标题: 比CMD更强大的命令行WMIC [打印本页] 作者: linda 时间: 2015-1-6 19:02 标题: 比CMD更强大的命令行WMIC
先决条件：
a. 启动Windows Management Instrumentation服务，开放TCP135端口。
b. 本地安全策略的“网络访问: 本地帐户的共享和安全模式”应设为“经典-本地用户以自己的身份验证”。
1. wmic /node:"192.168.1.20" /user:"domain\administrator" /password:"123456"
2.【硬件管理】：
获取磁盘资料：
wmic DISKDRIVE get deviceid,Caption,size,InterfaceType
获取分区资料：
wmic LOGICALDISK get name,Description,filesystem,size,freespace
获取CPU资料:
wmic cpu get name,addresswidth,processorid
获取主板资料:
wmic BaseBoard get Manufacturer,Product,Version,SerialNumber
获取内存数:
wmic memlogical get totalphysicalmemory
获得品牌机的序列号:
wmic csproduct get IdentifyingNumber
获取声卡资料:
wmic SOUNDDEV get ProductName
获取屏幕分辨率
wmic DESKTOPMONITOR where Status='ok' get ScreenHeight,ScreenWidth
3. PROCESS【进程管理】：
列出进程
wmic process list brief
(Full显示所有、Brief显示摘要、Instance显示实例、Status显示状态)
wmic 获取进程路径:
wmic process where name="jqs.exe" get executablepath
wmic 创建新进程
wmic process call create notepad
wmic process call create "C:\Program Files\Tencent\QQ\QQ.exe"
wmic process call create "shutdown.exe -r -f -t 20"
wmic 删除指定进程:
wmic process where name="qq.exe" call terminate
wmic process where processid="2345" delete
wmic process 2345 call terminate
wmic 删除可疑进程
wmic process where "name='explorer.exe' and executablepath<>'%SystemDrive%\\windows\\explorer.exe'" delete
wmic process where "name='svchost.exe' and ExecutablePath<>'C:\\WINDOWS\\system32\\svchost.exe'" call Terminate
