A set of useful commands for day-to-day sys admin activities.

Sys Admin Quickies.md

Kill Process Remotely

taskkill /IM dotnet.exe /u some-domain\some-user /p somePass /s SOME-MACHINE

Running as:

runas /netonly /user:some-domain\some-user "C:\foo.exe"

File & Directory

Fast Delete:

del /f/s/q node_modules > nul && rmdir /s/q node_modules

Fast Copy:

robocopy source destination /MT:25 /NP /NFL /NDL /E

• /MT    Use multiple threads.
• /NP    No Progress - don't display percentage copied.
• /NFL  No File List - don't log file names.
• /NDL  No Directory List - don't log directory names.
• /E     Copy Subfolders, including Empty Subfolders.

robocopy source destination /MIR /Z /XA:SH /R:2 /W:10 /LOG:C:\log.txt

• /MIR Make a mirror copy of the directory structure on the destination drive. Delete any files at the destination that are missing in the source.
• /Z Restartable, useful when working with unreliable networks.
• /XA:SH Exclude System and Hidden files when copying.
• /R:2 Retry 2 times before going to the next retry cycle.
• /LOG:C:\log.txt Log events to a text file. Useful for troubleshooting.

Count directory and sub-directories

dir /a:D /s /b C: | find /c "\"

Count files

dir /a:-D /s /b C: | find /c "\"

Output list of files

dir /a:-D /s /b C: > D:\files.lst

Search for a file:

where /R d:\ nuget.exe /F /T

• /R Recursively searches & displays the files matching the search pattern starting from the specified directory.
• /F Displays the matched filename in double quotes.
• /T Displays the file size, last modified date/time for all the matched files.

Search for a file or a directory:

dir /S "foo" /B /AD
dir /S nuget.exe /B /A-D

• /S     Display files in specified directory and all subdirectories.
• /B     Users bare format (no heading information or summary).
• /AD   Displays files that have the Directory attribute i.e. display directories.
• /A-D Displays files that do NOT have the Directory attribute i.e. display files only.
• /AH   Displays files that have the Hidden attribute i.e. display hidden files & directories.

Linux Commands

• ls View contents of directory (list)
• pwd Path of the current directory
• cd Change directory
• mkdir Make new directory
• mv Move/Rename files
• cp Copy files
• rm Remove files
• touch Create blank new file
• rmdir Delete directory
• cat List content of file to terminal
• clear Clear terminal window
• echo Move data into a file
• man Show manual of Linux commands
• sudo Enables you to perform tasks that require admin or root privileges
• top Task manager in terminal
• tar Used to archive multiple files into a tarball
• grep Used to searching words in specific files
• head View first lines of any text file
• tail View last lines of any text file
• diff Compares the contents of two files line by line
• kill Used for killing unresponsive program
• jobs Display all current jobs along with their statuses
• sort A utility for sorting lines of text files
• df Info about system disk
• du Check how much space a file or directory takes
• zip Compress your files into a zip archive
• unzip Extract the zipped files from a zip archive
• ssh A secure encrypted connection between two hosts over and insecure network
• cal Shows the calendar
• apt A tool for interaction with packaging system
• alias Custom shortcuts used to represent a command
• w Current user info
• whereis Used to locate the binary, source, manual page files
• whatis Used to get one-line man page description
• useradd Used to create a new user
• passwd Used to changing password of current user
• whoami Print current user
• uptime Print current time when machine starts
• free Print free disk space info
• history Print used commands history
• uname Print detailed information about your Linux system
• ping Check connectivity status to a server
• chmod Change permissions of files and directories
• chown Change ownership of files and directories
• find Searches for files and directories
• locate Locate a file, just like the search command in Windows
• ifconfig Print ip address stuff
• ip a Similar to ifconfig but shortest print
• finger Gives you a short dump of info about a user
• systemctl Manage system services
• journalctl View logs

Networking

Get network connections:

netstat -abno

• -a Displays all connections & listening ports
• -b Displays the executable involved in each connection/port
• -n Displays addresses & port numbers in numerical form
• -o Displays the owning PID associated with each connection

WMI

Get the details of the processes currently running:

wmic path win32_process get ProcessId,Caption,Commandline | clip

Get the details of a given process currently running:

wmic path Win32_PerfFormattedData_NETFramework_NETCLRMemory WHERE ProcessID=2072 GET * | clip

NETSH

Add URL reservation for Http.sys:

netsh http add urlacl url=http://+:8080/MyDashboard/ user="NT AUTHORITY\LOCAL SERVICE" listen=yes delegate=no

Note: Consider obtaining: HttpSysManager

Open Port through Firewall:

netsh advfirewall firewall add rule name="Open Port 8080 - MyDashboard" dir=in action=allow protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Open Port 8080 - MyDashboard" dir=out action=allow protocol=TCP localport=8080

MSTC

Start Remote Desktop as admin:

mstsc /admin

Find connected users to server foo:

cls & echo --- & quser /SERVER foo & echo --- & query session /server foo

Kick someone off from foo:

logoff 2 /V /SERVER foo

Alternatively:

Find the sessions:

qwinsta /server:foo

End the session:

rwinsta /server:foo foo-session-id

ProcDump

How to Create, Use, and Debug .NET application Crash Dumps in 2019

Common Arguments

• -e Write a dump when the process encounters an unhandled exception.
• -h Write dump if process has a hung window (does not respond to window messages for at least 5 seconds).
• -ma Write a dump file with all process memory. The default dump format includes thread and handle information.
• -x Launch the specified application

---

Listening for First Chance Exceptions:

procdump -ma -e 1 -f E0434352.CLR <pid>

• -e 1 -- First chance exceptions.
• -f E0434352.CLR -- Filter managed exceptions.

Launch an application with ProcDump and collect a dump with heap when the process crashes:

C:\>procdump –e –ma –x -g crash.dmp C:\Dumps "C:\My Applications\CrashingApp.exe"

Attach to an application that is hung and collect a dump with heap immediately:

C:\>procdump –ma HangingApplication.exe hang.dmp

Launch an application with ProcDump and collect a dump with heap when process either crashes or hangs

C:\procdump –e –h –ma -g –x C:\Dumps "C:\My Applications\Application1.exe"

Active Directory

Getting memebers of a given group MyGroup:

https://stackoverflow.com/a/46079714/1226568
Import-Module ActiveDirectory
Get-ADGroup "MyGroup" -Properties Member | Select-Object -Expand Member | Get-ADUser -Property Name, DisplayName

Update Machine DateTime with Domain Controller:

NET TIME /domain:MyDomain /SET /Y

PowerShell

Delete directory foo:

Remove-Item foo -Recurse -Force

Chrome

Override NTLM Chrome:

chrome.exe -–auth-server-whitelist=”184.7.121.8” -–auth-negotiate-delegatewhitelist=”184.7.121.8” -–auth-schemes=”digest,ntlm,negotiate”

Chrome Re-Enable:

HKEY_LOCAL_MACHINE/software/policies/google/chrome
Just delete the whole folder (../chrome) and all the restrictions will be removed
if you want to adjust some of them and not totally remove them, see this: 
http://www.chromium.org/administrators/policy-list-3

Windows Memory

Private Bytes: The amount of memory the process has asked for (both physical and virtual) which is not necessarily the amount it is actually using e.g. the amount can be shared between other processes.

Working Set: The total physical memory (RAM) used by the process. However this amount includes various different resources that can report less accurate measurement of the amount of memory used by the process. FYI, this is the same value reported by the Task Manager.

Virtual Bytes: Total Virtual Address Space used by the process. This basically includes Working Set plus the data that has already been paged out and sitting on the disk in a page file. So depending on how long the process has been running, the number of page faults and what the application is doing, this amount can be much larger than the amount of the RAM the machine has.

In summary, monitoring Private Bytes gives the most accurate overall result. What a high Virtual Bytes can tell us is that there are a high number of pagefaults on the process which on itself is not a big deal but it can be something that needs to be investigated.

Setting up proxy for Git & NPM

Note: Setting up this secion affects NuGet; Remember to always let the Fiddler running in the background.

1. Install and start Telerik Fiddler
2. Ensure port 8888 is specified in Tools -> Options -> Connections -> Fiddler listens on port: 8888
3. Set up Fiddler as reverse proxy

setx HTTP_PROXY "http://127.0.0.1:8888"
setx HTTPS_PROXY "http://127.0.0.1:8888"

Configure NPM

npm config set registry http://internal npm registry
npm config set proxy http://127.0.0.1:8888
npm config set https-proxy http://127.0.0.1:8888
npm config set strict-ssl false
npm config set cache "c:\\caches\\npm-cache
npm config set prefix "c:\\caches\\npm

Configure Git

git config --global http.proxy http://127.0.0.1:8888
git config --global https.proxy http://127.0.0.1:8888
git config --global http.sslVerify false
git config --global url."https://github".insteadOf git://github

Photo Editing

• PhotoPea

Stuff to watch:

• Sysinternals video library

Stuff to get:

• Dependency Walker
• dnSpy
• ILSpy
• Hawk Eye
• Win Dir Stat
• Memo Scope.NET
• SuperDump
• CodeTrack
• TailBlazer
• Cmder
• DebugDiag
• NETworkManager
• PerfView