2023年7月3日发(作者：)

wmicprocess命令进程管理【转】netstat -an -b -o //获取进程名称 端⼝ pidwmic process list brief >> d: //获取进程摘要信息结束⼀个进程(可根据进程对应的PID)wmic process where name="" deletewmic process where name="" terminatewmic process where pid="123" deletewmic path win32_process where "name=''" delete创建⼀个进程wmic process call create "c:"查询进程的启动路径(将得到的信息输出)wmic process get name,executablepath,processidwmic /output:c: process get processid,name,executablepath /format:查询指定进程的信息wmic process where name="" get name,executablepath,processid在远程计算上创建进程wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "c:"查询远程计算机上的进程列表wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process get name,executablepath,processid将获得到的远程计算机进程列表保存到本地wmic /output:c: /node:192.168.8.10 /user:administrator /password:xiongyefeng process getprocessid,name,executablepath /format:结束远程计算上的指定进程wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process where name="" delete重启远程计算机wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -r -f"关闭远程计算机wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -s -f"⾼级应⽤：结束可疑的进程wmic process where "name='' and executablepath <> '%systemdrive%'" deletewmic process where "name='' and executablepath <> '%systemdrive%'" callterminate======对磁盘的管理========查看磁盘的属性wmic logicaldisk list brief根据磁盘的类型查看相关属性wmic logicaldisk where drivetype=3 list brief使⽤get参数来获得⾃⼰想要参看的属性wmic logicaldisk where drivetype=3 get deviceid,size,freespace,description,filesystem只显⽰c盘的相关信息wmic logicaldisk where name="c:" get deviceid,size,freespace,description,filesystem更改卷标的名称wmic logicaldisk where name="c:" set volumename=lsxq获得U盘的盘符号wmic logicaldisk where drivetype='2' get deviceid,description--------------------------------------------------------------------------------------------------BIOS - 基本输⼊/输出服务 (BIOS) 管理::查看bios版本型号wmic bios get Manufacturer,NameCOMPUTERSYSTEM - 计算机系统管理::查看系统启动选项,boot的内容wmic COMPUTERSYSTEM get SystemStartupOptions::查看⼯作组/域wmic computersystem get domain::更改计算机名abc为123wmic computersystem where "name='abc'" call rename 123::更改⼯作组google为MyGroupwmic computersystem where "name='google'" call joindomainorworkgroup "","","MyGroup",1CPU - CPU 管理::查看cpu型号wmic cpu get nameDATAFILE - DataFile 管理::查找e盘下test⽬录(不包括⼦⽬录)下的⽂件wmic datafile where "drive='e:' and path='test' and FileName='cc' and Extension='cmd'" list::查找e盘下所有⽬录和⼦⽬录下的⽂件,且⽂件⼤⼩⼤于1Kwmic datafile where "drive='e:' and FileName='cc' and Extension='cmd' and FileSize>'1000'" list::删除e盘下⽂件⼤⼩⼤于10M的.cmd⽂件wmic datafile where "drive='e:' and Extension='cmd' and FileSize>'10000000'" call delete::删除e盘下test⽬录(不包括⼦⽬录)下的⾮.cmd⽂件wmic datafile where "drive='e:' and Extension<>'cmd' and path='test'" call delete::复制e盘下test⽬录(不包括⼦⽬录)下的⽂件到e:,并改名为c datafile where "drive='e:' and path='test' and FileName='cc' and Extension='cmd'" call copy "e:"::改名c:为c:c datafile "c:" call rename c:::查找h盘下⽬录含有test,⽂件名含有perl,后缀为txt的⽂件wmic datafile where "drive='h:' and extension='txt' and path like '%test%' and filename like '%perl%'" get nameDESKTOPMONITOR - 监视器管理::获取屏幕分辨率wmic DESKTOPMONITOR where Status='ok' get ScreenHeight,ScreenWidthDISKDRIVE - 物理磁盘驱动器管理::获取物理磁盘型号⼤⼩等wmic DISKDRIVE get Caption,size,InterfaceTypeENVIRONMENT - 系统环境设置管理::获取temp环境变量wmic ENVIRONMENT where "name='temp'" get UserName,VariableValue::更改path环境变量值,新增e:toolswmic ENVIRONMENT where "name='path' and username=''" set VariableValue="%path%;e:tools"::新增系统环境变量home,值为%HOMEDRIVE%%HOMEPATH%wmic ENVIRONMENT create name="home",username="",VariableValue="%HOMEDRIVE%%HOMEPATH%"::删除home环境变量wmic ENVIRONMENT where "name='home'" deleteFSDIR - ⽂件⽬录系统项⽬管理::查找e盘下名为test的⽬录wmic FSDIR where "drive='e:' and filename='test'" list::删除e:test⽬录下除过⽬录abc的所有⽬录wmic FSDIR where "drive='e:' and path='test' and filename<>'abc'" call delete::删除c:good⽂件夹wmic fsdir "c:good" call delete::重命名c:good⽂件夹为abbwmic fsdir "c:good" rename "c:abb"LOGICALDISK - 本地储存设备管理::获取硬盘系统格式、总⼤⼩、可⽤空间等wmic LOGICALDISK get name,Description,filesystem,size,freespaceNIC - ⽹络界⾯控制器 (NIC) 管理OS - 已安装的操作系统管理::设置系统时间wmic os where(primary=1) call setdatetime 22.555555+480PAGEFILESET - 页⾯⽂件设置管理::更改当前页⾯⽂件初始⼤⼩和最⼤值wmic PAGEFILESET set InitialSize="512",MaximumSize="512"::页⾯⽂件设置到d:下,执⾏下⾯两条命令wmic pagefileset create name='d:',initialsize=512,maximumsize=1024wmic pagefileset where"name='c:'" deletePROCESS - 进程管理::列出进程的核⼼信息,类似任务管理器wmic process list brief::结束进程,路径为⾮C:的wmic process where "name='' and ExecutablePath<>'C:'" call Terminate::新建notepad进程wmic process call create notepadPRODUCT - 安装包任务管理::安装包在C:WINDOWSInstaller⽬录下::卸载.msi安装包wmic PRODUCT where "name='Microsoft .NET Framework 1.1' and Version='1.1.4322'" call Uninstall::修复.msi安装包wmic PRODUCT where "name='Microsoft .NET Framework 1.1' and Version='1.1.4322'" call ReinstallSERVICE - 服务程序管理::运⾏spooler服务wmic SERVICE where name="Spooler" call startservice::停⽌spooler服务wmic SERVICE where name="Spooler" call stopservice::暂停spooler服务wmic SERVICE where name="Spooler" call PauseService::更改spooler服务启动类型[auto|Disabled|Manual] 释[⾃动|禁⽤|⼿动]wmic SERVICE where name="Spooler" set StartMode="auto"::删除服务wmic SERVICE where name="test123" call deleteSHARE - 共享资源管理::删除共享wmic SHARE where name="e$" call delete::添加共享WMIC SHARE CALL Create "","test","3","TestShareName","","c:test",0SOUNDDEV - 声⾳设备管理wmic SOUNDDEV listSTARTUP - ⽤户登录到计算机系统时⾃动运⾏命令的管理::查看msconfig中的启动选项wmic STARTUP listSYSDRIVER - 基本服务的系统驱动程序管理wmic SYSDRIVER listUSERACCOUNT - ⽤户帐户管理::更改⽤户administrator全名为adminwmic USERACCOUNT where name="Administrator" set FullName="admin"::更改⽤户名admin为admin00wmic useraccount where "name='admin" call Rename admin00