一些Pstool

PsExec - execute processes remotely

PsFile - shows files opened remotely

PsGetSid - display the SID of a computer or a user

PsInfo - list information about a system

PsKill - kill processes by name or process ID

PsList - list detailed information about processes

PsLoggedOn - see who's logged on locally and via resource sharing

PsLogList - dump event log records
PsPasswd - changes account passwords

PsService - view and control services

PsShutdown - shuts down and optionally reboots a computer

PsSuspend - suspend and resume processes

找PsExec的时候看到一些类似的工具包，顺便下载下来学习学习。

   1.PsFile

The "net file" command shows you a list of the files that other computers have opened on the system upon which you execute the command, however it truncates long path names and doesn't let you see that information for remote systems. PsFile is a command-line utility that shows a list of files on a system that are opened remotely, and it also allows you to close opened files either by name or by a file identifier.
Installation
 

Copy PsFile onto your executable path and type "psfile".
Usage

The default behavior of PsFile is to list the files on the local system that are open by remote systems. Typing a command followed by "-?" displays information on the syntax for the command.

usage: psfile [\\RemoteComputer [-u Username [-p Password]]] [[Id | path] [-c]]
-u    Specifies optional user name for login to remote computer.
-p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
Id    Identifier (as assigned by PsFile) of the file for which to display information or to close.
Path    Full or partial path of files to match for information display or close.
-c    Closes the files identifed by ID or path.

psfile是一个显示机器上的会话和有什么文件被网络中的用户的打开的命令。

使用实例：

D:\software\PsTools>PsFile \\10.11.16.23 -u Administrator -p password

psfile v1.02 - psfile
Copyright ⌐ 2001 Mark Russinovich
Sysinternals

Files opened remotely on 10.11.16.23:

[61] \PIPE\srvsvc
    User:   ADMINISTRATOR
    Locks:  0
    Access: Read Write

   1.PsInfo

PsInfo is a command-line tool that gathers key information about the local or remote system, including the type of installation, kernel build, registered organization and owner, number of processors and their type, memory size, the install date of the system, and if it's a trial version, the expiration date. PsInfo command-line switches also let you view installed hotfixes and software applications.
Installation
 
Copy PsInfo onto your executable path and type psinfo.
Usage
 By default PsInfo shows information for the local system. Specify a remote computer name to obtain information from the remote system. Since PsInfo relies on remote Registry access to obtain its data, the remote system must be running the Remote Registry service and the account from which you run PsInfo must have access to the HKLM\System portion of the remote Registry.

In order to aid in automated Service Pack updates, PsInfo returns as a value the Service Pack number of system (e.g. 0 for no service pack, 1 for SP 1, etc).

usage: psinfo [\\computer[,computer[,...] | @file [-u username [-p password]]] [-h] [-s] [-d] [-c [-t delimter]]

computer
Run the command on the computer or computers specified. If you omit the computer name the command runs on the local system and if you enter a computer name of \\* then the command runs on all computers in the current domain.
@file    Execute the command on each of the computers listed in the file.
-u    Specifies optional user name for login to remote computer.
-p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
-h    Shows installed hotfixes.
-s    Shows installed software.
-d    Show disk volume information.
-c    Dump in CSV format.
-t    The default delimiter for the -s option is a comma, but can be overriden with the specified character.

psinfo是一个搜集机器软硬件信息的工具，它可以获得操作系统信息，硬件信息和软件信息。　

D:\software\PsTools>PsInfo \\10.11.16.23 -u Administrator -p password

PsInfo v1.77 - Local and remote system information viewer
Copyright (C) 2001-2009 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\10.11.16.23:
Uptime:                    Error reading uptime
Kernel version:            Microsoft Windows Server 2003, Multiprocessor Free
Product type:              Standard Edition
Product version:           5.2
Service pack:              1
Kernel build number:       3790
Registered organization:   Director Lab
Registered owner:          IBM_USER
IE version:                6.0000
System root:               C:\WINDOWS
Processors:                4
Processor speed:           2.8 GHz
Processor type:            Dual-Core AMD Opteron(tm) Processor 2220
Physical memory:           0 MB
Video driver:              ATI ES1000

查看远程机器的磁盘和软件可以分别用-d 和-s

查看安装软件

D:\software\PsTools>PsInfo \\10.11.16.23 -u Administrator -p password -s

PsInfo v1.77 - Local and remote system information viewer
Copyright (C) 2001-2009 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\10.11.16.23:
Uptime:                    Error reading uptime
Kernel version:            Microsoft Windows Server 2003, Multiprocessor Free
Product type:              Standard Edition
Product version:           5.2
Service pack:              1
Kernel build number:       3790
Registered organization:   Director Lab
Registered owner:          IBM_USER
IE version:                6.0000
System root:               C:\WINDOWS
Processors:                4
Processor speed:           2.8 GHz
Processor type:            Dual-Core AMD Opteron(tm) Processor 2220
Physical memory:           0 MB
Video driver:              ATI ES1000
Applications:
ATI Display Driver 8.24.50.2-071025a-055797C-IBM
Broadcom NetXtreme II Driver Installer 11.48.05
Hotfix for Windows Server 2003 (KB925336) 1
Hotfix for Windows Server 2003 (KB942288-v4) 4
MSXML 6.0 Parser (KB927977) 6.00.3890.0
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft Virtual Server 2005 R2 SP1 1.1.603.0
Microsoft Visual C++ 2005 Redistributable (x64) 8.0.56336
Python 2.6.5 (64-bit) 2.6.5150
TivGuid64 01.03.0200
Windows Driver Package - Adaptec (arcsas) SCSIAdapter  (07/18/2007 5.2.0.12913)
07/18/2007 5.2.0.12913
Windows Driver Package - LSI Corporation (LSI_SAS) SCSIAdapter  (01/30/2009 1.30
.02.00) 01/30/2009 1.30.02.00
Windows Driver Package - LSI Corporation System  (10/14/2008 1.0.7.0) 10/14/2008
 1.0.7.0
Windows Driver Package - LSI Logic (LSI_SAS) SCSIAdapter  (10/18/2006 1.21.28.00
) 10/18/2006 1.21.28.00
Windows Driver Package - LSI Logic System  (07/24/2006 0.0.1.0) 07/24/2006 0.0.1
.0
Windows Driver Package - QLogic (ql2300) SCSIAdapter  (09/25/2008 9.1.7.45) 09/2
5/2008 9.1.7.45


查看磁盘信息
 D:\software\PsTools>PsInfo \\10.11.16.23 -u Administrator -p password-d

PsInfo v1.77 - Local and remote system information viewer
Copyright (C) 2001-2009 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\10.11.16.23:
Uptime:                    64 days 17 hours 30 minutes 17 seconds
Kernel version:            Microsoft Windows Server 2003, Multiprocessor Free
Product type:              Standard Edition
Product version:           5.2
Service pack:              1
Kernel build number:       3790
Registered organization:   Director Lab
Registered owner:          IBM_USER
IE version:                6.0000
System root:               C:\WINDOWS
Processors:                4
Processor speed:           2.8 GHz
Processor type:            Dual-Core AMD Opteron(tm) Processor 2220
Physical memory:           0 MB
Video driver:              ATI ES1000
Volume Type       Format     Label                      Size       Free   Free
    C: Fixed      NTFS                              68.36 GB    8.73 GB  12.8%

D:\software\PsTools>

   1.PsGetSid

Have you performed a rollout and only to discover that your network might suffer from the SID duplication problem? In order to know which systems have to be assigned a new SID (using a SID updater like Sysinternals' own NewSID) you have to know what a computer's machine SID is. Up until now there's been no way to tell the machine SID without knowing Regedit tricks and exactly where to look in the Registry. PsGetSid makes reading a computer's SID easy, and works across the network so that you can query SIDs remotely. PsGetSid also lets you see the SIDs of user accounts.
Installation
 

Copy PsPsGetSid onto your executable path and type "psgetsid".
Usage
Usage: psgetsid [\\computer[,computer[,...] | @file [-u username [-p password]]] [account]

If you want to see a computer's SID just pass the computer's name as a command-line argument. If you want to see a user's SID, name the account (e.g. "administrator") on the command-line and an optional computer name.

Specify a user name if the account you are running from doesn't have administrative privileges on the computer you want to query. If you don't specify a password as an option PsGetSid will prompt you for one so that you can type it in without having it echoed to the display.

使用实例：
D:\software\PsTools>Psgetsid

PsGetSid v1.44 - Translates SIDs to names and vice versa
Copyright (C) 1999-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

SID for \\R86M1CV:
S-1-5-21-2766576068-2271245186-4045486440

补充知识：什么是SID：

SID
SID也就是安全标识符（Security Identifiers），是标识用户、组和计算机帐户的唯一的号码。在第一次创建该帐户时，将给网络上的每一个帐户发布一个唯一的 SID。Windows 2000 中的内部进程将引用帐户的 SID 而不是帐户的用户或组名。如果创建帐户，再删除帐户，然后使用相同的用户名创建另一个帐户，则新帐户将不具有授权给前一个帐户的权力或权限，原因是该帐户具有不同的 SID 号。安全标识符也被称为安全 ID 或 SID。
SID的作用
用户通过验证后，登陆进程会给用户一个访问令牌，该令牌相当于用户访问系统资源的票证，当用户试图访问系统资源时，将访问令牌提供给 Windows NT，然后 Windows NT 检查用户试图访问对象上的访问控制列表。如果用户被允许访问该对象，Windows NT将会分配给用户适当的访问权限。
访问令牌是用户在通过验证的时候有登陆进程所提供的，所以改变用户的权限需要注销后重新登陆，重新获取访问令牌。
SID号码的组成
如果存在两个同样SID的用户，这两个帐户将被鉴别为同一个帐户，原理上如果帐户无限制增加的时候，会产生同样的SID，在通常的情况下SID是唯一的，他由计算机名、当前时间、当前用户态线程的CPU耗费时间的总和三个参数决定以保证它的唯一性。
一个完整的SID包括：
? 用户和组的安全描述
? 48-bit的ID authority
? 修订版本
? 可变的验证值Variable sub-authority values
例：S-1-5-21-310440588-250036847-580389505-500
我们来先分析这个重要的SID。第一项S表示该字符串是SID；第二项是SID的版本号，对于2000来说，这个就是1；然后是标志符的颁发机构（identifier authority），对于2000内的帐户，颁发机构就是NT，值是5。然后表示一系列的子颁发机构，前面几项是标志域的，最后一个标志着域内的帐户和组。


其他的使用工具如：

（1）PsKill
      Windows NT/2000 does not come with a command-line 'kill' utility. You can get one in the Windows NT or Win2K Resource Kit, but the kit's utility can only terminate processes on the local computer. PsKill is a kill utility that not only does what the Resource Kit's version does, but can also kill processes on remote systems. You don't even have to install a client on the target computer to use PsKill to terminate a remote process.
      Installation
       
      Copy PsKill onto your executable path and type pskill with command-line options defined below.
      Usage
      Running PsKill with a process ID directs it to kill the process of that ID on the local computer. If you specify a process name PsKill will kill all processes that have that name.

      usage: pskill [-t] [\\computer [-u username] [-p password]] <process name | process id>
      -t     Kill the process and its descendants.
      -u    Specifies optional user name for login to remote computer.
      -p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
      process id    Specifies the process ID of the process you want to kill.
      process name    Specifies the process name of the process or processes you want to kill.  

　pskill是一个杀除进程的程序。　　它的使用格式为：　　pskill [\\远程机器ip [-u username] [-p password]] <process name | process id>　　假设我在远程机器ip有一个账号，账号名是：abc 密码是：123　　比如要杀除一个pid号为999,名称为srm.exe的进程可以打：　　pskill \\远程机器ip -u abc -p 123 999 或 pskill \\远程机器ip -u abc -p 123 srm


（2）PsShutdown：

PsShutdown is a similar to the Resource Kit and Windows XP shutdown tools, providing you the same options and ability to shutdown, and optionally reboot, local and remote Windows NT/2K/XP/2003 systems. It also provided additional options that make it more powerful and flexible.
Installation
 

Copy PsShutdown onto your executable path and type "psshutdown" with command-line options defined below.
Usage
 

You can use PsShutdown to initiate a shutdown of the local or a remote computer, abort an imminent shutdown, logoff a console user, or lock the desktop.

usage: psshutdown [\\computer[,computer[,...] | @file [-u username [-p password]]]  -s|-r|-h|-d|-k|-a|-l|-o [-f] [-c] [-n s] [-t nn|h:m]  [-e [u|p]:xx:yy] [-m "message"]

computer
Run the command on the computer or computers specified. If you omit the computer name the command runs on the local system and if you enter a computer name of \\* then the command runs on all computers in the current domain.

@file    Execute the command on each of the computers listed in the file.
-u    Specifies optional user name for login to remote computer
-p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
-a    Aborts a shutdown (only possible while a countdown is in progress)
-c    Allow the shutdown to be aborted by the interactive user
-e    Shutdown reason code. Specify 'u' for user reason codes and 'p' for planned shutdown reason codes.
xx is the major reason code (must be less than 256)
yy is the minor reason code (must be less than 65536)
-f    Forces all running applications to exit during the shutdown instead of giving them a chance to gracefully save their data
-h    Hibernate the computer
-k    Poweroff the computer (reboot if poweroff is not supported
-l    Lock the computer
-m    This option lets you specify a message to display to logged-on users when a shutdown countdown commences
-n    Specifies timeout in seconds connecting to remote computers
-o    Logoff the console user
-r    Reboot after shutdown
-s    Shutdown without poweroff
-t    Specifies the countdown in seconds until the shutdown (default: 20 seconds) or the time of shutdown in 24 hour notation
-v    Display message for the specified number of seconds before the shutdown. If you omit this parameter the shutdown notification dialog displays and specifying a value of 0 omits the dialog.

 

　　psshutdown是一个远程关机命令。　　它的参数有：-a 取消以前执行的关机指令，-t离关机还有多少秒（默认是20秒），-s关闭机　　器，-m是要显示的信息，-f是关机是不保存运行的程序，-r表示重启，-l表示锁定电脑，-o 　　表示注销用户。　　比如我想让远程机器30秒后关闭并显示(要关机了，请保存文件)则打：　　psshutdown -t 30 -s -m "要关机了，请保存文件" \\远程机器ip　　如果是要重起的话打：　　psshutdown -t 30 -m "要关机了，请保存文件" -r \\远程机器ip　　如果要取消刚才的指令可以打：　　psshutdown -a \\远程机器ip

（3）Psservice：
PsService

PsService is a service viewer and controller for Windows NT/2K. Like the SC utility that's included in the Windows NT and Windows 2000 Resource Kits and Windows XP, PsService displays the status, configuration, and dependencies of a service, and allows you to start, stop, pause, resume and restart them. Unlike the SC utility, PsService enables you to logon to a remote system using a different account, for cases when the account from which you run it doesn't have required permissions on the remote system. PsService includes a unique service-search capability, which identifies active instances of a service on your network. You would use the search feature if you wanted to locate systems running DHCP servers, for instance.

Finally, PsService works on both NT 4 and Windows 2000, whereas the Windows 2000 Resource Kit version of SC requires Windows 2000, and PsService doesn't require you to manually enter a "resume index" in order to obtain a complete listing of service information.
Installation
 

Copy PsService onto your executable path and type "psservice".
Usage
 

The default behavior of PsService is to display the configured services (both running and stopped) on the local system. Entering a command on the command-line invokes a particular feature, and some commands accept options. Typing a command followed by "-?" displays information on the syntax for the command.

usage: psservice [\\computer [-u username] [-p password]] <command> <options>
-u    Specifies optional user name for login to remote computer.
-p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
query    Displays the status of a service
config    Displays the configuration of a service
setconfig
    

Specify the start type (auto, demand, disabled) of a service.
start    Starts a service
stop    Stops a service
restart    Stops and then restarts a service
pause    Pauses a service
cont    Resumes a paused service
security    Dumps the service's security descriptor
depend    Lists the services dependent on the one specified
find    Searches the network for the specified service

使用实例：

D:\software\PsTools>psservice \\10.11.16.23 -u Administrator -p passwordquery
tlntsvr

PsService v2.24 - Service information and configuration utility
Copyright (C) 2001-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

SERVICE_NAME: TlntSvr
DISPLAY_NAME: Telnet
Enables a remote user to log on to this computer and run programs, and supports
various TCP/IP Telnet clients, including UNIX-based and Windows-based computers.
 If this service is stopped, remote user access to programs might be unavailable
. If this service is disabled, any services that explicitly depend on it will fa
il to start.
        TYPE              : 10 WIN32_OWN_PROCESS
        STATE             : 1  STOPPED
                               (NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE   : 1077 (0x435)
        SERVICE_EXIT_CODE : 0  (0x0)
        CHECKPOINT        : 0x0
        WAIT_HINT         : 0 ms

（3）
PsPasswd

Systems administrators that manage local administrative accounts on multiple computers regularly need to change the account password as part of standard security practices. PsPasswd is a tool that lets you change an account password on the local or remote systems, enabling administrators to create batch files that run PsPasswd against the computer's they manage in order to perform a mass change of the administrator password.
Installation
 

Copy PsPasswd onto your executable path and type pspasswd with command-line options defined below.
Usage
 

You can use PsPasswd to change the password of a local or domain account on the local or a remote computer.

usage:  pspasswd [\\computer[,computer[,...] | @file [-u username [-p password]]] Username [NewPassword]]

 
    

computer
Run the command on the computer or computers specified. If you omit the computer name the command runs on the local system and if you enter a computer name of \\* then the command runs on all computers in the current domain.
@file    Execute the command on each of the computers listed in the file.
-u    Specifies optional user name for login to remote computer.
-p    Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
Username        Specifies name of account for password change.

NewPassword    New password. If ommitted a NULL password is applied.