1. Eject USB Device
-
When logged on remotely with standard user privileges, it is not possible to eject a USB device from the Notification Area.
-
Make sure to logon remotely with administrative privileges.
2. Help
"connection file" -- Specifies the name of an .RDP file for the connection. /v:<server[:port]> -- Specifies the remote PC to which you want to connect. /g:<gateway> -- Specifies the RD Gateway server to use for the connection. This parameter is only read if the endpoint remote PC is specified with /v. /admin -- Connects you to the session for administering a remote PC. /f -- Starts Remote Desktop in full-screen mode. /w:<width> -- Specifies the width of the Remote Desktop window. /h:<height> -- Specifies the height of the Remote Desktop window. /public -- Runs Remote Desktop in public mode. /span -- Matches the remote desktop width and height with the local virtual desktop, spanning across multiple monitors, if necessary. To span across monitors, the monitors must be arranged to form a rectangle. /multimon -- Configures the Remote Desktop Services session monitor layout to be identical to the current client-side configuration. /edit -- Opens the specified .RDP connection file for editing. /restrictedAdmin -- Connects you to the remote PC in Restricted Administration mode. In this mode, credentials won't be sent to the remote PC, which can protect you if you connect to a PC that has been compromised. However, connections made from the remote PC might not be authenticated by other PCs, which might impact application functionality and compatibility. This parameter implies /admin. /remoteGuard -- Connects your device to a remote device using Remote Guard. Remote Guard prevents credentials from being sent to the remote PC, which can help protect your credentials if you connect to a remote PC that has been compromised. Unlike Restricted Administration mode, Remote Guard also supports connections made from the remote PC by redirecting all requests back to your device. /prompt -- Prompts you for your credentials when you connect to the remote PC. /shadow:<sessionID> -- Specifies the ID of the session to shadow. /control -- Allows control of the session when shadowing. /noConsentPrompt -- Allows shadowing without user consent.
3. Move Off-screen Window
-
Select the application either by choosing it in the taskbar or using the Alt+Tab key.
-
Press Alt+Space and select Move.
-
Use the arrow keys to move the window back onto your screen.
4. Usage
-
Enter the following commands at a Command Prompt.
# Automatic. rdp rdp <Computer> rdp <Computer> -Shadow rdp <Computer> -Shadow -Control # Manual shadow. qwinsta.exe /server:<Computer> get-administratorpassword <Computer> mstsc.exe /shadow:<Id> /v:<Computer> /prompt # Type *.\Administrator* in the *User name* field. # Type the LAPS password in the *Password* field. # Click *OK*. -
Enter the following commands at a Command Prompt on the local computer.
Show-Status -wifi scp.exe -p -i id_rsa-auto W:\Software\_Delta\Delta-Windows-Tools-#.#.#-x64.exe Administrator@SMRUWS-TB02:C:\Tmp scp.exe -p -i id_rsa-auto "W:\Software\Microsoft\Microsoft Teams new\teamsbootstrapper-1.36.52307.0.exe" Administrator@SMRUWS-TB02:C:\Tmp scp.exe -i id_rsa-auto Administrator@SMRUWS-TB02:C:\SMRUWS-TB02.* . smru-putty Administrator@SMRUWS-TB02 # Add domain account to "Remote Desktop Users" group. net localgroup "Remote Desktop Users" <Domain>\<User> /add -
Enter the following commands at a Command Prompt on the remote computer.
dir C:\Tmp\Delta-Windows-Tools-#.#.#-x64.exe C:\Tmp\Delta-Windows-Tools-#.#.#-x64.exe Set-WindowsConfiguration Show-Inventory -
Enter the following commands at a Command Prompt on the local computer.
Show-RemoteComputers rdp <Computer> <Port> rdp localhost -Force -Shadow rdp localhost -Force -Shadow -Control mstsc.exe /v:tbhf-web-mrm:<rdp port> scp.exe -p -P <ssh port> W:\Software\CrowdStrike\SMRU\WindowsSensor-6.38.15205.0.exe Administrator@tbhf-web-mrm: -
Enter the following commands at a Command Prompt on the local computer.
rem Logon as Administrator with PuTTY to computer using id_rsa-auto.ppk private key. smru-putty Administrator@<computer> smru-putty Administrator@localhost rem Logon as Administrator with SSH to computer using id_rsa-auto private key. smru-ssh Administrator@<computer> smru-ssh Administrator@localhost Show-RemoteComputers rdp <computer> <rdp port> smru-putty -P <ssh port> Administrator@tbhf-web-mrm smru-ssh -p <ssh port> Administrator@tbhf-web-mrm smru-putty -P <ssh port> Administrator@tbhf-web-mrm scp.exe -p -P <ssh port> W:\Software\CrowdStrike\SMRU\WindowsSensor-6.38.15205.0.exe Administrator@tbhf-web-mrm: scp.exe -p -P <ssh port> W:\Software\_Delta\Delta-Windows-Tools-#.#.#-x64.exe Administrator@tbhf-web-mrm: -
Enter the following commands at a Command Prompt on the remote computer.
scp.exe -p smru@10.10.1.2:/media/Windows/Software/_Delta/Delta-Windows-Tools-#.#.#-x64.exe C:\Tmp scp.exe -p smru@10.10.1.2:/media/Windows/Software/CrowdStrike/SMRU/WindowsSensor-6.38.15205.0.exe C:\Tmp scp.exe -p smru@10.10.1.2:/media/Windows/Software/CrowdStrike/TBHF/WindowsSensor.MaverickGyr-6.38.15205.exe C:\Tmp -
Note: For the rdp and smru-putty aliases to work make sure to have the id_rsa-auto.ppk file in your home folder.
-
Note: For the smru-ssh alias to work make sure to have the id_rsa-auto file in your home folder.
$Command = "lsof -i4tcp | grep ^ssh.*:[2-3][2-3]0.*LISTEN" $Computer = "TBHF-WEB-MRM" $PrivateKey = "${Env:UserProfile}\id_rsa-auto" $User = "root" ssh.exe -i $PrivateKey $User@$Computer $Commandssh.exe -i C:\Users\Douwe\id_rsa-auto root@tbhf-web-mrm lsof -i4tcp | grep ^ssh.*:[2-3][2-3]0.*LISTEN ssh.exe -i C:\Users\Douwe\id_rsa-auto root@tbhf-web-mrm lsof -i4tcp | grep ^ssh.*:220.*LISTEN
5. XXX
-
Enter the following commands at a Command Prompt with administrative privileges.
netstat.exe -nob | Findstr.exe /ric:"3389" :: Note: The following command will trigger a CrowdStrike incident. C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <Id> O:\Tmp\dump.txt full -
Enter the following commands at a PowerShell Command Prompt with administrative privileges.
$Process = netstat.exe -nob | Select-String TermService -Context 1 $Id = ($Process.Context | Select-Object -ExpandProperty PreContext) -replace "^.* ", "" Get-Process -Id $Id | Format-List * # Note: The following command will trigger a CrowdStrike incident. C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump $Id O:\Tmp\dump.txt full