wmic-remote-mangement
NOTE: Product only returns software installed by MSI... microsoft installer
http://isc.sans.org/diary.html?storyid=1229
wmic process [pid] delete
wmic process where name='cmd.exe' delete
wmic process list brief /every:1
wmic useraccount
wmic startup list full
wmic process list brief wmic process list brief | find "cmd.exe"
wmic /output:[file] [stuff you want it to do] /format:[format]
wmic [stuff to do] /format /?
KEYWORDS: CSV for comma delimited (e.g. excel table) HFORM for a listing of items in HTML HMOF for output in programming mode? HTABLE HXML LIST RAWXML TABLE VALUE htable-sortby htable-sortby.xsl texttablewsys texttablewsys.xsl wmiclimofformat wmiclimofformat.xsl wmiclitableformat wmiclitableformat.xsl wmiclitableformatnosys wmiclitableformatnosys.xsl wmiclivalueformat wmiclivalueformat.xsl
wmic /output:c:\os.html os get /format:hform
wmic process list /format:htable:"sortby=Name" > test.html
Is very similar to the following
wmic /output:c:\test.htm process list /format:htable:"sortby=Name"
REM first param is remote computer ip REM only detects MSI installed software
wmic /node:%1 product list /format:htable:"sortby=Name" > %1-software.htm