Monitorowanie sieci

WMIC narzędzie systemu windows

Ratio: 3 / 5

Windows Management Instrumentation Command - WMIC

Narzędzie WMIC to przydat narzędzie które zawiera ogromny zestaw funkcji pokazujących informacje o systemie, pozwalających kontrolować uruchomione programy, pozwalający zarządzać zainstalowanym oprogramowaniem i to wszystko z linii poleceń.

Jak uruchomić program WMIC

Wchodzimy do linii poleceń wpisując cmd - odpalamy linię poleceń z prawami administratora.

Następnie wpisujemy polecenie WMIC i dostajemy się do jego linii poleceń.

Narzędzie WMIC pozwala na wydawanie poniższych poleceń możemy sobie je wylistować za pomocą helpa używając komendy

WMIC /?

Możemy pobierać dane o sprzęcie używając zapytania

WMIC OS Get /?

Możemy także wprowadzać zmiany w konfiguracji komendą

WMIC OS Set /?

Polecenia tego używaj tylko jeżeli zdajesz sobie sprawę z konsekwencji jego działania

Jak wyświetlać informacje w sposób formatowany

Używamy do tego polecenia np.: bios list brief /format:list

Wyświetlenie contextu profilu na którym pracujemy - wyświetla informację o stanie głównych przełączników

QUIT/EXIT wyjście z aplikacji

Przełączniki w WMIC:

/NAMESPACE	NAMESPACE - Path for the namespace the alias is to operate against. Namespaces are always relative i.e. if the namespace does not begin with a '\\' it will be assumed to be relative to the current namespace. USAGE: /NAMESPACE:<namespace>
/ROLE	ROLE - Path for the role containing the alias definitions to be available for the utility session. USAGE: /ROLE:<namespace> NOTE: Roles are actually namespaces and should be treated in the same way - i.e. relative paths should behave appropriately (default namespace is '\\root\cli').
/NODE	NODE - Specify what servers the alias will operate against. USAGE: /NODE:<machine id list> NOTE: <machine id list> ::= <@filename \| machine id> \| <@filename \| machine id> <,machine id list>
/IMPLEVEL	IMPLEVEL - Determine what level the command line should impersonate. Default is 'Impersonate'. USAGE: /IMPLEVEL:<implevel>[/AUTHORITY:<authority type>] Various implevels are as follows: Impersonation Level ------------------ Anonymous Identify Impersonate Delegate Note: Use /AUTHORITY switch for specifying the authority type.
/AUTHLEVEL	AUTHLEVEL - Specify the level the command line should authenticate. Default is 'Pktprivacy'. USAGE: /AUTHLEVEL:<authlevel> Various authlevels are as follows: Authlevel --------- Default None Connect Call Pkt Pktintegrity Pktprivacy
/LOCALE	LOCALE - Specify the language id the command line should use. USAGE: /LOCALE:<locale identifier> NOTE: The parameter to the 'LOCALE' switch is of the form MS_XXX. Where XXX for English is 409, XXX for Finnish is 40b.
/PRIVILEGES	PRIVILEGES - Enable or disable all privileges. USAGE: /PRIVILEGES:<option> NOTE: Allowed value(s) for <option> is either ENABLE or DISABLE.
/TRACE	TRACE - Specify whether output debug information is to be copied to stderr during the processing of the request(s). USAGE: /TRACE:<option> NOTE: Allowed value(s) for <option> is either ON or OFF.
/RECORD	RECORD - Logs all entered commands and WMIC's output to a file in XML format. USAGE: /RECORD:<filepath>
/INTERACTIVE	INTERACTIVE - Sets or resets the interactive mode. USAGE: /INTERACTIVE:<option> NOTE: Allowed value(s) for <option> is either ON or OFF.
/FAILFAST	FAILFAST - Sets or resets the FailFast mode. USAGE: /FAILFAST:<option> NOTE: Allowed value(s) for <option> is either ON or OFF.
/USER	USER - Provides the user to be used during the session. USAGE: /USER:<userid> NOTE: User should be provided in the form <domain>\<user>.
/PASSWORD	PASSWORD - Provides the password to be used in logging on to this session. USAGE: /PASSWORD:<password>
/OUTPUT	OUTPUT - Specifies the mode for output redirection. USAGE: /OUTPUT:<outputspec> NOTE: <outputspec> ::= (STDOUT \| CLIPBOARD \| <filename>) STDOUT - Output will be redirected to the STDOUT. CLIPBOARD - Output will be copied on to CLIPBOARD. <filename> - Output will be written to the specified file.
/APPEND	APPEND - Specifies the mode for output redirection. USAGE: /APPEND:<outputspec> NOTE: <outputspec> ::= (STDOUT \| CLIPBOARD \| <filename>) STDOUT - Output will be redirected to the STDOUT. CLIPBOARD - Output will be copied on to CLIPBOARD. <filename> - Output will be appended to the specified file.
/AGGREGATE	AGGREGATE - Determines the mode of displaying results. USAGE: /AGGREGATE:<option>. NOTE: Allowed value(s) for <option> is either ON or OFF.
/AUTHORITY	AUTHORITY - Specifies the <authority type> for the connection. USAGE: /AUTHORITY:<authority type>
/?	/? - Displays specification/syntax for help commands. USAGE: /?:[<helpType>] NOTE: Allowed value(s) for <helpType> is either BRIEF or FULL.

Podstawowe zapytania

alias	Access local system aliases
baseboard	get Manufacturer, Model, Name, PartNumber, slotlayout, serialnumber, poweredon
bios	get name, version, serialnumber
bootconfig	get BootDirectory, Caption, TempDirectory, Lastdrive
cdrom	get Name, Drive, Volumename
computersystem	get Name, domain, Manufacturer, Model, NumberofProcessors, PrimaryOwnerName,Username, Roles, totalphysicalmemory /format:list
cpu	get Name, Caption, MaxClockSpeed, DeviceID, status
CSPRODUCT	Computer system product information from SMBIOS.
datafile	where name='c:\\boot.ini' get Archive, FileSize, FileType, InstallDate, Readable, Writeable, System, Version
dcomapp	get Name, AppID /format:list
desktop	get Name, ScreenSaverExecutable, ScreenSaverActive, Wallpaper /format:list
desktopmonitor	get screenheight, screenwidth
diskdrive	get Name, Manufacturer, Model, InterfaceType, MediaLoaded, MediaType
diskquota	get User, Warninglimit, DiskSpaceUsed, QuotaVolume
environment	get Description, VariableValue
fsdir	where name='c:\\windows' get Archive, CreationDate, LastModified, Readable, Writeable, System, Hidden, Status
group	get Caption, InstallDate, LocalAccount, Domain, SID, Status
idecontroller	get Name, Manufacturer, DeviceID, Status
irq	get Name, Status
job	get Name, Owner, DaysOfMonth, DaysOfWeek, ElapsedTime, JobStatus, StartTime, Status
loadorder	get Name, DriverEnabled, GroupOrder, Status
logicaldisk	get Name, Compressed, Description, DriveType, FileSystem, FreeSpace, SupportsDiskQuotas, VolumeDirty, VolumeName
memcache	get Name, BlockSize, Purpose, MaxCacheSize, Status
memlogical	get AvailableVirtualMemory, TotalPageFileSpace, TotalPhysicalMemory, TotalVirtualMemory
memphysical	get Manufacturer, Model, SerialNumber, MaxCapacity, MemoryDevices
netclient	get Caption, Name, Manufacturer, Status
netlogin	get Name, Fullname, ScriptPath, Profile, UserID, NumberOfLogons, PasswordAge, LogonServer, HomeDirectory, PrimaryGroupID
netprotocol	get Caption, Description, GuaranteesSequencing, SupportsBroadcasting, SupportsEncryption, Status
netuse	get Caption, DisplayType, LocalName, Name, ProviderName, Status
nic	get AdapterType, AutoSense, Name, Installed, MACAddress, PNPDeviceID,PowerManagementSupported, Speed, StatusInfo
nicconfig	get MACAddress, DefaultIPGateway, IPAddress, IPSubnet, DNSHostName, DNSDomain
nicconfig	get MACAddress, IPAddress, DHCPEnabled, DHCPLeaseExpires, DHCPLeaseObtained, DHCPServer
nicconfig	get MACAddress, IPAddress, DNSHostName, DNSDomain, DNSDomainSuffixSearchOrder, DNSEnabledForWINSResolution, DNSServerSearchOrder
nicconfig	get MACAddress, IPAddress, WINSPrimaryServer, WINSSecondaryServer, WINSEnableLMHostsLookup, WINSHostLookupFile
ntdomain	get Caption, ClientSiteName, DomainControllerAddress, DomainControllerName, Roles, Status
ntevent	where (LogFile='system' and SourceName='W32Time') get Message, TimeGenerated
ntevent	where (LogFile='system' and SourceName='W32Time' and Message like '%timesource%') get Message, TimeGenerated
ntevent	where (LogFile='system' and SourceName='W32Time' and EventCode!='29') get TimeGenerated, EventCode, Message
onboarddevice	get Description, DeviceType, Enabled, Status
os	get Version, Caption, CountryCode, CSName, Description, InstallDate, SerialNumber, ServicePackMajorVersion, WindowsDirectory /format:list
os	get CurrentTimeZone, FreePhysicalMemory, FreeVirtualMemory, LastBootUpTime, NumberofProcesses, NumberofUsers, Organization, RegisteredUser, Status
pagefile	get Caption, CurrentUsage, Status, TempPageFile
pagefileset	get Name, InitialSize, MaximumSize
partition	get Caption, Size, PrimaryPartition, Status, Type
printer	get DeviceID, DriverName, Hidden, Name, PortName, PowerManagementSupported, PrintJobDataType, VerticalResolution, Horizontalresolution
printjob	get Description, Document, ElapsedTime, HostPrintQueue, JobID, JobStatus, Name, Notify, Owner, TimeSubmitted, TotalPages
process	get Caption, CommandLine, Handle, HandleCount, PageFaults, PageFileUsage, PArentProcessId, ProcessId, ThreadCount
product	get Description, InstallDate, Name, Vendor, Version
qfe	get description, FixComments, HotFixID, InstalledBy, InstalledOn, ServicePackInEffect
quotasetting	get Caption, DefaultLimit, Description, DefaultWarningLimit, SettingID, State
recoveros	get AutoReboot, DebugFilePath, WriteDebugInfo, WriteToSystemLog
Registry	get CurrentSize, MaximumSize, ProposedSize, Status
scsicontroller	get Caption, DeviceID, Manufacturer, PNPDeviceID
server	get ErrorsAccessPermissions, ErrorsGrantedAccess, ErrorsLogon, ErrorsSystem, FilesOpen, FileDirectorySearches
service	get Name, Caption, State, ServiceType, StartMode, pathname
share	get name, path, status
sounddev	get Caption, DeviceID, PNPDeviceID, Manufacturer, status
startup	get Caption, Location, Command
sysaccount	get Caption, Domain, Name, SID, SIDType, Status
sysdriver	get Caption, Name, PathName, ServiceType, State, Status
systemenclosure	get Caption, Height, Depth, Manufacturer, Model, SMBIOSAssetTag, AudibleAlarm, SecurityStatus, SecurityBreach, PoweredOn, NumberOfPowerCords
systemslot	get Number, SlotDesignation, Status, SupportsHotPlug, Version, CurrentUsage, ConnectorPinout
tapedrive	get Name, Capabilities, Compression, Description, MediaType, NeedsCleaning, Status, StatusInfo
timezone	get Caption, Bias, DaylightBias, DaylightName, StandardName
useraccount	get AccountType, Description, Domain, Disabled, LocalAccount, Lockout, PasswordChangeable, PasswordExpires, PasswordRequired, SID

Przykładowa składnia

wmic /node:SERVER1 printer list status

nic list

WMIC pozwala również wykonywać raport do pliku html

przykład składni:

/output:cpu.html CPU get name,numberofcores,family /Format:htable

/output:cpu.html - wysyła wynik do pliku cpu.html

CPU get pobiera dane o procesorze

name,numbersofcores,family - pobiera tylko te dane i przekazuje je do pliku wynikowego

/Format:htable - formatuje wynik jako tabela .html

Inny przykład

wmic diskdrive get model,size

INFORMATICS

The Best

Przełącznik języka

Tools

This Site

Mining

Security

CMS

Hardware

Backup

Windows Server

Databases

Emulators

Powershell

Storage Array

Active Directory

SEO

MSSQL

Antivirus program

Linux

Licznik

Visitor Info

Who Is Online

Netstat - testowanie portów

WMIC narzędzie systemu windows

Monitorowanie sieci WinMRTG

Search