wmic 命令用法及實(shí)例

2020-03-29 19:58:22

字體：大中小

供稿：網(wǎng)友

wmic 獲取進(jìn)程名稱以及可執(zhí)行路徑:
wmic process get name,executablepath

wmic 刪除指定進(jìn)程(根據(jù)進(jìn)程名稱):
wmic process where name="qq.exe" call terminate
或者用
wmic process where name="qq.exe" delete

wmic 刪除指定進(jìn)程(根據(jù)進(jìn)程PID):
wmic process where pid="123" delete

wmic 創(chuàng)建新進(jìn)程
wmic process call create "C:/Program Files/Tencent/QQ/QQ.exe"

在遠(yuǎn)程機(jī)器上創(chuàng)建新進(jìn)程：
wmic /node:192.168.1.10 /user:administrator /password:123456 process call create cmd.exe

關(guān)閉本地計(jì)算機(jī)
wmic process call create shutdown.exe

重啟遠(yuǎn)程計(jì)算機(jī)
wmic /node:192.168.1.10/user:administrator /password:123456 process call create "shutdown.exe -r -f -m"

更改計(jì)算機(jī)名稱
wmic computersystem where "caption='%ComputerName%'" call rename newcomputername

更改帳戶名
wmic USERACCOUNT where "name='%UserName%'" call rename newUserName

wmic 結(jié)束可疑進(jìn)程（根據(jù)進(jìn)程的啟動(dòng)路徑）

wmic process where "name='explorer.exe' and executablepath<>'%SystemDrive%//windows//explorer.exe'" delete

wmic 獲取物理內(nèi)存
wmic memlogical get TotalPhysicalMemory|find /i /v "t"

wmic 獲取文件的創(chuàng)建、訪問(wèn)、修改時(shí)間

復(fù)制代碼代碼如下:

	
	@echo off
	for /f "skip=1 tokens=1,3,5 delims=. " %%a in ('wmic datafile where name^="c://windows//system32//notepad.exe" get CreationDate^,LastAccessed^,LastModified') do (
	set a=%%a
	set b=%%b
	set c=%%c
	echo 文件: c:/windows/system32/notepad.exe
	echo.
	echo 創(chuàng)建時(shí)間: %a:~0,4% 年 %a:~4,2% 月 %a:~6,2% 日 %a:~8,2% 時(shí) %a:~10,2% 分 %a:~12,2% 秒
	echo 最后訪問(wèn): %b:~0,4% 年 %b:~4,2% 月 %b:~6,2% 日 %b:~8,2% 時(shí) %b:~10,2% 分 %b:~12,2% 秒
	echo 最后修改: %c:~0,4% 年 %c:~4,2% 月 %c:~6,2% 日 %c:~8,2% 時(shí) %c:~10,2% 分 %c:~12,2% 秒
	)
	echo.
	pause

wmic 全盤搜索某文件并獲取該文件所在目錄
for /f "skip=1 tokens=1*" %i in ('wmic datafile where "FileName='qq' and extension='exe'" get drive^,path') do (set "qPath=%i%j"&@echo %qPath:~0,-3%)

獲取屏幕分辨率 wmic DESKTOPMONITOR where Status='ok' get ScreenHeight,ScreenWidth

wmic PageFileSet set InitialSize="512",MaximumSize="512"

設(shè)置虛擬內(nèi)存到E盤，并刪除C盤下的頁(yè)面文件,重啟計(jì)算機(jī)后生效

wmic PageFileSet create name="E://pagefile.sys",InitialSize="1024",MaximumSize="1024"
wmic PageFileSet where "name='C://pagefile.sys'" delete

獲得進(jìn)程當(dāng)前占用的內(nèi)存和最大占用內(nèi)存的大小：

wmic process where caption='filename.exe' get WorkingSetSize,PeakWorkingSetSize

以KB為單位顯示

復(fù)制代碼代碼如下:

	
	@echo off
	for /f "skip=1 tokens=1-2 delims= " %%a in ('wmic process where caption^="conime.exe" get WorkingSetSize^,PeakWorkingSetSize') do (
	set /a m=%%a/1024
	set /a mm=%%b/1024
	echo 進(jìn)程conime.exe現(xiàn)在占用內(nèi)存：%m%K；最高占用內(nèi)存：%mm%K
	)
	pause

遠(yuǎn)程打開(kāi)計(jì)算機(jī)遠(yuǎn)程桌面

wmic /node:%pcname% /USER:%pcaccount% PATH win32_terminalservicesetting WHERE (__Class!="") CALL SetAllowTSConnections 1

檢測(cè)是否插入U(xiǎn)盤的批處理

復(fù)制代碼代碼如下:

	
	@echo off
	((wmic logicaldisk where "drivetype=2" get name|find "無(wú)可用范例")>nul 2>nul)||for /f "skip=1 tokens=* delims=" %%i in ('wmic logicaldisk where "drivetype=2" get name') do echo U盤盤符是 %%i
	pause

rem 查看cpu
wmic cpu list brief
rem 查看物理內(nèi)存
wmic memphysical list brief
rem 查看邏輯內(nèi)存
wmic memlogical list brief
rem 查看緩存內(nèi)存
wmic memcache list brief
rem 查看虛擬內(nèi)存
wmic pagefile list brief
rem 查看網(wǎng)卡
wmic nic list brief
rem 查看網(wǎng)絡(luò)協(xié)議
wmic netprotocal list brief

【例】將當(dāng)前系統(tǒng)BIOS，CPU，主板等信息輸出到一個(gè)HTML網(wǎng)頁(yè)文件，命令如下:

::得到系統(tǒng)信息.bat，運(yùn)行bat文件即可
::系統(tǒng)信息輸出到HTML文件,查看幫助: wmic /?
::wmic [系統(tǒng)參數(shù)名] list [brief|full] /format:hform >|>> [文件名]
wmic bios            list brief   /format:hform > PCinfo.html
wmic baseboard       list brief   /format:hform >>PCinfo.html
wmic cpu             list full    /format:hform >>PCinfo.html
wmic os              list full    /format:hform >>PCinfo.html
wmic computersystem list brief   /format:hform >>PCinfo.html
wmic diskdrive       list full    /format:hform >>PCinfo.html
wmic memlogical      list full    /format:hform >>PCinfo.html
PCinfo.html