW) netsh advfirewall set allprofiles state off
(habilitar FW) netsh advfirewall set allprofiles state on

(parar serviço FW) net stop MpsSvc
(iniciar serviço FW) net start MpsSvc

* Para executar remoto, utilize PSEXEC.EXE ou envie um .BAT com os comandos para o usuário.

Create event in windows log

EVENTCREATE /T WARNING /ID 199 /L APPLICATION /D “Event test”

* Event ID between 1 and 1000