Category Archives: Windows knowhow

Howto do some things in Windows

Windows knowhow

Windows: Enable or disable Features from command line

2 Comments

Hi,

some usefull tools like telnet.exe are disabled by default in Windows Vista and later version. You can enable this and other features by command line using dism.
dism called with the get-features parameter lists all available features and its current state.
Note: Featurenames are case sensitive.
C:\>dism /online /Get-Features

.....
Feature Name : TelnetServer
State : Disabled

Feature Name : TelnetClient
State : Enabled
......

and the Enable-Feature option install them
Continue reading Windows: Enable or disable Features from command line →

Windows, Windows knowhow

Windows: NTFS symbolic links and hard links

Leave a comment

Hi,

today I will explain the possiblity of the ntfs filesystem to create symbolic- and hardlinks.

Whats the difference? A symbolic link (File) or junction point (Directory) is a pointer to an existing file or directory. These works across volumes.
A hardlink is a file or directory which is referenced by more then one path on the same volume.

An example. The explorer.exe in c:\windows. The most Windows system files are hardlinks. These files have two of them. One in the Windows, respective system32 folder and one to its current version in the component store winsxs.

[C:\]fsutil hardlink list c:\Windows\explorer.exe
\Windows\explorer.exe
\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe

this means the file is stored once and there are two references in the filesystem to it.
With the dir command you cannot identify an hardlink. The only way is fsutil.exe.

Creating an hardlink is very easy. Continue reading Windows: NTFS symbolic links and hard links →

Windows, Windows knowhow

Windows: Show and configure network settings using netsh

3 Comments

Hi,

here is a set of netsh command lines which I use very often.

Show Interface configuration

netsh interface ipv4 show config

Only IP Addresses of all LAN adapters

netsh interface ipv4 show address

Show global TCP/IP Parameters

netsh interface ipv4 show global

Disable and enable a Interface

netsh int set int name="ethernet" admin=disabled
netsh int set int name="ethernet" admin=enabled

Show all network  interfaces and its link state

netsh interface ipv4 show interfaces
Continue reading Windows: Show and configure network settings using netsh →

Windows knowhow

Windows: Passing parameters to event triggered schedule tasks

15 Comments

Hi,

this week I had the problem on a Windows Server 2008 R2 system that I had to recognize if a network connection to specific closed TCP port is tried to established.

The Windows firewall on the machine is running but logs only packets to the firewall  logfile for tcp and udp ports an which a process is listen to. Also the parsing of the logfile is frequently necessary.

A better way is to enable the firewall audit option “Filtering Platform Packet Drop”. This generates an EventLog entry with EventID 5152 for each incoming packet which is dropped. Windows provides the abiltiy to trigger an schedule task after an eventlog entry is written and pass some event details as parameter to a script defined in the task.  Unfortunataly not with the GUI.
Continue reading Windows: Passing parameters to event triggered schedule tasks →

Windows knowhow

Windows: Set permissions on a service

4 Comments

Hi,

when it is necessary that normal user needs the ability to do some operations on a service, such as starting or stopping, multiple ways exists to grant these permissions. Windows has no GUI or (easy to use) command line tool on board to set these access rights. I will show you 3 ways to set them.

  • Sysinternals Process Explorer
  • sc.exe (Service controller)
  • subinacl.exe (The security swiss knife)

For the following examples I will use the OpenVPN Service with its Service Name openvpnservice and assign the start and stop permissions to a user or group. But its the same procedure for all other services.

The easiest way is to use the sysinternals Process Explorer. It provides a graphical user interface but  has the dependency that the service must be in the running state before process explorer is started. If you already have a valid openvpn configuration start the service:

sc start openvpnservice

Then start the process explorer as administrator and locate the openvpn service process openvpnserv.exe.

Openvpn Process
Openvpn Process

Continue reading Windows: Set permissions on a service →