curriculum Q syntax

reg export hklm HKLMexport | reg export hkcr HKCRexport

reg query hklm\software\7-zip /ve

Windows prefetching; 0×3 refers to what?

applaunch and boot enabled (optimal and default)

hklm\system\currentcontrolset\enum\usb

reg query <partial path> /f <search term> /s /k

/k for only searching within key names (leave off if searching for key values)

reg query “hklm\software\microsoft\windows nt\currentversion” /f buildguid /s

reg add “hklm\system\currentcontrolset\control\session manager\memory management\prefetchparameters” /v EnablePrefetcher /t reg_dword /d 0×0

reg query “hklm\software\mozilla\mozilla firefox”

reg add hkcu\software\microsoft\windows\currentversion\run /v script.bat /t reg_sz /d C:\Users\<user>\script.bat

wmic useraccount where name="username" get sid

wmic useraccount where “fullname like ‘<firstname>%’” get name

net user <username> /passwordchg:no

dir C:\ /b /s | find /i “.log”

find a file by name

icacls C:\<path_to_folder>

showing file/folder permissions

icacls c:\<path_to_folder> /grant user1:(W) /grant “group 1”:(W) /grant Everyone:(R)

setting multiple user/group permissions for a folder

net share Test=C:\Users\user1\Desktop\testfolder /grant:Everyone,full

creating a previously nonexistent share over SMB and giving full control permissions to everyone

net share <share_name>

view the permissions set for a share

auditpol /get /category:*

show all audit policies

eventvwr.msc or eventvwr.exe

open Event Viewer GUI

auditpol /set /subcategory:Logon /success:enable /failure:enable

wevtutil qe Security “/q:*[System[TimeCreated[timediff(@SystemTime) <= 1800000]]]”

netsh advfirewall firewall add rule name=”No Out HTTPS” protocol=TCP dir=out localport=443 action=block

added firewwall rule blocking outbound TCP traffic on port 443

netsh advfirewall firewall show rule name=”No Out HTTPS”

netsh interface ipv4 set dnsservers name=”Local Area Connection” source=static address=8.8.8.8 validate=no

netsh interface ip set address name=”Local Area Connection” static 10.10.1.31 255.240.0.0 <default_gateway>

netsh interface ip delete arpcache

wmic nic get NetConnectionId, Name, ServiceName

find an interface via it’s Service Name

netsh advfirewall firewall show rule name=all dir=in | more

netsh advfirewall firewall set rule name=”Remote Desktop (TCP-In)” new action=block