I professionisti IT potrebbero avere la necessità di estrarre i file di registro da uno o più computer per la diagnostica di un problema. Questa operazione viene eseguita al meglio tramite strumenti di gestione remota, ma può essere eseguita anche tramite scripting. La sezione Allegati di questo articolo include un collector registri di esempio che può essere eseguito o modificato per soddisfare la maggior parte delle esigenze.
Dettagli dello script:
C:\Users\<Current User>\AppData\Roaming\
9af4c403c997dcebdba49b6251565a5c
3a8bb6d3a75ebe14ffc631fe68dcfa308eaf3691
4917c7f2e0d8d6111159cfe18b8dc9ca6cf04ff4467166d65435e3b8e07a5e2b
.cmd
Il file viene visualizzato come icona Blocco note e si apre come Blocco note quando si clicca due volte
.cmd
e altri file di script..bat
file invece?
.cmd
e .bat
file che includono differenze di contesto e sicurezza..cmd
..bat
..txt
file contenere?
Registri raccolti | Percorso del registro ZIP | Comando utilizzato | Richiede l'amministratore | Tipo di comando | URL di riferimento Microsoft/Dell | 2.3 Cambiamento |
---|---|---|---|---|---|---|
Registri eventi delle applicazioni | \Logs\OperatingSystem\Event Logs\application_eventlog.evtx |
wevtutil epl Application /q:"*[System[(Level<=5)]]" application_eventlog.evtx |
No | Riga di comando | https://learn.microsoft.com/windows/win32/wes/windows-event-log |
0 |
Elenco pacchetti Appx | \Logs\Application\installed_appx.txt |
Get-AppxPackage | Select PackageFullName | Sort PackageFullName |
Sì | PowerShell | https://learn.microsoft.com/powershell/module/appx/get-appxpackage?view=windowsserver2022-ps |
0 |
Elenco degli stati di sospensione disponibili | \Logs\Power\available_sleepstates.txt |
powercfg /a |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Report sulla batteria | \Logs\Power\Battery_Report.html |
powercfg /batteryreport /output Battery_Report.html /duration 14 |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Informazioni su BCD | \Logs\OperatingSystem\bcd.txt |
bcdedit |
Sì | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/bcdedit |
0 |
Elenco delle protezioni di BitLocker | \Logs\Security\bitlocker_PCRs.txt |
manage-bde %SYSTEMDRIVE% -protectors -get -type TPM |
Sì | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/manage-bde |
0 |
Stato di BitLocker | \Logs\Security\bitlocker_status.txt |
manage-bde -status |
Sì | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/manage-bde |
0 |
Elenco delle schede a banda larga | \Logs\Network\broadband_adapter.txt |
netsh mbn show interfaces |
No | Riga di comando | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Elenco dei timer di riattivazione configurati | \Logs\Power\waketimers.txt |
powercfg /waketimers |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Registro Dell Command | Update | \Logs\Dell\Dell_Command_Update\Activity.log |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\UpdateService\Log |
Sì | Riga di comando | Dell Command | Update | 0 |
Registri di Dell Data Migrate (destinazione) | \Logs\Dell\Dell_Data_Migrate_Destination\(Various files) |
XCOPY /s /I /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\SupportAssist\CDM\Logs . |
Sì | Riga di comando | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/ | 0 |
Registri di Dell Data Migrate (origine) | \Logs\Dell\Dell_Data_Migrate_Source\(Various Files) |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\DDA\logs\ . |
Sì | Riga di comando | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/introduction?guid=guid-28c0bb91-e84d-4118-99ee-e5500769b170 e | 0 |
Registri di Dell Digital Delivery | \Logs\Dell\Dell_Digital_Delivery\ |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\dell\D3\Resources\Logs\ |
Sì | Riga di comando | https://www.dell.com/support/contents/article/product-support/self-support-knowledgebase/software-and-downloads/download-center/dell-digital-delivery | 0 |
Informazioni di caricamento in fabbrica Dell | \Logs\Dell\FactoryLoad\dell.sdr |
XCOPY /y /q /F %SYSTEMDRIVE%\dell.sdr |
No | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
0 |
Registri di Dell Optimizer | \Logs\Dell\Dell_Optimizer\* |
*XCOPY command copies multiple AppData files specific to Dell Optimizer* |
No | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
1 |
Registri del Dell Update Package | \Logs\Dell\Dell_Update_Package\* |
XCOPY /s /y /q /F %SYSTEMDRIVE%\ProgramData\Dell\UpdatePackage\Log . |
No | Riga di comando | Dell Command | Update | 0 |
Report dettagliato dei driver | \Logs\Driver\driver_details.txt |
Get-WmiObject Win32_PnPSignedDriver | select * |
No | PowerShell | https://learn.microsoft.com/previous-versions/windows/desktop/legacy/aa394354(v=vs.85) |
0 |
Registro di diagnostica DirectX | \Logs\Graphics\DXdiag.txt |
dxdiag.exe /t DXdiag.txt |
No | Riga di comando | https://support.microsoft.com/windows/open-and-run-dxdiag-exe-dad7792c-2ad5-f6cd-5a37-bf92228dfd85 |
0 |
Elenco driver | \Logs\Driver\driver_list.txt |
Get-WmiObject Win32_PnPSignedDriver| select devicename, driverversion, driverdate | Sort-Object devicename |
No | PowerShell | https://learn.microsoft.com/previous-versions/windows/desktop/legacy/aa394354(v=vs.85) |
0 |
Elenco archivio driver | \Logs\Driver\driver_store.txt |
dism /online /get-drivers /all /format:table |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/manufacture/desktop/what-is-dism?view=windows-11 |
0 |
Driver in stato di errore | \Logs\Driver\error_state_drivers.txt |
Pnputil /enum-devices /problem /ids |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/drivers/devtest/pnputil |
1 |
Report sull'energia | \Logs\Power\energy.html |
powercfg /energy /output energy.html |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Oggetti policy gruppo | \Logs\OperatingSystem\GPO_List.html |
start /min gpresult /H GPO_List.html |
No | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/gpresult |
0 |
Elenco applicazioni installate | \Logs\Application\installed_apps.txt |
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object InstallDate |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-7.3 |
0 |
Configurazione IP | \Logs\Network\ipconfig_all.txt |
ipconfig /all |
No | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/ipconfig |
0 |
Ultimo trigger di riattivazione | \Logs\Power\lastwake.txt |
powercfg /lastwake |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Dump della memoria (kernel completo) | \Logs\MemoryDumps\memory.dmp |
XCOPY /y /q /F %SYSTEMROOT%\memory.dmp |
No | Riga di comando | https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/xcopy |
0 |
Dump della memoria (minidump) | \Logs\MemoryDumps\*.dmp |
XCOPY /s /I /y /q /F %SYSTEMROOT%\minidump\*.dmp |
Sì | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/xcopy |
0 |
Dump della memoria (stato/dettagli) | \Logs\Operating System\DumpStatus.txt |
IF EXIST %SYSTEMROOT%\memory.dmp |
Sì | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/if |
0 |
Stato della gestione della memoria | \Logs\System\MemoryManagement.html |
Get-mmagent | Out-File MemoryManagement.html |
Sì | PowerShell | https://learn.microsoft.com/powershell/module/mmagent/get-mmagent?view=windowsserver2022-ps |
1 |
Microsoft System Information (MSinfo32) | \Logs\OperatingSystem\msinfo32.nfo |
start msinfo32 /nfo msinfo32.nfo |
No | Riga di comando | https://support.microsoft.com/topic/description-of-microsoft-system-information-msinfo32-exe-tool-10d335d8-5834-90b4-8452-42c58e61f9fc |
0 |
Informazioni sul monitor | \Logs\Graphics\monitor.txt |
Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorID | ForEach-Object {if ($_.UserFriendlyNameLength -gt 0) {($_.ManufacturerName -ne 0 | foreach {[char]$_}) + [char] 10 + 'InstanceName: ' + ($_.InstanceName) + [char] 10 + ($_.UserFriendlyName -ne 0 | foreach {[char]$_}) + [char] 10 + 'Serial: ' + ($_.SerialNumberID -ne 0 | foreach {[char]$_}) + [char] 10 + 'ProdCodeID: ' + ($_.ProductCodeID -ne 0 | foreach {[char]$_}) + [char] 10 + 'WeekOfManufacture:' + $_.WeekOfManufacture + [char] 10 + 'YearOfManufacture:' + $_.YearOfManufacture + [char] 10 + 'DisplayActive:' + $_.Active + [char] 10 -join ''} else{($_.ManufacturerName -ne 0 | foreach {[char]$_}) + [char] 10 + 'InstanceName: ' + ($_.InstanceName) + [char] 10 + ('No Model (Likely Internal LCD)') + [char] 10 + 'Serial: ' + ($_.SerialNumberID -ne 0 | foreach {[char]$_}) + [char] 10 + 'ProdCodeID: ' + ($_.ProductCodeID -ne 0 | foreach {[char]$_}) + [char] 10 + 'WeekOfManufacture:' + $_.WeekOfManufacture + [char] 10 + 'YearOfManufacture:' + $_.YearOfManufacture + [char] 10 + 'DisplayActive:' + $_.Active + [char] 10 -join ''}} |
No | No | https://learn.microsoft.com/windows/win32/wmicoreprov/wmimonitorid |
0 |
Registro delle proprietà avanzate della scheda di rete | \Logs\Network\net_adapter_adv_properties.txt |
Get-NetAdapterAdvancedProperty |
No | PowerShell | https://learn.microsoft.com/powershell/module/netadapter/get-netadapteradvancedproperty?view=windowsserver2022-ps |
0 |
Versione del sistema operativo e data di installazione | \Logs\LogCollectorStatus.txt |
(Get-WMIObject -class Win32_ComputerSystem | Select-Object Model| Format-List | Out-string).Trim(); (Get-WMIObject -class Win32_OperatingSystem | Select-Object Caption, Version| Format-List| Out-string).Trim(); (Write-Output 'OS Install Date:').Trim(); ((Get-Item 'C:\Windows\system.ini').CreationTime | Out-String).Trim() |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-operatingsystem |
0 |
Elenco dispositivi PnP | \Logs\Operating System\pnp_devices.txt |
Get-CimInstance Win32_PnPEntity |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-pnpentity |
0 |
Richieste di alimentazione | \Logs\Power\power_requests.txt |
powercfg /requests |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Dettagli delle combinazioni per il risparmio di energia | \Logs\Power\powerschemes.txt |
powercfg /query |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Elenco delle combinazioni per il risparmio di energia | \Logs\Power\power_schemes.html |
powercfg /list |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Elenco processi | \Logs\OperatingSystem\ processes.txt |
Get-WmiObject -Class Win32_Service | Select-Object -Property Name, ProcessID |
No | PowerShell | https://learn.microsoft.com/powershell/module/scheduledtasks/get-scheduledtask?view=windowsserver2022-ps |
0 |
Pacchetti di provisioning | \Logs\Application\installed_provisioning_packages.txt |
Get-ProvisioningPackage |
No | PowerShell | https://learn.microsoft.com/powershell/module/provisioning/get-provisioningpackage?view=windowsserver2022-ps |
0 |
Elenco delle attività pianificate | \Logs\OperatingSystem\taskscheduler.txt |
Get-ScheduledTask | Where State -ne "Disabled" | Get-ScheduledTaskInfo |
No | PowerShell | https://learn.microsoft.com/powershell/module/scheduledtasks/get-scheduledtask?view=windowsserver2022-ps |
0 |
Codice di matricola | Part of File Name |
Get-CimInstance -ClassName Win32_BIOS -Property SerialNumber | Select-Object -ExpandProperty SerialNumber |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-bios |
0 |
Codice di matricola e ID baseboard | \Logs\System\System_Board.txt |
Get-CimInstance -ClassName Win32_BaseBoard | Format-List |
No | PowerShell | https://www.dell.com/support/manuals/data-assistant/migrate_1.0_ug/introduction?guid=guid-28c0bb91-e84d-4118-99ee-e5500769b170 | 1 |
Elenco dei servizi | \Logs\OperatingSystem\services.txt |
Get-Service | Sort Status |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-service?view=powershell-7.3 |
0 |
Report sullo studio del passaggio allo stato di sospensione | \Logs\Power\sleepstudy.html |
powercfg /sleepstudy /output sleepstudy.html |
Sì | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Elenco processi di avvio | \Logs\Application\startup_processes.txt |
Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-startupcommand |
0 |
Elenco dei dispositivi di storage | \Logs\Storage\Disk_Drives.txt |
Get-CimInstance -ClassName Win32_DiskDrive | select * | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-diskdrive |
0 |
Volumi di storage | \Logs\Storage\Disk_Volumes.txt |
Get-CimInstance -ClassName Win32_DiskPartition | Format-List |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/Win32-DiskPartition |
0 |
Modello del sistema | Part of File Name |
Get-WMIObject -class Win32_ComputerSystem | Select-Object -ExpandProperty Model |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-computersystem |
0 |
Informazioni su TPM | \Logs\Security\tpm.txt |
get-tpm |
Sì | PowerShell | https://learn.microsoft.com/powershell/module/trustedplatformmodule/get-tpm?view=windowsserver2022-ps |
0 |
Elenco dei dispositivi USB | \Logs\USB\usb_devices.txt |
gwmi Win32_USBControllerDevice |%%{[wmi]($_.Dependent)} | Sort Manufacturer,Name,Description,DeviceID | Ft -GroupBy Manufacturer Name,Description,Service,DeviceID |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-usbcontrollerdevice |
0 |
Dettagli della scheda video | \Logs\Graphics\video.txt |
Get-WmiObject win32_videocontroller | select * |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller |
0 |
Dettagli della risoluzione video | \Logs\Graphics\video.txt |
Get-WmiObject win32_videocontroller | select caption, CurrentHorizontalResolution, CurrentVerticalResolution, CurrentRefreshRate, DriverVersion |
No | PowerShell | https://learn.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller |
0 |
Elenco dei dispositivi riattivati | \Logs\Power\device_wake_armed.html |
powercfg -devicequery wake_armed |
No | Riga di comando | https://learn.microsoft.com/windows-hardware/design/device-experiences/powercfg-command-line-options |
0 |
Registri eventi di sistema di Windows | \Logs\OperatingSystem\Event Logs\system_eventlog.evtx |
wevtutil epl System /q:"*[System[(Level<=5)]]" system_eventlog.evtx |
No | Riga di comando | https://learn.microsoft.com/windows/win32/wes/windows-event-log |
0 |
Registro Systeminfo di Windows | \Logs\LogCollectorStatus.txt |
Systeminfo |
No | Riga di comando | https://learn.microsoft.com/windows-server/administration/windows-commands/systeminfo |
0 |
Elenco di Windows Update | \Logs\OperatingSystem\WindowsUpdateLog.txt |
Get-WindowsUpdateLog |
No | PowerShell | https://learn.microsoft.com/powershell/module/windowsupdate/get-windowsupdatelog?view=windowsserver2022-ps |
0 |
Registro di Windows Update | \Logs\OperatingSystem\hotfixes.txt |
Get-hotfix |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-hotfix?view=powershell-7.3 |
0 |
Elenco delle reti cablate | \Logs\Network\current_wired_network_interfaces.txt |
netsh lan show interfaces |
No | Riga di comando | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Profili delle reti cablate | \Logs\Network\wired_profiles.txt |
netsh lan show profiles |
No | Riga di comando | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Impostazioni della rete cablata | \Logs\Network\wired_settings.txt |
netsh lan show settings |
No | Riga di comando | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Report delle reti wireless | \Logs\Network\wlan-report-latest.html |
netsh wlan show wlanreport duration=30 && copy /y %ProgramData%\microsoft\windows\wlanreport\wlan-report-latest.html . && copy /y %ProgramData%\Microsoft\Windows\wlanreport\wlan-report-latest.cab . |
Sì | Riga di comando | https://learn.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts |
0 |
Aggiornamento/aggiornamento di Windows | \Logs\OperatingSystem\windows_upgrade_history |
get-itemproperty -path 'HKLM:\SYSTEM\Setup\Source OS*' | SELECT PSChildName, Productname, ReleaseId, DisplayVersion, CurrentBuild |
PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-itemproperty?view=powershell-7.4 |
1 | |
Visualizza Stream Compression | Logs\Graphics\Display_Stream_Compression_status.txt |
REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\Class /s /v DPMstDscDisable > Display_Stream_Compression_status.txt |
No | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/reg-query |
1 |
Generazione di dispositivi PCIe e velocità di collegamento | \Logs\System\PCIe_Device_Info.txt |
(Get-WMIObject Win32_Bus -Filter 'DeviceID like "PCI%%"').GetRelated('Win32_PnPEntity') | foreach { [pscustomobject][ordered]@{Name = $_.Name; ExpressSpecVersion=$_.GetDeviceProperties('DEVPKEY_PciDevice_ExpressSpecVersion').deviceProperties.data;MaxLinkSpeed=$_.GetDeviceProperties('DEVPKEY_PciDevice_MaxLinkSpeed').deviceProperties.data; MaxLinkWidth=$_.GetDeviceProperties('DEVPKEY_PciDevice_MaxLinkWidth').deviceProperties.data; CurrentLinkSpeed=$_.GetDeviceProperties('DEVPKEY_PciDevice_CurrentLinkSpeed').deviceProperties.data; CurrentLinkWidth=$_.GetDeviceProperties('DEVPKEY_PciDevice_CurrentLinkWidth' ).deviceProperties.data} | Where MaxLinkSpeed } | Format-Table -AutoSize; |
No | PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 |
1 |
Impostazioni del BIOS | \Logs\System\BIOS_Settings.txt |
Get-CimInstance -Namespace root\dcim\sysman\biosattributes -ClassName EnumerationAttribute | Select-Object AttributeName, CurrentValue, Defaultvalue, PossibleValue |
Sì | PowerShell | https://learn.microsoft.com/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.4 |
1 |
Elenco comandi ignorati Dell | \Logs\Dell\Dell_Command_Update\Update_Ignore_List.txt |
REG QUERY HKLM\SOFTWARE\DELL\UpdateService\Service\IgnoreList /s /v InstalledUpdateJson |
No | PowerShell | https://learn.microsoft.com/windows-server/administration/windows-commands/reg-query |
1 |
Impostazioni di Dell Optimizer | \Logs\Dell\Dell_Optimizer\user_settings.txt |
do-cli /get |
No | Riga di comando | https://www.dell.com/support/manuals/dell-optimizer/dell-optimizer-4.0_ug/command-line-interface-for-dell-optimizer?guid=guid-a82481c9-8abf-4a15-9f2b-6011e36c6b19 e |
1 |