Skip to content
Tech Shizz Logo

An Engineers Blog

  • TechShizz
  • blog

I just need to know…

Posted on February 23, 2021 By rich No Comments on I just need to know…

Who is logged on to a computer?

We often need to know who is currently logged on to a remote computer.

We can use SysInternals‘ PSTools:

	PSLOGGEDON -L \remotecomputer

or:

	PSEXEC \remotecomputer NET CONFIG WORKSTATION | FIND /I " name "

or:

	PSEXEC \remotecomputer NET NAME

What groups is this user a member of?

In Windows NT 4 and later, users usually are members of global groups.
These global groups in turn are members of (domain) local groups.
Access permissions are given to (domain) local groups.
To check if a user has access to a resource, we need to check group membership recursively.
With (native) Windows Server 2003 commands:

	DSQUERY USER -samid loginname | DSGET USER -memberof -expand

What permissions does a user have on this directory?

One could use the previous command to check what permissions a user has on a certain directory.
However, sometimes SHOWACLS from the Windows Server 2003 Resource Kit Tools is a better alternative:

	CD /D d:directory2check
	SHOWACLS /U:domainuserid

When did someone last change they’re password?

With the native NET command:

	NET USER loginname /DOMAIN | FIND /I "Password last set"

When did someone last log in?

With the native NET command:

	NET USER loginname /DOMAIN | FIND /I "Last logon"

How do I reset someone’s password?

	DSQUERY USER -samid loginname | DSMOD USER -pwd newpassword

Is someone’s account locked?

With the native NET command:

	NET USER loginname /DOMAIN | FIND /I "Account active"

The account is either locked (“Locked”) or active (“Yes”).

How to unlock a locked account

With the native NET command:

	NET USER loginname /DOMAIN /ACTIVE:YES

or, if the password needs to be reset as well:

	NET USER loginname newpassword /DOMAIN /ACTIVE:YES

Make sure a local user’s password never expires

With WMIC (Windows XP Professional or later):

	WMIC.EXE /Node:remotecomputer Path Win32_UserAccount Where Name="user" Set PasswordExpires="FALSE"

Make sure a local user’s password will expire

With WMIC (Windows XP Professional or later):

	WMIC.EXE /Node:remotecomputer Path Win32_UserAccount Where Name="user" Set PasswordExpires="TRUE"

List all domains and workgroups in the network

With the native NET command:

	NET VIEW /DOMAIN

List all computers in the network

With the native NET command:

	NET VIEW

List all domain controllers

	DSQUERY Server

or, if you prefer host names only:

	DSQUERY Server -o rdn

List disk space on all disks on every server!

	FOR /F %%A IN (servers.txt) DO (WMIC /Node:%%A LogicalDisk Where DriveType="3" Get DeviceID,FileSystem,FreeSpace,Size /Format:csv | MORE /E +2 >> SRVSPACE.CSV)

The only prerequisites are:

  1. SRVSPACE.CSV should not exist or be empty,
  2. a list of server names in a file named SERVERS.TXT, one server name on each line

The CSV file format is ServerName,DeviceID,FileSystem,FreeSpace,Size (one line for each harddisk partition on each server).

List all drivers on any PC

With (native) Windows XP Professional or Windows Server 2003 commands:

	DRIVERQUERY /V /FO CSV > %ComputerName%.csv

Or, for remote computers:

	DRIVERQUERY /S remote_PC /V /FO CSV > remote_PC.csv

List all printers on any PC

With (native) Windows XP+ commands:

	WMIC /Node:remote_PC Path Win32_Printer Get DeviceID

List all local administrators

With (native) Windows NT 4+ commands:

	NET LOCALGROUP Administrators

Disable Windows Firewall for domain only

Disable the firewall only when the computer (e.g. a laptop) is connected to the domain:

	NETSH Firewall Set OpMode Mode = DISABLE Profile = DOMAIN

Completely disable Windows Firewall (for testing purposes)

Disable the firewall completely:

	SC [ \Remote_computer ] Stop SharedAccess
	SC [ \Remote_computer ] Config SharedAccess start= disabled

Which updates were installed on this compter?

Windows 7 and 8:

	DISM /Online /Get-Packages

or:

	WMIC QFE List

 

DISM will return far more details than WMIC.

Post navigation

❮ Previous Post: How to clear a print queue that won’t clear
Next Post: How to disable SIP ALG on a Draytek router ❯

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Generic selectors
Exact matches only
Search in title
Search in content
Post Type Selectors

Subscribe to our newsletter!

Recent Posts

  • How to Safely Use Public Wi-Fi without Compromising Your Security
  • How to implement a lightning-fast ransomware playbook
  • How to achieve defence in depth in your business
  • How to implement a SecOps team phishing response plan
  • How to block an Office 365 Sign-in correctly

Recent Comments

    Archives

    • July 2023
    • November 2022
    • July 2021
    • March 2021
    • February 2021

    Categories

    • Cyber Security
    • Uncategorized

    Meta

    • Log in
    • Entries feed
    • Comments feed
    • WordPress.org

    Copyright © 2023 .

    Theme: Oceanly News Dark by ScriptsTown