NOTES ABOUT COMMANDS. ATTRIB.exe

Size: px

Start display at page:

Download "NOTES ABOUT COMMANDS. ATTRIB.exe"

Alexander Heath
5 years ago
Views:

1 ATTRIB.exe Display or change file attributes. Find Filenames. Syntax ATTRIB [ + attribute - attribute ] [pathname] [/S [/D]] Key + : Turn an attribute ON - : Clear an attribute OFF pathname : Drive and/or filename e.g. C:\*.txt /S : Search the pathname including all subfolders. /D : Process folders as well attributes: R Read-only A Archive S System H Hidden The numeric values can be used when changing attributes with VBS/WSH. If no attribute is specified attrib will return the current attribute settings. Used with just the /S option ATTRIB will quickly search for a particular filename. Hidden and System attributes take priority. If a file has both the Hidden and System attributes set, you can clear both attributes only with a single ATTRIB command. For example, to clear the Hidden and System attributes for the RECORD.TXT file, you would type: ATTRIB -S -H RECORD.TXT

2 File Attributes You can use wildcards (? and *) with the filename parameter to display or change the attributes for a group of files. Remember that, if a file has the System or Hidden attribute set, you must clear that attribute before you can change any other attributes. Directory Attributes You can display or change the attributes for a directory/folder. To use ATTRIB with a directory, you must explicitly specify the directory name; you cannot use wildcards to work with directories. For example, to hide the directory C:\SECRET, you would type the following: ATTRIB +H C:\SECRET The following command would affect only files, not directories: ATTRIB +H C:*.* The Read-only attribute for a folder is generally ignored by applications, however the Read-only and System attributes are used by Windows Explorer to determine whether the folder is a special folder, such as My Documents, Favorites, Fonts, etc. Setting the Read-Only attribute on a folder can affect performance, particularly on shared drives because Windows Explorer will be forced to request the Desktop.ini of every sub-folder to see if any special folder settings need to be set.

3 chkdsk.exe Check Disk - check and repair disk problems Syntax CHKDSK [drive:][[path]filename] [/F] [/V] [/R] [/L[:size]] Key [drive:] The drive to check. filename File(s) to check for fragmentation (FAT only). /F Automatically Fix file system errors on the disk. /X Fix file system errors on the disk, (Win2003 and above) dismounts the volume first, closing all open file handles. /R Scan for and attempt Recovery of bad sectors. /V Display the full path and name of every file on the disk. /L:size NTFS only: change the log file size to the specified number of kilobytes. If size is not specified, displays the current log size and the drive type (FAT or NTFS). /C Skip directory corruption checks. /I Skip corruption checks that compare directory entries to the file record segment (FRS) in the volume's master file table (MFT)

4 Example: CHKDSK C: /F Fixing Errors /F If the drive is the boot partition, you will be prompted to run the check during the next boot. If you specify the /f switch, chkdsk will show an error if open files are found on the disk. Chkdsk /f will lock the volume, making data unavailable until chkdsk is finished. If you use chkdsk /f on a disk with a very large number of files (millions), chkdsk can take a long time to complete. When you delete a file or folder that has 'custom' permissions, the ACL is not deleted, it is cached. Chkdsk /f will remove ACLs that are no longer used. This is often the cause of the rather worrying message: "Windows found problems with the file system. Run chkdsk with the /F (fix) option to correct these." It is normal for chkdsk /F to remove unused index entries and unused security descriptors every time you run it, these do not indicate a problem with the file system. Scan only (without /f switch) If a file needs to be fixed chkdsk will alert you with a message but will not fix the error(s). chkdsk can report lost allocation units on the disk - it will produce this report even if the files are in-use (open). If corruption is found, consider closing all files and repairing the disk with /F. Running chkdsk on a data volume that is in use by another program or process can incorrectly report errors when none are present. To avoid this, close all programs or processes that have open handles to the volume. On computers running Windows 2003 SP1, chkdsk automatically creates a shadow copy, so you can check volumes that are 'in use' by another program or process. This enables an accurate report against a live file server. On earlier versions of Windows, chkdsk would always lock the volume, making data unavailable.

5 CIPHER.exe Encrypt or Decrypt files and folders. Without parameters cipher will display the encryption state of the current folder and files. NTFS volumes only. Syntax: Encrypt/Decrypt: CIPHER [{/e /d}] [/s:folder] [options] [/u[/n]] [{PathName [...]] New recovery agent certificate: CIPHER /r:pathnamewithoutextension Remove data: CIPHER /w:pathname Backup Keys: CIPHER /x[:pathname] options: /e Encrypt the folders. Folders are marked so that files that are added to the folder later are encrypted too. /d Decrypt the folders. Folders are marked so that files that are added to the folder later are encrypted too.

6 /s:folder Performs the operation in the folder and all subfolders. /a Perform the operation for files and directories. /i Continue even after errors occur. By default, cipher stops when it encounters an error. /f Force the encryption or decryption of all specified objects. By default, cipher skips files that have been encrypted or decrypted already. /q Quiet - Report only essential information. /h Display files with hidden or system attributes. By default, these files are not encrypted or decrypted. /k Create a new file encryption key for the user running cipher. /u Update the user's file encryption key or recovery agent's key to the current ones in all of the encrypted files on local drives (that is, if the keys have been changed). This option only works with /n. /n Prevent keys from being updated. Use this option to find all of the encrypted files on the local drives. This option only works with /u. PathName A pattern, file, or folder. /r:pathnamewithoutextension Generate a new recovery agent certificate and private key, and then write them to files with the filename PathNameWithoutExtension.

7 /w:pathname Remove data from unused portions of a volume. PathName can indicate any directory on the desired volume. Cipher does not obtain an exclusive lock on the drive. This option can take a long time to complete and should only be used when necessary. /x[:pathname] PathNameWithoutExtension Identifies the certificates and private keys used by EFS for the currently logged on user and backs them up to a file. If PathName is provided, the certificate used to encrypt the files is backed up. Otherwise, the user's current EFS certificate and keys will be backed up. The certificates and private keys are written to a file name PathNameWithoutExtension plus the file extension.pfx. It is recommended that you always encrypt both the file and the folder in which it resides, this prevents an encrypted file from becoming decrypted when it is modified. Cipher cannot encrypt files that are marked as read-only. Cipher will accept multiple folder names and wildcard characters. You must separate multiple parameters with at least one space. The /W option will remove data on unused portions of a volume, effectively erasing data that still resides on a hard drive after deletion. See Q for a description of this. Examples List encrypted files in the reports folder: CIPHER c:\reports\* Encrypt the Reports folder and all subfolders: CIPHER /e /s:c:\reports Back up the certificate and private key currently used to encrypt and decrypt EFS files to a file: CIPHER /x c:\myefsbackup

8 CONVERT.exe Convert a FAT16 or a FAT32 DISK volume to NTFS. Syntax convert [Volume] /fs:ntfs [/v] [/cvtarea:filename] [/nosecurity] [/x] Key Volume convert to NTFS. The drive letter (followed by a colon), mount point, or volume name to /fs:ntfs Convert the volume to NTFS. Required. /v Run convert in verbose mode, which displays all messages during the conversion process. /cvtarea:filename Specifies that the Master File Table (MFT) and other NTFS metadata files are written to an existing, contiguous placeholder file. This file must be in the root directory of the file system to be converted. Use of the /cvtarea parameter can result in a less fragmented file system after conversion. For best results, the size of this file should be 1 KB multiplied by the number of files and directories in the file system, although the convert utility accepts files of any size. Important You must create the placeholder file by using the fsutil file createnew command prior to running convert. Convert does not create this file for you. Convert overwrites this file with NTFS metadata. After conversion, any unused space in this file is freed. /nosecurity The security settings on the converted files and directories allow access by all users. /x Dismount the volume, if necessary, before it is converted. Any open handles to the volume will no longer be valid.

9 /? Displays help at the command prompt. If convert cannot lock the drive (for example, the drive is the system volume or the current drive), you are given the option to convert the drive the next time you restart the computer. If you cannot restart the computer immediately to complete the conversion, plan a time to restart the computer and allow extra time for the conversion process to complete. For volumes converted from FAT or FAT32 to NTFS: Due to existing disk usage, the MFT is created in a different location than on a volume originally formatted with NTFS, so volume performance might not be as good as on volumes originally formatted with NTFS. For optimal performance, consider recreating these volumes and formatting them with the NTFS file system. Volume conversion from FAT or FAT32 to NTFS leaves the files intact, but the volume might lack some performance benefits compared to volumes initially formatted with NTFS. For example, the MFT might become fragmented on converted volumes. In addition, on converted boot volumes, convert applies the same default security that is applied during Windows Setup. Example Convert the volume on drive E: to NTFS and display all messages during the conversion process: C:\> convert e: /fs:ntfs /v

10 Defragment hard drive. DEFRAG Syntax DEFRAG <volume> [-a] [-f] [-v] [-?] Options volume drive letter or mount point (d: or d:\vol\mountpoint) -a Analyze only -f Force defragmentation even if free space is low -v Verbose output Example: DEFRAG c:

11 Configure IP (Internet Protocol configuration) Syntax IPCONFIG IPCONFIG /all Display full configuration information. IPCONFIG /release [adapter] Release the IP address for the specified adapter. IPCONFIG /renew [adapter] Renew the IP address for the specified adapter. IPCONFIG /flushdns Purge the DNS Resolver cache. IPCONFIG /registerdns Refresh all DHCP leases and re-register DNS names. IPCONFIG /displaydns Display the contents of the DNS Resolver Cache. IPCONFIG /showclassid adapter Display all the DHCP class IDs allowed for adapter. IPCONFIG /setclassid adapter [classid] Modify the dhcp class id.

12 If the Adapter name contains spaces, use quotes: "Adapter Name" Wildcard characters * and? Are allowed, see the examples below. The default is to display only the IP address, subnet mask and default gateway for each adapter bound to TCP/IP. For Release and Renew, if no adapter name is specified, then the IP address leases for all adapters bound to TCP/IP will be released or renewed. For setclassid, if no CLASS ID is specified, then the CLASS ID is removed. DHCP User Classes allow additional or modified DHCP options to be applied to a subset of computers on the network, as identified by a CLASS ID. For example, a different gateway, DNS server, or lease time. This requires configuring the CLASS ID appropriately on the DHCP server. see RFC 3004 Examples: Show detailed information C:\> ipconfig /all Renew all adapters: C:\> ipconfig /renew Renew any connection that has a name starting with EL: C:\> ipconfig /renew EL* Release all connections matching *Con*, eg. "Local Area Connection 1" or "Local Area Connection 2": C:\> ipconfig /release *Con* Set the DHCP class ID for the named adapter to TEST: C:\> ipconfig /setclassid "Local Area Connection" TEST

13 MEM Display memory usage. Available only in 32 bit systems. Syntax MEM MEM /C MEM /D MEM /P Key /P List programs in memory with the memory address and size of each. /D List Programs(as /P) and also Devices /C List programs in conventional memory and list programs in upper memory MEM will only display details about the current CMD shell environment, programs running in a separate shell (or WIN32 programs) will not be listed - so it won't tell you anything about total memory usage.

14 PING Test a network connection - if successful, ping returns the ip address. Syntax PING [options] destination_host Options -w timeout Timeout in milliseconds to wait for each reply, default= i TTL Time To Live. -v TOS Type Of Service. -a Resolve addresses to hostnames. -n count Number of echo requests to send. -t Ping the destination host until interrupted. To see statistics and continue type Control-Break; To stop type Control-C. -l size Send buffer size (default=32). -f Set don t Fragment flag in packet (IPv4-only). -r count Record route for count hops (IPv4-only). -s count Timestamp for count hops (IPv4-only). -j host_list Loose source route along host_list (IPv4-only). -k host_list Strict source route along host_list (IPv4-only). destination_host The name of the remote host -R Use routing header to test reverse route also (IPv6-only). -S srcaddr Source address to use. -4 Force using IPv4. -6 Force using IPv6. A response of "Request timed out" means there was no response within the default time period of 4 seconds. If the latency of the response is more than 4 seconds. Use the -w option to increase the time-out. For example, to allow responses within 10 seconds, use ping -w 10000

15 The IPv6 options are only available on versions of Windows that support IPv6, e.g. Windows 7 / A successful PING does NOT always return an %errorlevel% of 0. Therefore to reliably detect a successful ping - pipe the output into FIND and look for the text "TTL" Note that "Reply" in the output of PING does not always indicate a positive response. Example message: Reply from : Destination Net Unreachable. Ping response times below 10 milliseconds often have low accuracy. A time of 10 milliseconds is roughly equal to a distance of 1860 Miles, travelling a straight line route at the speed of light, (or a round trip of miles). From this you can see that ping response times will give a very very rough estimate of the distance to a remote host. Network adminstrators do not appreciate frequent or continual pings to their servers, try not to overdo it! How to test connectivity with ping: 1) Ping the loopback address to verify that TCP/IP is installed and configured correctly on the local computer. PING ) Ping the IP address of the local computer to verify that it was added to the network correctly. PING IP_address_of_local_host 3) Ping the IP address of the default gateway to verify that the default gateway is functioning and that you can communicate with a local host on the local network. PING IP_address_of_default_gateway 4) Ping the IP address of a remote host to verify that you can communicate through a router. PING IP_address_of_remote_host How to create a timed delay with ping: Create a delay of 1 or more seconds by pinging the loopback address ( ) multiple times. The delay between each ping is 1 second, so for a delay of 5 seconds ping 6 times: PING -n >nul In tests this consumes less processor time than Sleep or Timeout - see Clay Calvert's original newsgroup posting.

16 Examples Ping a server just once: PING -n 1 Server64 Check if a host is reachable: PING Server64 find "TTL=" && ECHO MyHost found Check if a host is not reachable: PING Server64 find "TTL=" ECHO MyHost not found Test which iscsi IP on a specific NIC is functioning or if a specific teamed NIC is operating as it should: Ping -S (Source IP: XXX.XXX.XXX.XXX) (Destination IP:XXX.XXX.XXX.XXX) Ping -S Ping a website 5 times: PING -n 5 -w Monitor a website (example.com) every 15 off Echo Logging ping responses, press CTRL-C to stop :start Ping -n 1 example.com find "TTL=" >>c:\pingtest.txt Echo. Ping -n >nul goto start The script above can be used to test an Internet connection, just replace example.com with your ISP's Default Gateway IP address. This represents the first physical device on the ISP's side of your connection. You can find the Default Gateway on your router status screen. PING is named after the sound that a sonar makes.

17 ROBOCOPY.exe Robust File and Folder Copy. By default Robocopy will only copy a file if the source and destination have different time stamps or different file sizes. Syntax ROBOCOPY Source_folder Destination_folder [files_to_copy] [options] Key file(s)_to_copy : A list of files or a wildcard. (defaults to copying *.*) Source options /S : Copy Subfolders. /E : Copy Subfolders, including Empty Subfolders. Examples: Simple copy of all files from one folder to another: ROBOCOPY \\Server1\reports \\Server2\backup Copy files including subfolders (even empty ones /E). If this command is run repeatedly it will skip any files already in the destination, however it is not a true mirror as any files deleted from the source will remain in the destination. ROBOCOPY \\Server1\reports \\Server2\backup *.* /E

Chapter 5: Trouble shooting of a network

5 Troubleshooting TCP/IP Fig 5 show trouble shooting a TCP/IP Chapter 5: Trouble shooting of a network Steps 1 First, determines whether your local host is properly configured. Step 2 Next, uses the ping