[size=small]======对进程的管理==========
结束一个进程(可根据进程对应的PID)
wmic process where name="notepad.exe" delete
wmic process where name="notepad.exe" terminate
wmic process where pid="123" delete
wmic path win32_process where "name='notepad.exe'" delete
创建一个进程
wmic process call create "c:\windows\system32\calc.exe"
查询进程的启动路径(将得到的信息输出)
wmic process get name,executablepath,processid
wmic /output:c:\process.html process get processid,name,executablepath /format:htable.xsl
查询指定进程的信息
wmic process where name="notepad.exe" get name,executablepath,processid
在远程计算上创建进程
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "c:\windows\notepad.exe"
查询远程计算机上的进程列表
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process get name,executablepath,processid
将获得到的远程计算机进程列表保存到本地
wmic /output:c:\process.html /node:192.168.8.10 /user:administrator /password:xiongyefeng process get processid,name,executablepath /format:htable.xsl
结束远程计算上的指定进程
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process where name="notepad.exe" delete
重启远程计算机
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -r -f"
关闭远程计算机
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -s -f"
高级应用:
结束可疑的进程
wmic process where "name='explorer.exe' and executablepath <> '%systemdrive%\\windows\\explorer.exe'" delete
wmic process where "name='svchost.exe' and executablepath <> '%systemdrive%\\windows\\system32\\svchost.exe'" call terminate
======对磁盘的管理========
查看磁盘的属性
wmic logicaldisk list brief
根据磁盘的类型查看相关属性
wmic logicaldisk where drivetype=3 list brief
使用get参数来获得自己想要参看的属性
wmic logicaldisk where drivetype=3 get deviceid,size,freespace,description,filesystem
只显示c盘的相关信息
wmic logicaldisk where name="c:" get deviceid,size,freespace,description,filesystem
更改卷标的名称
wmic logicaldisk where name="c:" set volumename=lsxq
获得U盘的盘符号
wmic logicaldisk where drivetype='2' get deviceid,description
[/size]
结束一个进程(可根据进程对应的PID)
wmic process where name="notepad.exe" delete
wmic process where name="notepad.exe" terminate
wmic process where pid="123" delete
wmic path win32_process where "name='notepad.exe'" delete
创建一个进程
wmic process call create "c:\windows\system32\calc.exe"
查询进程的启动路径(将得到的信息输出)
wmic process get name,executablepath,processid
wmic /output:c:\process.html process get processid,name,executablepath /format:htable.xsl
查询指定进程的信息
wmic process where name="notepad.exe" get name,executablepath,processid
在远程计算上创建进程
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "c:\windows\notepad.exe"
查询远程计算机上的进程列表
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process get name,executablepath,processid
将获得到的远程计算机进程列表保存到本地
wmic /output:c:\process.html /node:192.168.8.10 /user:administrator /password:xiongyefeng process get processid,name,executablepath /format:htable.xsl
结束远程计算上的指定进程
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process where name="notepad.exe" delete
重启远程计算机
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -r -f"
关闭远程计算机
wmic /node:192.168.8.10 /user:administrator /password:xiongyefeng process call create "shutdown -s -f"
高级应用:
结束可疑的进程
wmic process where "name='explorer.exe' and executablepath <> '%systemdrive%\\windows\\explorer.exe'" delete
wmic process where "name='svchost.exe' and executablepath <> '%systemdrive%\\windows\\system32\\svchost.exe'" call terminate
======对磁盘的管理========
查看磁盘的属性
wmic logicaldisk list brief
根据磁盘的类型查看相关属性
wmic logicaldisk where drivetype=3 list brief
使用get参数来获得自己想要参看的属性
wmic logicaldisk where drivetype=3 get deviceid,size,freespace,description,filesystem
只显示c盘的相关信息
wmic logicaldisk where name="c:" get deviceid,size,freespace,description,filesystem
更改卷标的名称
wmic logicaldisk where name="c:" set volumename=lsxq
获得U盘的盘符号
wmic logicaldisk where drivetype='2' get deviceid,description
[/size]