Remote Command Line - Example Commands

Move or rename file

move myfile.txt myfilemoved.txt

Copy file

copy myfile.txt

Delete file

del myfile.txt

View contents of file

type myfile.txt

List Directory Contents

dir

/p (pause after each screen of data) and /w or /d (column formats) not currently supported

List Directory Tree

tree /a

Must use "/A", ascii option, for tree to be displayed correctly

Find file

dir /s /b iexplore.exe

Map network drive

net use S: \\fileshare01\shares

This will only map the drive for the session and user context under which the Agent is running (by default Local System Account). The "/PERSISTENT" switch will make the mapping permanent (but again only for Local System Account). Running commands as a different user is being investigated.

List running processes

tasklist

Kill process by ID

taskkill /PID 4064

Kill process by Name

taskkill /IM notepad.exe

List running services

net start

List status of particular service

sc query "Spooler"

Note that the "sc" query command requires the service "key" name not the display name this can be retrieved from the display name using the "sc GetKeyName" command for example: sc GetKeyName "Print Spooler"

List installed but stopped services

sc query type= service state= inactive

Start a service

net start "Print Spooler"

Stop a service

net stop "Print Spooler"

Shutdown device

shutdown /s /t 600 /c "Maintenance"

/i and /l flags are not supported

Restart device

shutdown /r /f /c "Maintenance"

Cancel shutdown

shutdown /a

During timeout period only

Find Registry Key

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Themes

Find particular Registry Key value

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Themes /v InstallTheme

Update value of Key

reg add HKEY_LOCAL_MACHINE\SOFTWARE\SomeApp /f /v Path /t REG_SZ /d "c:\someApp"

/f is optional without it you will be prompted for confirmation when editing an existing value

Delete Key

reg delete HKEY_LOCAL_MACHINE\SOFTWARE\SomeApp /f /v Path

/f optional as above

Delete particular value

reg delete HKEY_LOCAL_MACHINE\SOFTWARE\SomeApp

Install via MSI

msiexec /i c:\path\installer.msi /quiet /qn /norestart /log c:\msi.log

Note that in some cases the msiexec command may return immediately, but the install continues in the background.

Programs that install using .exe files may be supported if they provide suitable silent installation flags/