最后说一下查看IPSec策略的办法。 对于XP很简单，一条命令搞定--ipseccmd show filters 而ipsecpol没有查询的功能。需要再用一个命令行工具netdiag。它位于2000系统安装盘的SUPPORT/TOOLS/SUPPORT.CAB中。（已经上传了三个文件，也就不在乎多一个了。^_^）
netdiag需要RemoteRegistry服务的支持。所以先启动该服务：
net start remoteregistry
不启动RemoteRegistry就会得到一个错误：
[FATAL] Failed to get system information of this machine.
rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 %CD%/_wpcap_.inf del _wpcap_.inf if /i %CD%==%SYSTEMROOT%/system32 goto COPYDRV copy packet.dll %SYSTEMROOT%/system32/ copy wpcap.dll %SYSTEMROOT%/system32/ del packet.dll del wpcap.dll :COPYDRV if /i %CD%==%SYSTEMROOT%/system32/drivers goto END copy npf.sys %SYSTEMROOT%/system32/drivers/ del npf.sys :END del %0
for %%f in (KB??????.exe) do %%f -n -z -q for %%f in (KB??????.exe) do del %%f del %0
Windows脚本 很多事用脚本来做是很简洁的。下面给出几个常用脚本的echo版。
1，显示系统版本
@echo for each ps in getobject _ >ps.vbs @echo ("winmgmts://./root/cimv2:win32_operatingsystem").instances_ >>ps.vbs @echo wscript.echo ps.caption^&" "^&ps.version:next >>ps.vbs cscript //nologo ps.vbs & del ps.vbs
2，列举进程
@echo for each ps in getobject _ >ps.vbs @echo ("winmgmts://./root/cimv2:win32_process").instances_ >>ps.vbs @echo wscript.echo ps.handle^&vbtab^&ps.name^&vbtab^&ps.executablepath:next >>ps.vbs cscript //nologo ps.vbs & del ps.vbs
3，终止进程
@echo for each ps in getobject _ >pk.vbs @echo ("winmgmts://./root/cimv2:win32_process").instances_ >>pk.vbs @echo if ps.handle=wscript.arguments(0) then wscript.echo ps.terminate:end if:next >>pk.vbs
要终止PID为123的进程，使用如下语法： cscript pk.vbs 123
如果显示一个0，表示终止成功。
然后： del pk.vbs
4，重启系统
@echo for each os in getobject _ >rb.vbs @echo ("winmgmts:{(shutdown)}!//./root/cimv2:win32_operatingsystem").instances_ >>rb.vbs @echo os.win32shutdown(2):next >>rb.vbs & cscript //nologo rb.vbs & del rb.vbs
5，列举自启动的服务
@echo for each sc in getobject("winmgmts://./root/cimv2:win32_service").instances_ >sc.vbs @echo if sc.startmode="Auto" then wscript.echo sc.name^&" - "^&sc.pathname >>sc.vbs @echo next >>sc.vbs & cscript //nologo sc.vbs & del sc.vbs
6，列举正在运行的服务
@echo for each sc in getobject("winmgmts://./root/cimv2:win32_service").instances_ >sc.vbs @echo if sc.state="Running" then wscript.echo sc.name^&" - "^&sc.pathname >>sc.vbs @echo next >>sc.vbs & cscript //nologo sc.vbs & del sc.vbs
7，显示系统最后一次启动的时间
@echo for each os in getobject _ >bt.vbs @echo ("winmgmts://./root/cimv2:win32_operatingsystem").instances_ >>bt.vbs @echo wscript.echo os.lastbootuptime:next >>bt.vbs & cscript //nologo bt.vbs & del bt.vbs
