Advanced System Administrator Commands

ASSOC

Most files in Windows are associated with a specific program that is assigned to open the file by default. At times, remembering these associations can become confusing. You can remind yourself by entering the command “assoc” to display a full list of file extensions and the programs they’re connected with.

You can also extend the command to change file associations. For example, “assoc .txt=” will change the file association for text files to whatever program you enter after the equal sign. The ASSOC command itself will reveal both the extension names and program names, which will help you properly use this command. You can probably do this more easily in the GUI, but the command line interface is a perfectly functional alternative.

Cipher

Deleting files on a mechanical hard drive doesn’t really delete them at all. Instead, it marks the files as no longer accessible and the space they took up as free. The files remain recoverable until they’re overwritten with new data, which can take some time.

The cipher command, however, can be used to wipe a directory by writing random data to it. To wipe your C drive, for example, you’d use the command “cipher /w:c”, which will wipe free space on the drive. The command does not overwrite undeleted data, so you will not wipe out files you need by running this command.

There’s also a host of other cipher commands, however, they are generally redundant with Bitlocker enabled versions of Windows.

Driverquery

Drivers remain among the most important software installed on a PC.Improperly configured or missing drivers can cause all sorts of trouble, so its good to have access to a list of what’s on your PC. That’s exactly what the “driverquery” command does. You can extend it to “driverquery -v” to obtain more information including the directory in which the driver is installed.

File Compare

This command can be used to identify differences in text between two files, and is particularly useful for writers and programmers trying to find small changes between two versions of a file. Simply type “fc” and then the directory path and file name of the two files you want to compare.

You can also extend the command in several ways. Typing “/b” compares only binary output, “/c” disregards the case of text in the comparison, and “/l” only compares ASCII text.

So, for example, you could use the following:

fc /l "C:\Program Files (x86)\example1.doc" "C:\Program Files (x86)\example2.doc"

to compare ASCII text in two word documents.

Ipconfig

This command relays the IP address that your computer is currently using. However, if you’re behind a router (like most computers today), you’ll instead receive the local network address of the router.

Still, ipconfig is useful because of its extensions. “ipconfig /release” followed by “ipconfig /renew” can force your Windows PC into asking for a new IP address, which is useful if your computer claims one isn’t available. You can also use “ipconfig /flushdns” to refresh your DNS address. These commands are great if the Windows network troubleshooter chokes, which does happen on occasion.

Netstat

Entering the command “netstat -an” will provide you with a list of currently open ports and related IP addresses. You’ll also be told what state the port is in – listening, established or closed. This is a great command if you’re trying to troubleshoot the devices your PC is connected to or you’re afraid you’re infected with a Trojan and are trying to locate a malicious connection.

Ping

Sometimes, you need to know whether or not packets are making it to a specific networked device. That’s where ping comes in handy. Typing “ping” followed by an IP address or web domain will send a series of test packets to the specified address. If they arrive and are returned, you know the device is capable of communicating with your PC; if it fails, you know that there’s something blocking communication between the device and your computer. This can help you decide if an issue is caused by improper configuration or a failure of network hardware.

Pathping

This is a more advanced version of ping that’s useful if there are multiple routers between your PC and the device you’re testing. Like ping, you use this command by typing “pathping” followed by the IP address, but unlike ping, pathping also relays some information about the route the test packets take.

Tracert

The “tracert” command is similar to pathping. Once again, type “tracert” followed by the IP address or domain you’d like to trace. You’ll receive information about each step in the route between your PC and the target. Unlike pathping, however, tracert also tracks how much time (in milliseconds) each hop between servers or devices takes.

Powercfg

Powercfg is a very powerful command for managing and tracking how your computer uses energy. You can use the command “powercfg /hibernate on” and “powercfg /hibernate off” to manage hibernation, and you can also use the command “powercfg /a” to view the power-saving states currently available on your PC.

Another useful command is “powercfg /devicequery s1_supported” which displays a list of devices on your computer that support connected standby. When enabled, these devices can be used to bring your computer out of standby – even remotely. You can enable this by selecting the device in Device Manager, opening its properties, going to the Power Management tab and then checking the “Allow this device to wake the computer” box.

“Powercfg /lastwake” will show you what device last woke your PC from a sleep state. You can use this command to troubleshoot your PC if it seems to wake from sleep at random.

The “powercfg /energy” command can be used to build a detailed power consumption report for your PC, which is output to a directory indicated after the command finishes. This report will let you know of any system faults that might increase power consumption, like devices that are blocking certain sleep modes, or which aren’t properly configured to respond to your power management settings.

Windows 8 added “powercfg /batteryreport”, which provides a detailed analysis of battery use, if applicable. Normally output to your Windows user directory, the report provides details about the time and length of charge and discharge cycles, lifetime average battery life, and estimated battery capacity.

Shutdown

As of Windows 8/8.1 there is now a shutdown command that – you guessed it! – shuts down your computer. This is of course redundant with the already easily accessed shutdown button, but what’s not redundant is the “shutdown /r /o” command, which restarts your PC and launches the Advanced Start Options menu, which is where you can access Safe Mode and Windows recovery utilities. This is useful if you want to restart your computer for troubleshooting purposes.

System File Checker

System File Checker is an automatic scan and repair tool that focuses on Windows system files. You will need to run the command prompt with administrator privileges and enter the command “sfc /scannow”. If any corrupt or missing files are found, they’ll be automatically replaced using cached copies kept by Windows for just that purpose. The command can require a half-hour to run on older notebooks.

Recovery Image

Virtually all Windows 8/8.1 computers ship from the factory with a recovery image, but the image may include bloatware you’d rather not have re-installed. Once you’ve un-installed the software you can create a new image using the “recimg” command. Entering this command presents a very detailed explanation of how to use it. You must have administrator privileges to use the recimg command, and you can only access the custom recovery image you create via the Windows 8 “refresh” feature.

Tasklist

The “tasklist” command can be used to provide a current list of all tasks running on your PC. Though somewhat redundant with Task Manager, the command may sometimes find tasks hidden from view in that utility.

There’s also a wide range of modifiers. “Tasklist -svc” shows services related to each task, “tasklist -v” can be used to obtain more detail on each task, and “tasklist -m” can be used to locate .dll files associated with active tasks. These commands are useful for advanced troubleshooting.

Taskkill

Tasks that appear in the “tasklist” command will have an executable and process ID (a four-digit number) associated with them. You can force stop a program using “taskkill -im” followed by the executable’s name, or “taskkill -pid” followed by the process ID. Again, this is a bit redundant with Task Manager, but may be used to kill otherwise unresponsive or hidden programs.

10 Windows 7 commands every administrator should know

1: System File Checker

Malicious software will often attempt to replace core system files with modified versions in an effort to take control of the system. The System File Checker can be used to verify the integrity of the Windows system files. If any of the files are found to be missing or corrupt, they will be replaced. You can run the System File Checker by using this command:

sfc /scannow

2: File Signature Verification

One way to verify the integrity of a system is to make sure that all the system files are digitally signed. You can accomplish this with the File Signature Verification tool. This tool is launched from the command line but uses a GUI interface. It will tell you which system files are signed and which aren't. As a rule, all the system files should be digitally signed, although some hardware vendors don't sign driver files. The command used to launch the File Signature Verification tool is:

sigverif

3: Driverquery

Incorrect device drivers can lead to any number of system problems. If you want to see which drivers are installed on a Windows 7 system, you can do so by running the driverquery tool. This simple command-line tool provides information about each driver that is being used. The command is:

driverquery

If you need a bit more information, you can append the -v switch. Another option is to append the -si switch, which causes the tool to display signature information for the drivers. Here's how they look:

driverquery -v

driverquery -si

4: Nslookup

The nslookup tool can help you to verify that DNS name resolution is working correctly. When you run nslookup against a host name, the tool will show you how the name was resolved, as well as which DNS server was used during the lookup. This tool can be extremely helpful when troubleshooting problems related to legacy DNS records that still exist but that are no longer correct.

To use this tool, just enter the nslookup command, followed by the name of the host you want to resolve. For example:

nslookup dc1.contoso.com

5: Ping

Ping is probably the simplest of all diagnostic commands. It's used to verify basic TCP/IP connectivity to a network host. To use it, simply enter the command, followed by the name or IP address of the host you want to test. For example:

ping 192.168.1.1

Keep in mind that this command will work only if Internet Control Message Protocol (ICMP) traffic is allowed to pass between the two machines. If at any point a firewall is blocking ICMP traffic, the ping will fail.

6: Pathping

Ping does a good job of telling you whether two machines can communicate with one another over TCP/IP, but if a ping does fail, you won't receive any information regarding the nature of the failure. This is where the pathping utility comes in.

Pathping is designed for environments in which one or more routers exist between hosts. It sends a series of packets to each router that's in the path to the destination host in an effort to determine whether the router is performing slowly or dropping packets. At its simplest, the syntax for pathping is identical to that of the ping command (although there are some optional switches you can use). The command looks like this:

pathping 192.168.1.1

7: Ipconfig

The ipconfig command is used to view or modify a computer's IP addresses. For example, if you wanted to view a Windows 7 system's full IP configuration, you could use the following command:

ipconfig /all

Assuming that the system has acquired its IP address from a DHCP server, you can use the ipconfig command to release and then renew the IP address. Doing so involves using the following commands:

ipconfig /release

ipconfig /renew

Another handy thing you can do with ipconfig is flush the DNS resolver cache. This can be helpful when a system is resolving DNS addresses incorrectly. You can flush the DNS cache by using this command:

ipconfig /flushdns

8: Repair-bde

If a drive that is encrypted with BitLocker has problems, you can sometimes recover the data using a utility called repair-bde. To use this command, you will need a destination drive to which the recovered data can be written, as well as your BitLocker recovery key or recovery password. The basic syntax for this command is:

repair-bde <source> <destination> -rk | rp <source>

You must specify the source drive, the destination drive, and either the rk (recovery key) or the rp (recovery password) switch, along with the path to the recovery key or the recovery password. Here are two examples of how to use this utility:

repair-bde c: d: -rk e:\recovery.bek

repair-bde c: d: -rp 111111-111111-111111-111111-111111-111111

9: Tasklist

The tasklist command is designed to provide information about the tasks that are running on a Windows 7 system. At its most basic, you can enter the following command:

tasklist

The tasklist command has numerous optional switches, but there are a couple I want to mention. One is the -m switch, which causes tasklist to display all the DLL modules associated with a task. The other is the -svc switch, which lists the services that support each task. Here's how they look:

tasklist -m

tasklist -svc

10: Taskkill

The taskkill command terminates a task, either by name (which is referred to as the image name) or by process ID. The syntax for this command is simple. You must follow the taskkill command with -pid (process ID) or -im (image name) and the name or process ID of the task that you want to terminate. Here are two examples of how this command works:

taskkill -pid 4104

taskkill -im iexplore.exe

7-layer OSI MODEL

The OSI (Open System Interconnection) model is developed by ISO in 1984 to provide a reference model for the complex aspects related to network communication. It divides the different functions and services provided by network technology in 7 layers. This facilitates modular engineering, simplifies teaching and learning network technologies, helps to isolate problems, and allows vendors to focus on just the layer(s) in which their hardware or software is implemented and enables them to create products that are compatible, standardized, and interoperable.

The diagram below shows the 7 layers of the OSI Model. To remember them in the correct order, a common mnemonic is often used: All People Seem To Need Data Processing.

Host A		Host B

The Application, Presentation and Session layers are known as the Upper Layers and are implemented in software. The Transport and Network layer are mainly concerned with protocols for delivery and routing of packets and are implemented in software as well. The Data Link is implemented in hard- and software and the Physical layer is implemented in hardware only, hence its name. These lower two layers define LAN and WAN specifications. A more detailed description of each layer follows below, but here's what basically happens when data passes from Host A to Host B:

1. the Application, Presentation and Session layer take user input and converts it into data,
2. the Transport layer adds a segment header converting the data into segments,
3. the Network layer adds a network header and converts the segments into packets / datagrams,
4. the Data Link layer adds a frame header converting the packets/datagrams into frames,
5. the MAC sublayer converts the frames into a bits, which the Physical layer can put on the wire.

The steps are known as the 5 steps of data encapsulation. When the bits stream arrives at the destination, the Physical layer takes it of the wire and converts it into frames, each layer will remove their corresponding header while the data flows up the OSI model until it is converted back to data and presented to the user. This is also known as decapsulation.


APPLICATION (LAYER 7)

The Application layer provides network services directly to the user's application such as a web browser or email client. This layer is said to be "closest to the user". Protocols that operate on this layer include TELNET, HTTP, FTP, TFTP, SMTP, and NTP.


PRESENTATION (LAYER 6)

The Presentation layer 'represents' the data in a particular format to the Application layer. It defines encryption, compression, conversion and other coding functions. Examples of specifications defined at this layer are GIF, JPEG, MPEG, MIME, and ASCII.


SESSION (LAYER 5)

The Session layer establishes, maintains, and terminates end-to-end connections (sessions) between two applications on two network nodes. It controls the dialogue between the source and destination node, which node can send when and for how long. It also provides error reporting for the Application, Presentation and Session layer. Examples of protocols/API's that operate on this layer are RPC and NETBIOS.


TRANSPORT (LAYER 4)

The Transport layer converts the data received from the upper layers into segments and prepares them for transport. The Transport layer is responsible for end-to-end (source-to-destination) delivery of entire messages. It allows data to be transferred reliably and uses sequencing to guarantee that it will be delivered in the same order that it was sent. It also provides services such as error checking and flow control (in software). Examples of protocols that operate on this layer are TCP, UDP, NETBEUI, and SPX.

The above Transport layer protocols are either connectionless or connection-oriented:

Connection-oriented means that a connection (a virtual link) must be established before any actual data can be exchanged. This guarantees that data will arrive, and in the same order as it was sent. It guarantees delivery by sending acknowledgements back to the source when messages are received. TCP is an example of a connection-oriented transport protocol.

A common example of connection-oriented communication is a telephone call. You call, the 'destination' picks up the phone and acknowledges, and you start talking (sending data). When a message or a piece of it doesn't arrive, you say: "What!?" and the sender will repeat what he said (retransmit the data).

Connectionless is the opposite of connection-oriented; the sender does not establish a connection before it sends data, it just sends it without guaranteeing delivery. UDP is an example of a connectionless transport protocol.


NETWORK (LAYER 3)

The Network layer converts the segments from the Transport layer into packets (or datagrams) and is responsible for path determination, routing , and the delivery of packets across internetworks. The network layer treats these packets independently, without recognizing any relationship between those individual packets. It relies on higher layers for reliable delivery and sequencing.

The Network layer is also responsible for logical addressing (also known as network addressing or Layer 3 addressing) for example IP addressing. Examples of protocols defined at this layer are IP, IPX, ICMP, RIP, OSPF, and BGP. Examples of devices that operate on this layer are layer-3 switches and routers. The latter includes WAPs with built-in routing capabilities (wireless access routers).


DATA LINK (LAYER 2)

The Data Links provides transparent network services to the Network layer so the Network layer can be ignorant about the underlying physical network topology. It is responsible for reassembling bits, taken of the wire by the Physical layer, to frames, and makes sure they are in the correct order and requests retransmission of frames in case an error occurs. It provides error checking by adding a CRC to the frame, and flow control. Examples of devices that operate on this layer are switches, bridges, WAPs, and NICs.

IEEE 802 Data Link sub layers

Around the same time the OSI model was developed, the IEEE developed the 802-standards such as 802.5 Token Ring and 802.11 for wireless networks. Both organizations exchanged information during the development, which resulted in two compatible standards. The IEEE 802 standards define physical network components such as cabling and network interfaces, and correspond to the Data Link and/or Physical layer of the OSI model. The IEEE refined the standards and divided the Data Link layer into two sublayers: the LLC and the MAC sublayer.

- LLC sublayer

LLC is short for Logical Link Control. The LLC layer is the upper sublayer of the Data Link layer and is defined in the IEEE 802.2 standard. LLC masks the underlying physical network technologies by hiding their differences to provide a single interface to the Network layer. The LLC sublayer uses Source Service Access Points (SSAPs) and Destination Service Access Points (DSAPs) to help the lower layers communicate with the Network layer protocols, acting as an intermediate between the different network protocols (IPX, TCP/IP, etc.) and the different network technologies (Ethernet, Token Ring, etc.). Additionally, this layer is responsible for sequencing and acknowledgements of individual frames.

- MAC sublayer

The Media Access Control layer takes care of physical addressing and allows upper layers access to the physical media, handles frame addressing, error checking. This layer controls and communicates directly with the physical network media through the network interface card. It converts the frames into bits to pass them on to the Physical layer who puts them on the wire (and vice versa). IEEE LAN standards such as 802.3, 802.4, 802.5, and 802.11 define standards for the MAC sublayer as well as the Physical layer.


PHYSICAL (LAYER 1)

This layer communicates directly with the physical media. It is responsible for activating, maintaining and deactivating the physical link. It handles a raw bits stream and places it on the wire to be picked up by the Physical layer at the receiving node. It defines electrical and optical signaling, voltage levels, data transmission rates, as well as mechanical specifications such as cable lengths and connectors, the amount of pins and their functions. Examples of devices that operate on this layer are hubs/concentrators, repeaters, NICs, WAPs, and LAN and WAN interfaces such as RS-232, OC-3, BRI, and antennas.

Ethernet Media Standards Ethernet, Fast Ethernet and Gigabit Ethernet, are identified by three-part names, which is also known as Media Standard. An example of Media Standard is 10BASE-T. The first part of the Media Standard specifies the transmission speed (10, in this case specifies 10 Mbps) The second part of the name "BASE" specifies that the Ethernet signal is a Basebandsignal. The final part of the Ethernet Media Standard specifies the kind of cable used. Here "T" specifies twisted-pair cable. The following table shows the common Ethernet Media Standards. Media Standard Cable Type Bandwidth Capacity Maximum Length 10Base2 Coax 10 Mbps 185m 10Base5 Coax 10 Mbps 500m 10BaseT UTP (CAT 3 or higher) 10 Mbps 100m 100BaseTX UTP (CAT 5 or higher) 100 Mbps 100m 10BaseFL Fibre Optic 10 Mbps 2Km 100BaseFX Fibre Optic 100 Mbps HD 400m/FD 2km 1000BaseT UTP (CAT 5e or higher) 1 Gbps (1000 Mbps) 100m 1000BaseSX Fibre Optic 1 Gbps (1000 Mbps) MMF 550m 1000BaseLX Fibre Optic 1 Gbps (1000 Mbps) MMF 500m/SMF 10km 1000BaseCX Fibre Optic 1 Gbps (1000 Mbps 100m 10GbaseSR Fibre Optic 10 Gbps 300m 10GbaseLR Fibre Optic 10 Gbps SMF 10km

IEEE 802 Standards

The IEEE 802 Standards comprises a family of networking standards that cover the physical layer specifications of technologies. The following tables show the most popular IEEE 802 Standards.

Standard	Description
802.1	Internetworking
802.2	Logical link control
802.3	Ethernet
802.4	Token bus
802.5	Token ring
802.6	Metropolitan area network (MAN)
802.7	Broadband technology
802.8	Fiber-optic technology
802.9	Voice and data integration
802.10	Network security
802.11	Wireless networking
802.12	Demand priority networking

Ethernet Standards

Standard	Description
802.3	Ethernet CSMA /CD (10 Mbps)
802.3u	Fast Ethernet (100 Mbps)
802.3z	Gigabit Ethernet over fiber-optic cabling or coaxial cabling
802.3ab	Gigabit Ethernet over twisted-pair cabling
802.3ae	10-Gigabit Ethernet