Saving and restoring existing Windows shares

Refer to Microsoft KB

Insufficient system resources exist to complete the requested service Windows Server 2003

Refer to MS KB935649

How to create dumps of applications or the whole machine

Instruction manual on how to gather data Click Here.

Antivirus software may cause Event ID 2011

For more details refer to  MS KB

How to reboot/shutdown Windows Servers remotely using PsShutdown utility

You need to copy the PsShutdown file on Windows server in a folder. Say I saved the file under a folder called C:\downloadss. Next open windows command prompt, go to  (Start > Run > cmd) and schedule the  reboot:


c:> at 12:00am c:\downloads\psshutdown.exe -r -f -c -t 10 -accepteula

Above command will reboot the system at 12am. If you want to shutdown system:

c:> at 12:00am c:\downloads\psshutdown.exe -s -f -c -t 10 -accepteula

Where:

• -s: Shutdown specified server
• -r: Reboot specified server
• -f: Forces all running application to exit
• -c: Allow the shutdown to by cancel by user
• -t: Specifies the countdown in seconds until the reboot or shutdow process
• -accepteula (you need to add -accepteula to the psshutdown command, otherwise the task will hang, indicating a “running” state in Scheduled Tasks)

How find out a User Login Name

You can use this window server 2003 native command to find out users login details:

DSQUERY USER -name *LastNameOrFirstNameQuestionedUser* | DSGET USER -samid -display

For Example, if we want to find out fawad's login details then the command would be:

DSQUERY USER -name *fawad* | DSGET USER -samid -display

Output Screen from above command:

samid       display

FZI          Fawad Zikria
dsget succeeded

Who is Logged on to a Computer

You can use WMIC command on Window xp pro or later version of OS to find out who is logged on to a computer.

WMIC /Node:RemoteComputerName ComputerSystem Get UserName

For Example:

>WMIC /Node:replicator ComputerSystem Get UserName
UserName
fzk
ske
tet
tue

Above are 4 users who are currently logged on to replicator.

Also, you can use the PSTools to find out who is logged on to a computer remotely by executing the following command:

PSLOGGEDON -L \\Remote ComputerName or PSEXEC file://remotecomputername/ NET NAME

How to List all Domain Controllers on your Domain

Open the CLI and type to following Window Server 2003 native commands:

DSQUERY Server

Otput Screen:

"CN=testserver,CN=Servers,CN=sydney,CN=Sites,CN=Configuration,DC=test,DC=com,DC=au"

"CN=DC1,CN=Servers,CN=Campbelltown,CN=Sites,CN=Configuration,DC=test,DC=com,DC=au"
"CN=DC2,CN=Servers,CN=Campbelltown,CN=Sites,CN=Configuration,DC=test,DC=com,DC=au"
"CN=SDC1,CN=Servers,CN=City,CN=Sites,CN=Configuration,DC=test,DC=com,DC=au"
"CN=SDC2,CN=Servers,CN=City,CN=Sites,CN=Configuration,DC=test,DC=com,DC=au"

or, if you prefer the host names only then type:

DSQUERY Server -o rdn

Output Screen:
testserver

DC1
DC2
SDC1
SDC2

You can also use the below command on window server 2003:

           nltest /dclist:DomainName

For example:

       nltest /dclist:test.com.au

Useful Commands for Windows Administrator

Answer Available Here

How to Change Windows Local Administrator’s Password Remotely via CLI

In order to change a local user’s password in the computer being used, we can run this command:

           net user username newpassword

But to change a local user’s password in another computer, first of all you need to have a administrator privileges and then need to make connection to the IPC$ of the computer.

Use this command to establish a IPC connection:

           net use \\computer_name\ipc$ /user:administrator

Press Enter and then enter the administrator’s password when prompted.

For Example : To change the administrator’s password of the computer called vmcitrix04:

            net use \\vmcitrix04\ipc$ /user:administrator


Local name
Remote name \\vmcitrix04\ipc$
Resource type IPC
Status Disconnected
# Opens 0
# Connections 1

The command completed successfully.

But if we want to automate the service to change the local administrator’s password or to schedule the task for later, then we need to find out the time on the computer. So, we need the current time on the computer by using this command :

      net time \\vmcitrix04

Current time at \\vmcitrix04 is 3/1/2010 4:19 PM
The command completed successfully.

Finally, use the below cmd format to schedule the task at 4:22 using this command:

    at \\vmcitrix04 4:22 cmd /c net user administrator testing

Added a new job with job ID = 1

The job is scheduled to run on vmcitrix04 at 4:22 by changing the local administrator password to testing.

How to shutdown and reboot remote machine via cmd

Examples for Shutdown switch

shutdown /s /m file://testserver/ - Shuts down a remote machine called 'testserver'
shutdown /r /m file://testserver/ - Reboots a remote machine called 'testserver'

Shutdown - with extra switches

/t for time (In seconds and Maximum value is 600secs)
/f for force (to force the reboot or shutdown)
/c for comment (to add comments)

Also, Click Here for A collection of shutdown commands for most DOS and Windows OS.

How to display system info via command line

This command gives you a hard copy of the information displayed in System Information (Accessories). From the command prompt type: Systeminfo > server.txt Then Notepad server.txt lets you read the data captured. The > 'greater than' is an old trick to redirect information from the screen into a file.


Systeminfo - pipe O/S details to a text file
 
For example:   
 
systeminfo > c:\systeminfo.txt

output info to a pipe file

Host Name: 6LMKK1S
OS Name: Microsoft Windows XP Professional
OS Version: 5.1.2600 Service Pack 3 Build 2600
OS Manufacturer: Microsoft Corporation
OS Configuration: Member Workstation
OS Build Type: Multiprocessor Free
Registered Owner: fzi
Registered Organization: fzi
Product ID: 76487-641-0311207-23721
Original Install Date: 18/08/2009, 3:54:09 PM
System Up Time: 8 Days, 21 Hours, 23 Minutes, 9 Seconds
System Manufacturer: Dell Inc.
System Model: OptiPlex GX620
System type: X86-based PC
Processor(s): 1 Processor(s) Installed.
[01]: x86 Family 15 Model 4 Stepping 7 GenuineIntel ~2793 Mhz
BIOS Version: DELL - 7
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (GMT+10:00) Canberra, Melbourne, Sydney
Total Physical Memory: 2,038 MB
Available Physical Memory: 1,185 MB
Virtual Memory: Max Size: 2,048 MB
Virtual Memory: Available: 2,008 MB
Virtual Memory: In Use: 40 MB
Page File Location(s): C:\pagefile.sys
Domain: test.com.au
Logon Server:
Hotfix(s): 154 Hotfix(s) Installed.NetWork Card(s): 1 NIC(s) Installed.
[01]: Broadcom NetXtreme Gigabit Ethernet
Connection Name: Local Area Connection
DHCP Enabled: Yes
DHCP Server:
IP address(es)
 

How to find out what group an ADS computer is member of

To find out what groups an ADS computer is a member of:


          dsquery computer -name computername

C:\>dsquery computer -name 6lmmk1s
"CN=6LMKK1s,OU=Admin,OU=Informartion Technology,DC=sca,DC=nsw,DC=gov,DC=au"

How to find out detailed information about a user account

How to find out detailed information about a user account:


     net user username /domain

For example, to find the detailed information about a user FZI, enter the below command:

    net user fzi /domain

The command will generate the following below information:

The request will be processed at a domain controller for domain test.com.au
User name FZI
Full Name Fawad Zikria
Comment Information Technology Infrastructure Specialist
User's comment
Country code                 000 (System Default)
Account active                Yes
Account expires              Never
Password last set            12/23/2009 9:58 AM
Password expires            1/22/2010 9:58 AM
Password changeable       12/25/2009 9:58 AM
Password required Yes
User may change password Yes
Workstations allowed        All
Logon script                      slogic.bat
User profile
Home directory
Last logon                           12/23/2009 1:47 PM
Logon hours allowed           All
Local Group Memberships  *Account Operators         *Print Operators                                        
Global Group memberships *CSS_Security                  *Contribute_Users
                                           *Domain Admins               *Citrix_Environment_Gr
                                           *SUN5                             *RSA
                                           *BREACH_DB_READ    *AACO_IT_Admin
                                           *DAR_EDIT                     *Domain Users
                                           *VM_Admin                     *Trim_Context_INFOWORK
                                           *Specialist file exten           *INCIDENT_MANAGEMENT
                                           *CTX-APP-COGNOS     *CTX-APP-GISTEST
The command completed successfully.

How to get list of machines by OS type from Active Directory

To list of all computers that have a Windows XP OS use the following below command:

dsquery * domainroot -filter "(&(objectCategory=computer)(operatingSystem=Windows XP*))"
 
To list of all computers that have a Windows Server OS use the following below command:


dsquery * domainroot -filter "(&(objectCategory=computer)(operatingSystem=Windows Server*))"

Using dsquery to find the domain controllers in the domain or forest

To find all the domain controllers in the forest with DN and RDN:

    DsQuery Server -o rdn -Forest
    DsQuery Server -Forest

To find all the domain controllers in a domain:
  DsQuery Server -domain domain_name.com

To list all the domain controllers in a domain that are also Global Catalog Servers:
   DsQuery Server -domain domain_name.com -isgc

To list the domain controller in the forest that holds the Schema FSMO:
DsQuery Server -Forest -hasfsmo schema

How to check if a newly created gpo updated on the all domain controllers

Open the command prompt on a domain controller where you created the new gpo and execute the followinng command:

              gpotool.exe /gpo:Newly_Created_GPO_Name_Here /verbose


If the policy has replicated to all the domain controllers, you will see a "Policy Ok" message. If it has not replicated accross yet, then the tool will list the names of the domain controllers who has not received this GPO yet.

Managing Terminal Services Sessions Remotely (Window xp and 2003)

Windows XP and 2003 have two command-line tools which is called qwinsta and rwinsta that can query and reset a remote session.


For example, let's say that I can't gain access to a server using Terminal Services because both sessions are used up. I can use another server to check the status of the first one. As long as the user has administrative rights on the non-accessible machine I would run this:

qwinsta /server:testserver

Where testserver is the name of the non-accessible machine.

The above command will display the following below information:

> qwinsta /server:testserver

SESSIONNAME     USERNAME        ID            STATE         TYPE        DEVICE
console                                                   0              Conn             wdcon
rdp-tcp                                           65536              Listen            rdpwd
rdp-tcp#470              fzi                          1             Active            rdpwd
rdp-tcp#470              grg                        3              Active            rdpwd
Now I know that fzi and grg are the two that are logged in. To disconnect either user session I would type this:

rwinsta /server:testserver 1 or 3 (depending which user session you want to terminate)

Notice the 1 or 3 which is the session ID we found from using qwinsta command above.
 
Or you can try and logoff the session remotely using two Windows utilities, quser.exe and logoff.exe. With quser you can find out the session names of the logged on users and use that information in a subsequent call to logoff.exe to close the session.
 
> quser /server:testserver
 
USERNAME    SESSIONNAME          ID        STATE         IDLE TIME      LOGON TIME
pjp                    rdp-tcp#5                       2          Active                    2:31        12/11/2009 3:39
PM

>logoff rdp-tcp#5 /server:testserver

Running Diagnostics Against Active Directory Domain

Makesure you have the support tools installed on the server from the CD

Location: d:\support\tools\setup.exe

Run dcdiag, netdiag and repadmin, you need to run them in verbose mode.

dcdiag /e /c /v /s:(Domain Controller Name) /f:c:\dcdiaglogfile.log

netdiag.exe /v > c:\netdiaglogfile.log

repadmin.exe /showrepl (Domain Controller) /verbose /all /intersite > c:\repllogfile.txt

Once the log files are gernerated then just search the log files for the Fail and Warning messages.

Active Directory Operations Guide

Procedures Reference Guild:

http://technet.microsoft.com/en-us/library/bb727062(printer).aspx#EIAA