Windows 2000 Commands Pocket Reference

BUY THIS BOOK

Print Book $9.95

PDF $6.99

Safari Books Online

What is this?

Print Book £6.95

What is this?

Looking to Reprint or License this content?

Tell a friend

Windows 2000 Commands Pocket Reference

By Æleen Frisch
Book Price: $9.95 USD
£6.95 GBP
PDF Price: $6.99

Cover | Table of Contents

Chapter 1: Windows 2000 Commands Pocket Reference

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

This desktop reference documents Windows 2000 command mode. It is designed for system administrators, but will also prove beneficial to many other types of users. It includes most available Windows 2000 commands, as well as the most useful system administration command-line utilities from the Resource Kit (space permitting). Resource Kit commands are marked with an "RK" superscript in their header lines.

Space limitations have forced us to exclude the following classes of special-purpose commands from this reference:

Multiuser Terminal Services commands (since this facility is an add-on to the standard Windows 2000 products)
Clustering-related utilities
Most NetWare-related commands and options
SNMP-related commands
Multicast networking-related commands
Services for Macintosh commands
Java subsystem-related commands

A few additional commands are also excluded, either because they have been deemed redundant, obscure, obsolete, broken, unacceptably insecure, or because they perform inadvisable actions or procedures. Lingering unneeded DOS commands (e.g., subst, commands used in Config.SYS files, etc.) are likewise omitted.

Finally, whenever several utilities perform essentially identical tasks, only the best of them are included.

Commands are arranged in groups related to their purposes and functions; within a group, commands are arranged alphabetically. Consult the index to locate a desired command. Command options are grouped by function and ordered by importance. Occasionally, unimportant options are omitted.

Much of the information in this book not only corresponds to Windows 2000, but also applies to earlier versions of Windows NT. Some commands are available only with the Server or Advanced Server version of the operating system.

cmd: Bold denotes a Windows 2000 command or option.
arg: Italics denotes variable parameters (i.e., things you must fill in).
[...]: Brackets denote optional parts of commands.
a | b: A pipe indicates that either a or b should be selected.
cmd^RK: The "RK" superscript denotes a Resource Kit command.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Introduction

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

Space limitations have forced us to exclude the following classes of special-purpose commands from this reference:

Multiuser Terminal Services commands (since this facility is an add-on to the standard Windows 2000 products)
Clustering-related utilities
Most NetWare-related commands and options
SNMP-related commands
Multicast networking-related commands
Services for Macintosh commands
Java subsystem-related commands

Finally, whenever several utilities perform essentially identical tasks, only the best of them are included.

cmd: Bold denotes a Windows 2000 command or option.
arg: Italics denotes variable parameters (i.e., things you must fill in).
[...]: Brackets denote optional parts of commands.
a | b: A pipe indicates that either a or b should be selected.
cmd^RK: The "RK" superscript denotes a Resource Kit command.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Entering Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

Commands are not case-sensitive.
Command options are not usually case-sensitive. The few options that are lowercase only are specified as such in this book. Uppercase and mixed-case options can be assumed to be case-insensitive.
Command options are generally preceded by a forward slash—for example, /X. In many cases, a minus sign may be substituted for the slash if desired. A few commands (mostly originating in the Resource Kit) require that their options be preceded by a minus sign.
Option placement is not consistent across all commands. Consult the syntax summary for option placement for a specific command.
Distinct command arguments are separated by spaces, commas, or semicolons.
A command may be continued onto a second (or subsequent) line by placing a caret (^) as the final character of the initial line.
The caret is also used as the escape symbol, protecting the following character from being processed by the command interpreter.
Multiple commands may be concatenated by an ampersand: command1 & command2. The commands are executed in sequence.
Commands may be executed conditionally, based on the success or failure of a preceding command, by joining them with && or || (respectively):

command1 && command2

Execute command2 only if command1 succeeds.

command1 || command2

Execute command2 only if command1 fails.

< file: Take standard input from a file.
> file
1> file: Send standard output to a file.
>> file
1>> file: Append standard output to a file.
2 > file: Send standard error to a file.
2 >> file: Append standard error to a file.
> file 2 >&1: Combine standard output and standard error and send both to the same destination (use >> before file to append).
command1 | command2
command1 0 > command2: Form a pipe, linking the standard output of command1 to the standard input of command2.

This section lists several key Windows 2000 environment variables. Note that environment variables are dereferenced by enclosing the name between percent signs—for example, %SystemRoot%. System and current user environment variables are modified via the path

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Installing Extra Administrative Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

The Windows 2000 distribution CD includes several additional groups of administrative commands that must be installed separately. They are in the following directory locations on the CD:

\Support\Tools\Setup: this installs tools into %SystemRoot%\Program Files\Support Tools
\Support\Tools\Deploy.Cab: this contains system installation automation tools; these must be installed manually to whatever location you desire
\I386\AdminPak.MSI: this installs tools into a standard system software tree (i.e., under %SystemRoot%)
\ValueAdd\3rdParty\Mgmt\Winstel\SwiAdmLE.MSI: this installs tools into %SystemRoot%\Program Files\VERITAS Software

The Resource Kit must be purchased separately (available from most booksellers and software sellers). Once installed, these tools are located in the directory %SystemRoot%\Program Files\Resource Kit. Note that a few tools must be installed manually; they are generally located in subdirectories of \Apps on the Resource Kit CD.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Help Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

help command: Obtain help for a standard Windows 2000 command.
command /?: Obtain help for the specified command.
net help command: Obtain help for one of the net commands.
net helpmsg nnnn: Explain Windows 2000 message number nnnn.
ntbooks: Open main Windows 2000 help file. Navigate to Troubleshooting and Additional Resources→Additional Resources→Windows 2000 Commands in the help file to find documentation of the various commands.
W2RKSupp.Chm: The help file for the additional support tools available on the Windows 2000 distribution CD.
Deploy.Chmand Unattend.Doc: The help files and documentation related to unattended and other automated Windows 2000 installations (these files are located wherever you installed the installation automation tools from the Windows 2000 distribution CD, discussed in the previous section).
W2RKTool.Chm^RK: The main help file for Resource Kit commands. Other useful help files in the Resource Kit include:

W2RKBook.Chm^RK: Resource Kit books.
RegEntry.Chm^RK: Descriptions of registry keys and values.
GP.Chm^RK: Descriptions of many Group Policy settings.
W2000Msgs.Chm^RK: Documentation of Windows 2000 error messages and event log entry types.
Counters.Chm^RK: Documentation of all Performance Monitor counters.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

General-Purpose Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

clipRK

command |clip clip < file

Place the command output file /specified file contents on the system clipboard.

cmd

cmd [options] [/C | /K [/S] command]

Start a new Windows 2000 command interpreter. If command is specified, that command is executed. Enclose multiple commands in quotation marks. See the cmd /? documentation for other features (e.g., command /path completion, delayed environment variable expansion, and so on).

Use the exit command to end a command interpreter session.

Options

/C | /K [/S]: Carry out the specified command, retaining (/C ) or terminating ( /K) the command interpreter afterward. With either /C or /K, /S says to process quotes in the command string before execution. (Usually they are preserved.)
/Q: Disable command echoing (see echo OFF, later in this book).
/E:ON | OFF: Enable/disable command interpreter extensions. Set the default by the value of the HKCU\ or HKLM\ Software\Microsoft\Command Processor\Enable Extensions registry key (enabled by default).
/A | /U: Format command output as ANSI (default) or Unicode, respectively.
/D: Disable registry autorun commands in the HKLM\ or HKCU\Software\Microsoft\Command Processor\Autorun registry key.

cscript

cscript [script] [options]

Run a script using the Windows Scripting Host facility. The script filename must include a recognized extension indicating the scripting language. See the ntbooks documentation for script execution-related options. Note that cscript options are preceded by two slashes ( // ) in order to distinguish them from the script's own options.

cscript //h:cscript

Make cscript the default script host, which allows scripts to be run by entering the script name as the command.

date

date [mm-dd-[yy]yy] [/T]

Set to the specified date (prompted if omitted). The /T option displays the date without modifying it.

doskey

doskey [options]

Recall previous commands or create macros (aliases).

Command History and Editing Options

/HISTORY: Display the entire command history list.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

General Administrative Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

assoc

assoc [.ext=filestypename]

Associate a file extension with a named file type. See also ftype.

ftypeRK

ftype [filetypename=command-string]

Display (no parameters) or define file type-specific command invocations. In the latter mode, the specified command is invoked whenever a file of the specified type is executed. See also assoc.

mode

Set the characteristics of a serial line. See the ntbooks documentation for details about the available settings as well as other forms of this command.

msinfo32

MSInfo32 /Report file [/Computer name]

Create a report of the system configuration for the local or specified system and place it in the specified text file. See W2RKSupp.Chm for options to limit the output and change its format. Note that similar functionality is provided by the graphical utility winrep.

This command is located in the %ProgramFiles%\Common Files\Microsoft Shared\MSInfo directory (this directory is not typically in the PATH).

net computer

net computer \\host /ADD | /DELETE

Add or remove the specified computer from the domain database.

net name

net name [name] [/DELETE]

Without parameters, display the current name set (message recipients targeted to this user account). If an argument is included, the command adds the specified name to the current name set.

The /DELETE option removes the specified name from the name set.

net send

net send who message

Send a message to one or more users. who may be one of the following:

A username

A message recipient defined with net name

A hostname (corresponds to any user logged into the specified computer)

An asterisk for all users in the local domain

/DOMAIN:name for all users in the specified domain

/USERS for all users with connections to the local server

net time

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Working with Files

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

attrib

attrib [options] [files]

Set DOS file attributes (or display the current attributes if no options are specified). The file list defaults to all files in the current directory.

Options

+x| -x: Add or remove an attribute, where x is one of the following code characters: R (read-only), H (hidden), S (system) or A (archive).
/S: Recurse subdirectories in the file list.
/D: Apply attributes to folders themselves.

cacls, xcaclsRK

cacls | xcacls files [options]

Display (if no options are specified) or modify access control lists (ACLs), using Windows NT 4 or Windows 2000 permission sets, respectively.

Options

Multiple options and instances of options are allowed.

/T: Propagate changes to subdirectories in the file list.
/E: Edit the existing ACL (the default is to replace it).
/G user : perms [;dir-perms]
/P user : perms[;dir-perms]: Grant or replace (respectively) permissions in the access control entries (ACEs) for the specified user. perms indicates the defined permission set. For cacls, it is either R (read), C (change), F (full control), or N (none, applies to /P with cacls only). xcacls uses several additional codes for the other atomic permissions: P (change permissions), O (take ownership), X (execute), W (write), and D (delete). Directories take a second permission string, separated from the first by a semicolon. In this context, there is an additional code letter: T (not specified).
/R user: Remove the ACEs for the specified user (requires /E).
/D user: Deny the specified user all access to the files.
/C: Continue applying changes even if an error occurs.
/Y: Suppress confirmation prompts (xcacls only).

comp

comp [options] fileset1 fileset2

Compare two sets of files (or individual files). If multiple files are specified, compare files of the same name. Differences are reported only for files of identical size. (Use fc to compare files of different sizes.)

Options

/A: Display the differences in ASCII form (the default is decimal).
/L: Display line numbers for differing lines.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Working with Directories

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

append

append path-list [options]

Create a search path of directories for datafiles (used in addition to the current folder), where path-list is a semicolon-separated list of directories (use a single semicolon to clear the append path).

Options

/X [:on | off]: Turn use of the append path on or off. In order to use this option, the first append command executed must include /X:on. on is the default if no setting is given to /X.
/Path [:on | off]: Specify whether to search the append path for datafiles including full paths. The default is on.
/E: Set the value of the APPEND environment variable to the append path, allowing it to be viewed subsequently with set.

cd [/D] [path]

Display or set the current working directory. If path does not include a drive letter, the current drive is assumed. Use /D to change to the current directory on the specified drive when it is different from the current drive. (The default is to just set it.) The form .. is used to refer to a parent directory.

chdir is a synonym for cd.

cipher

cipher [options] [paths]

Display encryption status (default operation) or encrypt /decrypt files. The list of paths defaults to the current directory. The options /E and /D specify encryption or decryption. (The default mode is a status display.)

cipher /E | /D dirs

Mark specified folders as encrypted /decrypted (affecting subsequently added files).

cipher /E | /D /S:dir

Mark all folders in the specified directory subtree.

cipher /E |/D /A specs
cipher /E |/D /A /S:dir specs

Encrypt/decrypt all files and mark all subdirectories matching the wildcard specifications in the current directory (first form), or throughout the directory tree, beginning at the specified directory. Omit specs in the second form to operate on an entire subtree.

Additional Options

/I: Continue on error.
/H: Include system and hidden files.
/F: Force encryption /decryption of all items, regardless of their current status.
/Q: Quiet mode.

delrpRK

delrp path

Delete the specified item, along with any associated reparse points.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Working with Disks and Filesystems

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

chkdsk

chkdsk x:[options]

Check the filesystem on Drive x.

Options

/F [/X]: Fix any errors encountered. /X forces a volume dismount before the check.
/L :n: Change the log file size to n KB (on NTFS filesystems only).
/R: Locate and recover bad sectors.
/V: Produce verbose output.

dfscmd

dmfcmd [options]

Administer the Distributed File System (Dfs) facility on the local system.

Options

/VIEW \\dfsroot\share[/Partial | /Full | /Batch | ^ /BatchRestore]: View the components of the specified Dfs share. /Partial adds share comments to the output and /Full lists all servers for each volume. The remaining options create batch files suitable for recreating the Dfs, including the /Restore switch in the latter case (see the next option, /MAP).
/MAP \\root\share\path\\server\share\path [comment] ^ [/Restore]: Add a shared folder to the specified Dfs tree. /Restore suppresses all checks of the destination server and forces the mapping.
/UNMAP \\root\share\path: Remove a component from a Dfs tree.
/ADD \\root\share\path\\server\share\path [/Restore]: Add a replica for the specified Dfs tree components. /Restore suppresses all checks of the destination server and forces the mapping.
/REMOVE \\root\share\path\\server\share\path: Remove a replica from the Dfs volume.

dfsutil

dfsutil [options]

Administer the Distributed File System (Dfs) facility in a Windows 2000 domain.

Server Options

/LIST:domain [/DCNAME:name]: List the distributed filesystems in the specified domain, using the specified domain controller if included. (This option is necessary if the local system is not a domain controller.)
/VIEW:\\dfsroot \dfsshare [/DCNAME:name] [/LEVEL:1]: Display configuration information for the specified Dfs tree component (share). /LEVEL:1 requests more detailed output.
/WHATIS:server: Display the Dfs server type and Dfs root for the specified server.
/VERIFY:dfsroot \dfsshare [/DCNAME:name]: Verify the metadata for the specified Dfs share.
/DFSALT:unc-path: Resolve the specified pathname to the UNC path to the actual data (taking into account replication).

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Managing Shares

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

net share

net share share-name[=path] [options]

Make a directory available to the network or revoke shared access (the =path form is used only when defining a new shared resource).

Without arguments, the command lists all currently shared resources. If just a share name is specified (without options), information about that resource is displayed.

Options

/USERS:n: Specify the maximum number of simultaneous users.
/UNLIMITED: Allow unlimited users to access the share simultaneously.
/REMARK: "text ": Specify a description or other comment for the share.
/DELETE: Remove the specified shared resource. Either the share name, the path, or the printer device may be specified as the argument to the command.

net use

net use [device:] [\\host\share] [password | *] [options]

Map a network resource to a local device, which can be a drive letter or a printer of the form LPTn.

The host and share name argument is used only when defining new mappings. It may have a NetWare volume name appended, if appropriate.

Any required password may be specified on the command line, or an asterisk may be substituted to request a password prompt.

Options

/PERSISTENT:YES | NO: Create a persistent mapping (automatically re-created at each login). The default is the setting used most recently. If this option is specified without any other arguments, it changes the current default.
/USER:[domain\]username: Specify an alternate user account for accessing the resource.
/HOME: Map the specified drive letter to your home directory (no resource specification is needed).
/DELETE: Permanently remove the specified device mapping.

net view

net view [target]

Display the names of the computers in a domain or network, or display the shared resources on a specified remote system. target can be one of the following:

\\host: The name of a remote system whose shared resources are displayed.
/DOMAIN:name: A Windows 2000 domain (its members are listed).
/NETWORK:NW [ \\host]: Without a hostname, this option lists all available NetWare servers. If a

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Printing

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

See also and .

con2prt

con2prt options [/C[D] \\hostname\printer-share]

Add remote printers to the local system. (The command is a scriptable version of the Add Printer wizard.)

Options

/C | /CD \\hostname \ printer-share: Connect to the specified printer. /CD says to make it the local default printer. These options may be specified multiple times; the first /CD sets the default printer.
/F: Delete all existing printer connections.

lpq

lpq -Sserver -Pprinter [-I]

Display the status and contents of the specified LPD-based print queue. The final option requests a detailed status report.

lpr

lpq -Sserver -Pprinter [options] file

Print the specified file to the indicated LPD-based printer.

Options

-Cclass: Select a banner page based on job class (not supported for all printers).
-J jobname: Specify the job name.
-Ol: Specify the job type as binary (the default is text). Useful for printing PostScript files in some circumstances.

print /D:\\server\ print_share files

Print text files on the specified remote printer.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Networking-Related Commands

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

finger

finger [user][@host]

Display information about the specified local or remote user (the remote host must provide a finger service). If no username is specified, information about all logged-in users is returned.

-L says to use a long listing format (ignored by many systems).

ftp

ftp host | IP-address

Initiate a file transfer session to a remote host, which must provide an ftp service.

Options

-A: Log on as anonymous.
-n: Suppress automatic initial logon to the remote host.
-w :size: Set transfer buffer size in bytes (the default is 4,096).
-i: Disable prompting during multifile transfers.
-S: file: Run commands in the specified file instead of starting an interactive session.
-v: Suppress remote server response messages.
-a: Use any local interface.
-g: Disable wildcard interpretation in filenames (known as "globbing").
-d: Enable debugging messages.

hostname

Display the hostname of the local system.

irftp

irftp path [/H] | /S

Send files over an infrared wireless link. /S opens the Wireless Link Properties dialog rather than sending a file. /H suppresses the usual Wireless Link dialog when sending the file.

rcp

rcp [/B] files destination

Copy files to or from a remote system. If the remote system running is Windows-based, it must be running the Remote Shell service. Prepend remote filenames with host [.username]: .

Options

/H: Include hidden files in the copy operation.
/R: Recurse subdirectories in the file list.

rsh, rexec

rsh server [-l username] command rexec server [-l username] command

Execute a command on a remote system using the REXEC or the Remote Shell service, optionally specifying a user account for the remote system.

telnet

telnet host | IP-address

Initiate an interactive session to a remote host (which must provide a telnet service).

tftp

tftp [-i] host [get | put] file-to-transfer [destination]

Perform a Trivial FTP file transfer. The -i option says to perform a binary file transfer (an ASCII transfer is the default). The keywords

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Administering Users and Groups

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

addusersRK

addusers [\\server] file

Manage user accounts on the local or specified server via a prepared file. Options control the command's functioning. See W2RKTools.Chm for the syntax of the input file.

Options

/C [ /P:c]: Create new user accounts and groups. /P specifies account flags via one or more of the following code letters: l (don't force password change at first login), c (user cannot change password), e (password never expires), and d (account is disabled).
/D: Write user and group data to the specified file.
/E: Delete user accounts as specified in file.
/S:c: Set the field-separation character for the file. The default character is a comma.

cusrmgrRK

cusrmgr -u user[-m system] [options]

Modify characteristics of the specified user account.

Options

-P password: Set the user password.
+s | -s flag: Set or unset account flags, where flag is one of the following: MustChangePassword, CanNotChangePassword, PasswordNeverExpires, AccountDisabled, AccountLockout, or RASUser.
-r newname: Rename the user account.
- d: Delete the user account.
-c comment: Set the account comment.
-f fullname: Specify the user's full name.
-U profile: Specify the user profile.
-h dir -H drive: Specify the user home directory or the drive letter mapping.
-n logon-script: Specify the logon script.
-alg group |-agg group: Add the user to the specified local (-alg ) or global (-agg ) group.
-dlg group | -dgg group: Remove the user from the specified local (-dlg ) or global (-dgg ) group.
-rlg | -rgg group newname: Rename a local (-rlf ) or global (-rgg ) group (-u is ignored).

delprofRK

delprof [/c:\\server] [options]

Delete inactive user profiles on the local computer or on any specified computer.

Options

/Q: Suppress confirmation messages.
/D:days: Specify the inactivity period (the default is 0).

globalRK

global group domain | \\host

List the members of a global group.

localRK

local group domain | \\host

List the members of a local group.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Managing Processes

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

List or schedule delayed and periodic tasks on the specified computer system. (This defaults to the local system.)

Variations

at [\\host]

List currently pending at jobs in the Schedule service queue. Note that at jobs also appear in the Scheduled Tasks control panel applet, and may be managed from there also.

at [\\host] job-ID /DELETE
at [\\host] /DELETE [/YES]

Remove a pending job (first form) or all pending jobs (second form; /YES preconfirms the action).

at [\\host] time [options] command

Schedule a job for one-time or periodic execution; time indicates the time of day at which the command runs.

Job Scheduling Options

/NEXT: weekday | n: Run the command on the next occurrence of the specified day of the week or on the nth of the month.
/EVER Y: weekday-and-dates-list: Run the command on a regular schedule; i.e., on each day of the week or the date of the month specified in the comma-separated list.
/INTERACTIVE: Allow desktop input when the command executes.

clearmemRK

clearmem [options]

Clear and allocate memory.

Option

-mn: Allocate n MB of memory (the default is all of the memory).

See W2RKTools.Chm for other options.

diskperf

diskperf -Y[D | V] | -N[D | V] [\\host]

Enable (-Y) or disable (-N) disk performance counters on the specified system (this defaults to the local system). D and V refer to the counters for physical and logical devices, respectively—for example, -YD enables the counter for physical disks. By default, all counters are enabled. The command takes effect once the system is rebooted.

kill

kill [/F] item

Terminate one or more processes, where item is a process ID or a regular expression designed to match a complete task /command name or window title. The /F option kills some processes that survive the normal termination signal.

memsnap

Write a listing of all current processes and their memory usage statistics to the file memsnap.log.

net print

net print \\host\shared-printer

List the contents of the specified print queue.

Additional content appearing in this section has been removed.
Purchase this book now or read it online at Safari to get the whole thing!

Managing Services

Content preview·Buy PDF of this chapter|Buy reprint rights for this chapter

delsrvRK

delsrv service

Delete and unregister the specified service. Use sclist to view the names of installed services.

dumpelRK

dumpel [-s \\ server] -f output-file -l log [options]

Write event log entries from the local system or the specified system to the indicated output file (separating fields by spaces by default). The -l option specifies the event log to dump: system, security, or application (the default).

Options

-t: Separate fields by tabs.
-m source [-e id-list] [-r]: Specify the source field (i.e., the subsystem) for which to dump events, further limiting the list to the listed event IDs (up to 10 may be specified) if -e is included. The -r option reverses the sense of this filtering, writing all events except those that meet the specified criteria.
-d n: Dump events for only the past n days.

elogdmpRK

elogdmp server logtype

Dump the event log entries from the specified system to standard output in CSV format. logtype is either Application, Security, or System.

instsrvRK

instsrv service-name command-path [options]

Install a new service with the specified service name, running the executable indicated by command-path.

instsrv service-name remove

Remove an installed service. Use sclist to determine the name of the desired service.

Options

/A user: Run the service as the specified user.
/P password: Specify the password for the user account.

logeventRK

logevent [-m \\server] [options] text

Add an event to the Application event log.

Options

-s c: Specify the event severity level; either s (success), i (information), w (warning), e (error), or f (failure).