Category: Windows

Introduction to the Utility Robocopy
Introduction

Robocopy (Robust Copy) is a command line tool for copying files in Windows. It replaces the older ‘copy’ command. It contains many new features and can copy files both to an external hard drive or a remote computer.

Before you can copy files to an external hard drive, you need to create a folder on the destination drive first and set the permission on that folder to ‘Everyone’ (see below). I like to somewhat mirror the folder structure of the source and destination files. It makes for an easy reference, when you need to look for the files on the backup.

Command Layout

The three primary copy switches are /E, /S, and /MIR. They will copy just the data, attributes, and timestamps (/COPY:DAT), and not file permissions. The default behavior (not using any switches) of robocopy is to copy only newer files and overwrite the older files at the destination.

The basic format of the command.
```
robocopy <source directory> <destination directory> <file to copy> <switches>
```
If you are copying files you are not the owner of, you will need to run the the command prompt as an Administrator and use the /B switch to override the file and folder permissions. You will typically want to use the /Z if coping files over a network and you want to exclude Hidden and System files. The /TEE switch is only necessary if it is an attended backup. Finally, I like to drop a log file in the backup folder in case I need to review anything.

Copy Switches
- /L Test the command before you execute it.
- /S Do not copy empty directories.
- /E Copy all directories, including empty ones.
- /MIR Sync a directory. (Caution! If a file is deleted in source, will be deleted in destination).
- /B Copy in backup mode. Copy all files regardless of permissions. (Needed if copying files other than your own. Run command prompt as an Administrator).
Network Switches
- /Z Use Restart mode, Start copy where you left off. (Needed when possible network interference).
- /ZB Use Restart mode & Backup mode. (Needed when coping over a network).
- /W:2 Wait time between retries. (Needed when copying over a network).
- /R:1 The number of retries, if the file is locked. (Needed when coping over a network).
Exclude Switches
- /XA:H Exclude files with the attribute Hidden. (Typically want to use this switch)
- /XA:S Exclude files with the attribute System. (Typically always want to use the switch).
- /XA:SH Exclude System and Hidden files (Needed when coping a User’s Profile).
- /XJ exclude junction points. (Needed when coping a User’s Profile).
- /FTT format in FAT32 File system. (Needed if backing up files to a Linux host).
- /XD exclude directory. Use if you want to exclude some Hidden files and not others.
Logging Switches
- /NFL Don’t log file names of copied files.
- /NDL Don’t log directory names. (Include if using a log file).
- /NP Suppress % copied output to a log file. (Include if using a log file).
- /LOG:/F:\backup.log Writes output to a log file.
- /LOG+:F:\file.log Append output to an existing log file.
- /TEE Write output to the console window AND the log file.
Get Help
```
robocopy /?
```
Copy Files to an External Drive

Copy one or two files. If you have spaces in the file path, be sure to enclose in quotes.
```
robocopy "C:\users\username\desktop\folder 1" D:\backup file1.txt 
robocopy "C:\users\username\desktop\folder 2" D:\backup file1.txt file2.pdf
```
Copy files that end with pdf or begin with Sam. The * is a wildcard.
```
robocopy "C:\users\username\desktop\folder 1" "D:\backup\folder 2" *.pdf
robocopy "C:\users\username\desktop\folder 1" "D:\backup\folder 2" Sam.*
```
Copy all files & folders on the desktop, & make a log file. Also, show the results on the screen as the command is running.
```
robocopy C:\Users\John\Desktop D:\backup\Desktop /MIR > C:\backup.log /TEE
```
Copy a user’s profile (MIR), exclude the junction points (XJ), system files (XA:S), and the user’s “AppData” folder (XD). Suppress the percent copied results (NP). Junction points are a kind of soft link or a shortcut. The copy process could get stuck in a copy loop if you do not exclude. This will still copy any other hidden files. Output results to screen and log file (TEE & LOG).
```
robocopy "C:\Users\John" "D:\backup\Users\John" /MIR /XA:S /XD "c:\Users\John\AppData" /XJ /TEE /NP /LOG:F:\backup\backup.log
```
Copy Files to a remote PC

Copy a directory, subdirectories, and files to a remote computer.
```
robocopy C:\Data \\PCName\c$\Data /MIR /Z /R:2 /W:1 
```
Copy a directory, subdirectories, and files, but excluding system & hidden files, to a remote Linux PC.
```
robocopy C:\Data \\NAS\data /MIR /W:0 /R:1 /XA:SH /FFT 
```
Step-By-Step Guide to Backup Your Files

Begin by plugging in a USB stick into any open port on the PC. In our example, it shows up as “Drive F”. Now, make a new folder called F:\backups.

Set the permissions on the new folder to ‘Everyone’ by right clicking on the folder, go to properties, security tab, select add group or username, and select check names. Be sure to verify that the “Everyone” has all the allow permissions.

Now, any folders or files copied to the “backup” folder during the backup, should inherit the same permissions. (i.e. Everyone).

If you don’t do this and you need to access the files on a PC other than the original computer, you may not be able to open the files. This is because you are not logged in as the original user that ran the backup. But, with folder permissions set to Everyone, you can plug the external drive or USB stick into any computer, and you will have full access to the copied files.

Make a Backup Script

We will backup the contents of a generic folder and two user’s profiles. It will copy to an external hard drive and also to a remote windows computer. For this example, we are logged in as a user called Jack and it is an “admin” account, so we can be granted rights to copy files of other users.

First, we will start by coping all files in a folder called “Data”. Since we don’t know who owns this folder, we will use the /B switch to overwrite any potential permissions issues. Finally, we will make a log file but exclude the percent copied for each file. As this unnecessary clogs up the log output.
```
rem backup.bat
robocopy C:\Data F:\backups\data /MIR /B /NP /LOG:F:\backup.log
```
Next, we can now copy Jack and Jill’s profiles. Jack’s profile, we will exclude all hidden files, system files, and junction points. Since his “AppData” folder is already hidden, we do not need to specifically exclude it.

In Jill’s profile, we have several hidden files that we want to copy that contain her SSH keys. So, we will not create a blanket exclusion for all hidden files. Instead, we will exclude her “AppData” folder specifically. Finally, we will add to the previously created log file, but again we will exclude the total percent copied. Also, we need to add her file using the /B switch to copy in backup mode.
```
robocopy C:\Users\Jack F:\backups\Jack /MIR /XA:SH /XJ /NP /LOG+:F:\backup.log
robocopy C:\Users\Jill F:\backups\Jill /MIR /XA:S /XD C:\Users\John\AppData /B /XJ /NP /LOG+:F:\backup.log
```
Finally, copy the same files to a remote computer for a secondary backup. As before, we will use the /MIR switch to make an exact duplicate folder tree, /B to run in backup mode and exclude the System, Hidden, Junction Points, and specifically exclude Jill’s “AppData” folder. Also, we use the /Z (restart mode), /R (retry) and /W (wait) in case there are network issues.
```
robocopy C:\data \\PCName\c$\backups\data /MIR /ZB /XA:SH /XJ /R:1 /W:1 
robocopy C:\Users\Jack \\PCName\c$\backups\Jack /MIR /ZB /XA:SH /XJ /R:1 /W:1 
robocopy C:\Users\Jill \\PCName\c$\backups\Jill /MIR /ZB /XA:S /XD C:\Users\Jill\AppData /XJ /R:1 /W:2
```
Save and Execute the Script

Save the script to Jack’s desktop as backup.bat. To run the script, open a command prompt as an Admin, and navigate to Jack’s desktop. Type the script name and hit enter. To run the script nightly, you can set up a scheduled task to execute.

References

https://ss64.com/nt/robocopy.html

http://caughtinpixels.com/how-to-create-a-backup-script-using-robocopy/
February 9, 2025
Tracking Communications with Netstat & TCPView
Netstat on the Command Line

Netstat is a built in utility typically used to troubleshoot remote connection issues. It is also be used to see what external IPs and URLs your computer is actively communicating with and to what ports are passively open waiting for a connection. To run netstat, launch the Command Prompt in administrator mode.

It is important to remember that running the command is a one and done. It does not auto refresh unless you tell it to using a switch. To get a list of switches, run “netstat /?“. The most important for netstat switches are:

-a = Display all connections and listening ports
-b = Display the executable involved.
-f = Display FQDN.
-n = Display IP and ports in number format.
-o = Display process ID associated with the connection.
-r = Display routing table.

Let’s go over some commands. First, ‘netstat -ab’ is unusually slow to provide results and the results are not in a easy to read format. For this reason many users do not like it. But it will provide the process name that opened or established the connection.
```
netstat -ab
```
Next is ‘netstat -ano’. It provides very fast results, but does not provide the name of the running service. However, you can get the process ID’s and then lookup the running process in task manager to find the service or executable. Finally, you can lookup up the foreign addresses in an online URL lookup to find the ‘whois’ or the IP registration.
```
netstat -ano
```
Display the TCP active connections with the FQDN.
```
netstat -p tcp -f
```
You can pipe the results from netstat to include only specific outputs.
```
netstat -ano | findstr "ESTABLISHED"
```
You can pipe to exclude results by using the /V switch.
```
netstat -ano | findstr /V "127.0.0.1" | findstr /V "0.0.0.0"
```
Using TCPView

Think of TCPView (or the older CURRPorts) as a netstat GUI interface. TCPView is produced by Microsoft System Internals and is actively supported. It is easier to read then the command line, auto refreshed every 2 seconds, and provides both fast results as well as the process name.

You can quickly track down what service is attempting to make an external connection, what remote IP or URL it is communicating with, and over what port. The results can be combined with some google searches to get a complete picture. I find it easier than trying to interpret the netstat command line results.

The color scheme is tricky. Red means a connection is about to close, green means a connection was just opened, and yellow means a connection has just refreshed. Notice the green bar in the picture below.
January 13, 2025
Run a Script using Windows Task Scheduler
Begin

By default, a task will only run when a user is logged in. If you want to run a task after hours or over night, you will need to select “run whether the user is logged in or not” and “run with highest privilege’s”, so it runs in admin mode. Finally, you will need to add the user to the local admin group.

Some blog posts will say, you still can get a task to run if a regular user is not logged in. You can add the user to the local security group policy under “logon as a batch job” by going to secpol.msc, security settings, user rights assignment, logon as batch job, and add the user. I tested this multiple times and could not get this method to work when attempting to run a PowerShell script. Perhaps, this only works for true batch scripts.

Let’s assume, I want to run a PowerShell script every hour of every day (i.e. 24 x7). First, check if your user is a local administrator. Go to Computer management, system tools, local users and groups, administrators. Verify he is included.

Run the task scheduler and select create a task.

General Tab

Configure the Name, User account, Run whether the users is logged on or not, and Run with highest privileges, as it needs to run in admin mode when the user is logged out. Next, select Configure for Windows 10.

Triggers Tab

Select to run starting at 1:00 PM, every hour, and verify the task is enabled.

Action Tab

The script must be stored under the local user’s profile to get it to execute!! i.e. C:\users\username\tasks\yourscript.ps1.

Program: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Argument: -nologo -ExecutionPolicy Bypass -windowstyle Hidden -file C:\Users\user1\scripts\report.ps1

Common PowerShell arguments are:
- -NoProfile, meaning do not load the users profile (use when you have custom setting in the script).
- -ExecutionPolicy Bypass, means allow the script to run with no conditions (i.e. it is not signed).
- -Windowstyle Hidden, means do not display the PS window.
- -nologo, means to suppress the PS copyright info when PS starts (provides a cleaner process).
- -file /path/filename.ps1, enter full path to your script.
Conditions Tab

Make no changes.

Settings Tab

Make no changes. Do not enable “if task fails. then restart”. If your password expires, it will keep locking your AD account.
October 11, 2024
Split Text Data into Columns Using Microsoft Excel

Split out data from Excel

A common task to perform is when you have data in a text file and you need to copy and paste the data into excel and then split the date into columns. Unfortunately, when you do this it will put all the date in a single column. You have to then split out the date into columns using the below method.

Process

Highlight and copy date from notepad.

Paste data into excel. All data will be pasted into the first column only!

Select data, text to column, delimited, and then next.

Select the items you want to use as separators, usually tabs and spaces. Then hit next or finish.

October 10, 2024
Change Windows Cmd Line Startup Folder

Change Default Startup Path for Command Prompt

Right click on the command prompt then select properties. On shortcut tab, change “Start in:”

September 29, 2024
Start Encrypting Your Files in Windows
Getting Started

File encryption adds a level of security to your critical files. In Windows, you can create an encrypted folder and it will auto encrypt any files you drop into the folder.

Windows uses the Encrypted File System (EFS) platform. The first time you encrypt a file, it will auto generates a key set and a certificate. Windows manages the encryption for you on the backend. In other words, once you set it all up, it will automatically decrypt a file when you open it, and encrypt it when you close the file.

After you set up a folder in windows and encrypt it, any files you drop into that folder will automatically be encrypted too. No need to set the encryption on each file.

Check to see if your files are already encrypted.

Does the folder or file has a lock on it?

An alternate method, is to go to the file, right click, select details, check the attributes for the E flag. (Note: The A flag means the archive bit is set).

Finally, you can open a command prompt and run cipher.
```
ciper /s:Users/user1/Desktop/test
```
Here are two folders, one has encrypted files inside it and one does not.

Encrypt a folder or files

The easiest way to encrypt multiple files is to create an encrypted folder and drop files into it. Make a new folder on the desktop, right click on folder, select properties, go to general tab, select advanced button, and check the encrypt box.

After you see the lock icon on the folder, this means the folder is encrypted. Any files you drop into it, will automatically be encrypted too and will display the lock icon. If you drag the the file outside the folder, it will remain encrypted.

Note: the lock symbol does not always show up right away after you encrypt a file/folder, don’t panic.
September 25, 2024