WMIC command sorting

Cutting-edge: WMIC commands in our work can help us reduce our reliance on other tools and save our time. It is really worth learning and researching, here, I have sorted out some of the more practical commands available on the Internet. I hope that you can find what you need and use the detailed commands. For details, refer to Microsoft's help. http://technet.microsoft.com/zh-cn/library/cc779482 (WS.10 ). aspx ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Obtain the system Version information wmic datafile where Name = 'C: \ windows \ mongoer.exe 'get Manufacturer, Version, Filename to obtain the system process wmic process list full note: here, full can also be replaced with brief (concise) to obtain hardware information (here, the cpu is used as an example) wmic cpu get name, caption, maxclockspeed, description will output the result to the 1.txt of the d Drive wmic/output: D: \ 1.txt cpu get name wmic get hard disk fixed partition drive letter: wmic logicaldisk where "drivetype = 3" get name wmic get hard disk each partition file system and available space: wmic logicaldisk where "drivetype = 3" get name, f Ilesystem, freespace wmic get process name and executable path: wmic process get name, executablepath wmic Delete specified process (based on process name ): wmic process where name = "qq.exe" call terminate or use wmic process where name = "qq.exe" delete wmic to delete a specified process (based on the process PID ): wmic process where pid = "123" delete wmic create new process wmic process call create "C: \ Program Files \ Tencent \ QQ \ QQ.exe" create a new process on a remote machine: wmic/node: 192.168.1.10/user: administrator/password: 123456 process call Create cmd.exe disable the Local Computer wmic process call create shutdown.exe restart the remote computer wmic/node: 192.168.1.10/user: administrator/password: 123456 process call create "shutdown.exe-r-f-m" change computer name wmic computersystem where "caption = '% ComputerName %'" call rename newcomputername change account name wmic USERACCOUNT where "name =' % UserName % '"call rename newUserName wmic ends suspicious processes (based on the process startup path) wmic process where "namepolic'cmder.exe 'and ex Ecutablepath <> '% SystemDrive % \ windows \ javaser.exe' "delete wmic get physical memory wmic memlogical get TotalPhysicalMemory | find/I/v" t "wmic get file creation and access, modification time @ echo off 'wmic datafile where name ^ = "c: \ windows \ system32 \ notepad.exe "get CreationDate ^, LastAccessed ^, lastModified wmic searches for a file and obtains the wmic datafile where "FileName = 'qq' and extension = 'exe '" get drive, pathfor/f "skip = 1 tokens = 1 *" % I in ('wmic data File where "FileName = 'qq' and extension = 'exe '" get drive ^, path') do (set "qPath = % I % j" & @ echo % qPath :~ 0,-3%) obtain the screen resolution wmic publish topmonitor where Status = 'OK' get ScreenHeight, ScreenWidth get shared resources (including hidden sharing) WMIC share list brief receives the udisc and runs the qq.exe @ for/f "skip = 1 tokens = *" % I in ('wmic logicaldisk where "drivetype = 2" get name ') do (if not "% I" = "" start d: \ qq.exe) obtains the memory occupied by the process and the maximum memory occupied by the process: wmic process where caption1_'filename.exe 'get WorkingSetSize, peakWorkingSetSize: change the existing workgroup to the specified workgroup wmic computersystem Where "n Ame = 'computer name' call UnjoinDomainOrWorkgroup exit the domain wmic computersystem Where "name = 'computer name'" call joindomainorworkgroup "", 1, "Domain name", "domain administrator password ", "domain administrator username "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ Open 2003 wmic rdtoggle where ServerName = '% COMPUTERNAME %' callSetAllowTSConnections 1 Remote Desktop wmic/node: % pcname %/USER: % pcaccount % PATH win32_terminalservicesetting WHERE (_ Class! = "") CALL SetAllowTSConnections 1 to add a scheduled task. The same AT command added by wmic can also be seen in wmic job call create "sol.exe", true, false, * ****** 154800.000000 + 480 wmic job call create "sol.exe, * ******* the 154600.000000 + 480 statements are the same. TRUE can be expressed as 1, and FALSE can be expressed as 0. What are the eight asterisks used before the time, this is a feature of WMIC. The display time is YYYYMMDDHHMMSS. MMMMMM + time zone, however, we do not need to specify the year and month with the day, therefore, the * Asterisk is used to check the BIOS information in wmic. wmic bios list full wmic has the function of stopping, pausing, and running the service: starting the service startservice and stopping the service stopservi. Ce to suspend the service pauseservice. The specific command format is: wmic Service where caption = "windows time" call stopservice ● -- stop the Service wmic Service where caption = "windows time" call startservice ● -- start the Service wmic Service where name = "w32time" call stopservice ● -- stop the service, note the differences between name and caption. Remote wmic/node: 109.254.2.102/user: "rdgad \ administrator"/password: "1234" process call create commandline = "cmd.exe/k echo xxxxx | clip.exe"