使⽤WMIC管理wmi

注意：wmic命令需要本地管理员或域管理员才可以进⾏正常使⽤，普通权限⽤户若想要使⽤wmi，可以修改 普通⽤户的ACL，不过修改⽤户的ACL也需要管理员权限，这⾥笔者单独罗列⼩结：普通⽤户使⽤wmic。以下 命令均在2008R2、2012R2、2016上进⾏测试,部分命令在虚拟机中测试不⾏，例如查询杀软。

wmic logon list brief #登录⽤户
wmic ntdomain list brief #域控机器
wmic useraccount list brief #⽤户列表
wmic share get name,path #查看系统共享
wmic service list brief |more #服务列表
wmic startup list full #识别开机启动的程序，包括路径
wmic fsdir "c:\test" call delete #删除C盘下的test⽬录
wmic nteventlog get path,filename,writeable #查看系统中开启的⽇志
wmic nicconfig get ipaddress,macaddress #查看系统中⽹卡的IP地址和MAC地址
wmic qfe get description,installedOn #使⽤wmic识别安装到系统中的补丁情况
wmic product get name,version #查看系统中安装的软件以及版本，2008R2上执⾏后⽆反应。
wmic useraccount where "name='%UserName%'" call rename newUserName #更改当前⽤户名
wmic useraccount where "name='Administrator'" call Rename admin #更改指定⽤户名
wmic bios list full | findstr /i "vmware" #查看当前系统是否是VMWARE，可以按照实际情况进⾏筛选
wmic desktop get screensaversecure,screensavertimeout #查看当前系统是否有屏保保护，延迟是多少
wmic process where name="vmtoolsd.exe" get executablepath #获取指定进程可执⾏⽂件的路径
wmic environment where "name='temp'" get UserName,VariableValue #获取temp环境变量

###查询当前主机的杀毒软件
wmic process where "name like '%forti%'" get name
wmic process where name="FortiTray.exe" call terminate
wmic /namespace:\rootsecuritycenter2 path antivirusproduct GET displayName,productState,pathToSignedProductExe
wmic /namespace:\rootsecuritycenter2 path antispywareproduct GET displayName,productState, pathToSignedProductExe 
wmic /namespace:\rootsecuritycenter2 path antivirusproduct GET displayName,productState,pathToSignedProductExe
wmic /Node:localhost /Namespace:\rootSecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
###

###查询windows机器版本和服务位数和.net版本
wmic os get caption
wmic os get osarchitecture
wmic OS get Caption,CSDVersion,OSArchitecture,Version
wmic product where "Name like 'Microsoft .Net%'" get Name, Version
###

###查询本机所有盘符
wmic logicaldisk list brief
wmic logicaldisk get description,name,size,freespace /value
###

###卸载和重新安装程序
wmic product where "name like '%Office%'" get name
wmic product where name="Office" call uninstall
###

### 查看某个进程的详细信息 （路径，命令⾏参数等）
wmic process where name="chrome.exe" list full
wmic process where name="frp.exe" get executablepath,name,ProcessId 进程路径
wmic process where caption="frp.exe" get caption,commandline /value
###

### 更改PATH环境变量值，新增c:whoami
wmic environment where "name='path' and username='<system>'" set
VariableValue="%path%;c:whoami
###

### 查看某个进程的详细信息-PID
wmic process list brief
tasklist /SVC | findstr frp.exe
wmic process where ProcessId=3604 get
ParentProcessId,commandline,processid,executablepath,name,CreationClassName,CreationDate
###

### 终⽌⼀个进程
wmic process where name ="xshell.exe" call terminate
ntsd -c q -p 进程的PID
taskkill -im pid
###

###获取电脑产品编号和型号信息
wmic baseboard get Product,SerialNumber
wmic bios get serialnumber
###

###安装软件
wmic product get name,version
wmic product list brief