Table of Contents
Table of Contents

An often overlooked part of the CimTrak software product suite is the CimTrak Flex Module.  The Module can be very powerful when used with the right collection of commands. Imagine any output you can think of in DOS, combined with CimTrak's advanced monitoring. You can compare outputs for IP configurations, DNS zones, and settings, running Windows services, port status, or just about anything! When using Flex within CimTrak, you will be notified when any change in any output has been made. Utilizing CimTrak's compare tool you can even see pre-change vs. post-change output and easily zoom in on the exact change.

 Here are some cool example commands you can use with the Flex Module:

IP Address/DHCP/DNS - Ipconfig displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. This could be useful to monitor if you were interested in any of your node’s IPs being changed or network configuration updated.

ipconfig

Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings.

ipconfig /all

To renew a DHCP-assigned IP address configuration for only the Local Area Connection adapter, type:

ipconfig /displaydns : Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. The DNS Client service uses this information to resolve frequently queried names quickly, before querying its configured DNS servers.

 

DNS (Must be executed from the node DNS is running from) - DNSCmd displays and changes the properties of DNS servers, zones, and resource records. It manually modifies these properties, creates and deletes zones and resource records, and forces replication events between DNS server physical memory and DNS databases and data files. Some operations of this tool work at the DNS server level while others work at the zone level.

Note - Depending on whether you are on a 32 or 64-bit operating system, these commands will vary because dnscmd.exe is held in different directories. C:\windows\sysnative is 32 bit and C:\windows\system32 is 64 bit.

 

C:\windows\sysnative\dnscmd.exe /zoneprint [Domain Server] | findstr /b /l /c:";" /v

On a 32bit system, this will list the records in a zone with almost all their attributes.

C:\windows\system32\dnscmd.exe /zoneprint [Domain Server] | findstr /b /l /c:";" /v

On a 64bit system, this will list the records in a zone with almost all their attributes. 

C:\windows\system32\dnscmd.exe /info

Displays settings from the DNS section of the registry of the specified server

C:\windows\system32\dnscmd.exe /enumzones

Lists zones that exist on the specified DNS server.

To filter zones in this command you can use these parameters:

C:\windows\system32\dnscmd.exe /enumzones /primary

Lists all zones that are either standard primary or Active Directory-integrated.

C:\windows\system32\dnscmd.exe /enumzones /secondary

Lists all standard secondary zones.

C:\windows\system32\dnscmd.exe /enumzones /forwarder

Lists zones that forward unresolved queries to another DNS server.

C:\windows\system32\dnscmd.exe /enumzones /stub

Lists all stub zones.

C:\windows\system32\dnscmd.exe /enumzones /cache

Lists only the zones that are loaded into cache.

C:\windows\system32\dnscmd.exe /enumzones /auto-created

Lists the zones that were created automatically during the DNS server installation.

C:\windows\system32\dnscmd.exe  [Domain Server] /zoneinfo [ZoneName] /zoneinfo

Displays settings from the section of the registry of the specified zone

C:\windows\system32\dnscmd.exe /statistics

Displays or clears data for a specified DNS server.

 

This is just the tip of the iceberg as far as commands can be run.  We will explore others in future posts.

TrustedFileRegistry

Justin Chandler
Post by Justin Chandler
August 18, 2014
Justin is a CimTrak expert. By working closely with customers and partners to complete production environments, providing pre/post sales support, and dabbling in development, he has seen it all.

About Cimcor

Cimcor’s File Integrity Monitoring solution, CimTrak, helps enterprise IT and security teams secure critical assets and simplify compliance. Easily identify, prohibit, and remediate unknown or unauthorized changes in real-time