Searching for a DHCP Lease by MAC Address

Update Note, if you are looking to search for DHCP information across all or multiple DHCP servers in the forest then this is a quicker method. The below is still valid if you are searching a single server. Sometimes in a large infrastructure it can be hard to find new devices added to the network. Being able to search on MAC address across all DHCP scopes comes in handy. With powershell and Windows DHCP server this is easy to do.
Read more →

Reporting the Machine Hardware Model Number from Windows

You can pull this information from wmi. This method is useful when you are on the other side of the world to the machine you are working on. All you need is a local or remote shell via psexec or powershell, and type the following: wmic csproduct get name Here are some sample results: Name HP Z420 Workstation Name PRIMERGY BX924 S4 Name ProLiant DL380 G7
Read more →

Batch Convert Images

The quickest way of converting image formats is to use ImageMagick. There are binary releases for most popular operating systems, however in my case I’m using it on OS X. So to install using brew from a terminal use: brew install imagemagick Once that is installed then just move to the folder you are interested in and use the following: mogrify -format png *.jpg Once that is completed the folder of jpegs should now have some png friends to play with.
Read more →

Active Directory Forest Wide User Search

I always have to look this up, I’m not sure what is going on with my memory: dsquery user forestroot -name search When you are working on large Active Directories this is somewhat handy. Just replace search with the name you are after, helpfully it supports wildcard.
Read more →

Finding the Exchange Mail Pickup and Replay Directory Folder Location in Your Exchange Infrastructure

Use the following powershell command to return the mail pickup folder location from all your Edge and Hub Transport servers. Get-TransportServer | Fl name, PickupDirectoryPath If you are interested in a single server add -Identity: Get-TransportServer -Identity "Server Name" | Fl name, PickupDirectoryPath Where “Server Name” is the Exchange box you are interested in.
Read more →

USB Network Interface Missing from Wireshark Interface List

I needed to do some packet capturing in windows, so I added a USB network interface to an ultra-book. Upon running wireshark the USB network adapter was conspicuous by its absence from the interface list. After a bit of mulling over I wondered if WinPCap was not aware of the adapter; as these days WinPCap runs as a service. The service is called NPF (NetGroup Packet Filter). So: net stop npf and
Read more →

Quick Method to List Disks in Windows

There are numerous ways to do this. However using the WMI from a command prompt does the job: wmic diskdrive list brief It is quick and easy to remember, having the benefit that it can be run remotely using a remote shell like Powershell or psexec. Sample output: C:\windows\system32>wmic diskdrive list brief Caption DeviceID Model Partitions Size LITEONIT LMT-128M3M \.\PHYSICALDRIVE0 LITEONIT LMT-128M3M 2 128034708480 Even though it is easy to remember, I’m putting it here as I’ll forget.
Read more →

Unable to use Wireless and Wired Connections In Windows 8

I needed to do this recently and had a few issues. I guess it is not often required to have multiple connections but every now and then it crops up. Historically drivers sometimes caused issues and usually down to power options, understandability to reduce load on batteries. However this time it turned out to be windows that is effecting things. Cutting a long story short, to find the culprit setting run:
Read more →

Finding out the Windows Cluster Size of a Volume

From an administrative command prompt type: fsutil fsinfo ntfsinfo d: The output will include: Bytes Per Cluster : 4096 In this case Bytes Per Cluster is 4096.
Read more →

Excluding or Including a Network/Subnet from Wireshark Results

You can use this wireshark filter to restrict results to the network you are interested in: ip.addr == 10.10.0.0/16 Since we are not specifying a source or destination (i.e. ip.src or ip.dst), the filter will match both. If you want to reverse it then: !(ip.addr == 10.10.0.0/16) I’ll often use the same method to filter the results on a specific IP address, preserving both ends of the conversation: ip.addr == 10.
Read more →