dsquery command

dsquery user -inactive 13 ==>list users have no login for 91 days.
dsquery user -stalepwd 180 ==>list users that the password had been used for 180 days.

netsh command change IP address

netsh interface ip set address "Local Area Connection" static 192.168.0.1 255.255.255.0 192.168.0.254 1

netsh firewall set icmpsetting 8          => allow others to ping you
netsh firewall set icmpsetting 8 disable=> deny others to ping you

EventTriggers

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/eventtriggers.mspx?mfr=true

• /create - is used to create an event trigger,
• /delete can be used to delete the trigger
• /eid - is the event id number you wish to track
• /tr - is the name you would like to give to the event trigger
• /ru - is the user name to run under userdomain or user@domain.com are both acceptable
• /rp - is the user password
• /tk - is the action you would like performed when triggered

• /query - a list of event triggers

How to set event log security locally or by using Group Policy in Windows Server 2003

http://support.microsoft.com/kb/323076/en-us
http://social.technet.microsoft.com/Forums/zh-TW/winserverzhcht/thread/eda758fa-8841-4d64-9edb-5b798d99600d/

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security
對CustomSD點兩下後,在最後面加上下面一行

(A;; 0x1;;;UserSID)

A=Allow

D=Deny

1 = 讀取
2 = 寫入
3 = 讀取+寫入
4 = 清除

7 = 讀取+寫入+清除

LogParser -- (2)

How do I retrieve the event logs that have been logged in the past 10 minutes?

You need to use the SUB function to subtract 10 minutes from the current UTC timestamp returned by the SYSTEM_TIMESTAMP function, and convert this timestamp to local time using the TO_LOCALTIME function:

SELECT *
FROM System
WHERE TimeGenerated >= TO_LOCALTIME( SUB( SYSTEM_TIMESTAMP(), TIMESTAMP( '10', 'mm' ) ) )

LogParser -- (1)

logparser "SELECT * FROM Application.evt"
Task aborted.
Cannot open <from-entity>: Error opening event log "\\?\C:\Application.evt": The event log file is corrupted.

Statistics:
-----------
Elements processed: 0
Elements output:    0
Execution time:     0.61 seconds

Solution:

wevtutil epl application.evt application.evtx /lf:true

wevtutil export-log application.evt application.evtx /lf

wevtutil [{el | enum-logs}] [{gl | get-log} <Logname> [/f:<Format>]]
[{sl | set-log} <Logname> [/e:<Enabled>] [/i:<Isolation>] [/lfn:<Logpath>] [/rt:<Retention>] [/ab:<Auto>] [/ms:<Size>] [/l:<Level>] [/k:<Keywords>] [/ca:<Channel>] [/c:<Config>]] 
[{ep | enum-publishers}] 
[{gp | get-publisher} <Publishername> [/ge:<Metadata>] [/gm:<Message>] [/f:<Format>]] [{im | install-manifest} <Manifest>] 
[{um | uninstall-manifest} <Manifest>] [{qe | query-events} <Path> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/bm:<Bookmark>] [/sbm:<Savebm>] [/rd:<Direction>] [/f:<Format>] [/l:<Locale>] [/c:<Count>] [/e:<Element>]] 
[{gli | get-loginfo} <Logname> [/lf:<Logfile>]] 
[{epl | export-log} <Path> <Exportfile> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/ow:<Overwrite>]] 
[{al | archive-log} <Logpath> [/l:<Locale>]] 
[{cl | clear-log} <Logname> [/bu:<Backup>]] [/r:<Remote>] [/u:<Username>] [/p:<Password>] [/a:<Auth>] [/uni:<Unicode>]

Event Collector is managed with a command-line tool, Windows Event Collector Utility (Wecutil.exe).

How to move user Databases

The procedures in this topic require the Logic name of the database files. To obtain the name, query the name column in the "sys.master_files" catalog view.
>select * from sys.master_files

To move a data or log file as part of a planned relocation, follow these steps:

1. Run the following statement.
>ALTER DATABASE database_name SET OFFLINE;

2. Move the file or files to the new location.

3. For each file moved, run the following statement.
>ALTER DATABASE database_name MODIFY FILE ( NAME = logical_name, FILENAME = 'new_path\os_file_name' );

4. Run the following statement.
>ALTER DATABASE database_name SET ONLINE;

5. Verify the file change by running the following query.
>SELECT name, physical_name AS CurrentLocation, state_desc FROM sys.master_files
WHERE database_id = DB_ID(N'<database_name>');