NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface.

Open the door of J: CD-ROM drive

nircmd.exe cdrom open j:

Close the door of Y: CD-ROM drive

nircmd.exe cdrom close y:

Increase the system volume by 2000 units (out of 65535)

nircmd.exe changesysvolume 2000

Decrease the system volume by 5000 units (out of 65535)

nircmd.exe changesysvolume -5000

Set the volume to the highest value

nircmd.exe setsysvolume 65535

Mute the system volume

nircmd.exe mutesysvolume 1

Unmute the system volume

nircmd.exe mutesysvolume 0

Switch the system volume between the mute and normal state.

nircmd.exe mutesysvolume 2

Create a shortcut on your desktop that switch the system volume between the mute and normal state.

nircmd.exe cmdshortcut "~$folder.desktop$" "Switch Volume" mutesysvolume 2

Turn off the monitor

nircmd.exe monitor off

Start the default screen saver

nircmd.exe screensaver

Put your computer in 'standby' mode

nircmd.exe standby

log off the current user

nircmd.exe exitwin logoff

Ask if you want to reboot, and if you answer 'Yes', reboot the computer.

nircmd.exe qboxcom "Do you want to reboot ?" "question" exitwin reboot

Turn off your computer

nircmd.exe exitwin poweroff

Turn off all computers specified in computers.txt !

multiremote copy "c:tempcomputers.txt" exitwin poweroff force

Dial to "My Internet" connection

nircmd.exe rasdial "My Internet"

Disconnect the "My Internet" connection

nircmd.exe rashangup "My Internet"

Make your Internet Explorer windows 75% transparent ! (192 / 256)

nircmd.exe win trans ititle "internet explorer" 192

Minimize all your Internet Explorer windows

nircmd.exe win min class "IEFrame"

Close all your Internet Explorer windows

nircmd.exe win close class "IEFrame"

Close all your Explorer windows (My Computer, folders, and so on)

nircmd.exe win close class "CabinetWClass"

Hide all your Internet Explorer windows

nircmd.exe win hide class "IEFrame"

Show all your Internet Explorer windows (after you made them hidden with previous example)

nircmd.exe win show class "IEFrame"

Center all top-level windows

nircmd.exe win center alltop

Remove the title bar of My Computer window.

nircmd.exe win -style title "my computer" 0x00C00000

Return the title bar of My Computer window that we removed in the previous example.

nircmd.exe win +style title "my computer" 0x00C00000

Set the My Computer window to right-to-left order (For hebrew and arabic languages)

nircmd win +exstyle title "my computer" 0x00400000

Set all child windows of My Computer window to right-to-left order (For hebrew and arabic languages)

nircmd win child title "my computer" +exstyle all 0x00400000

Create a shortcut on your desktop that closes all your Internet Explorer windows

nircmd.exe cmdshortcut " "~$folder.desktop$ "Close All IE" win close class "IEFrame"

Create a shortcut on your desktop that hides all your Internet Explorer windows

nircmd.exe cmdshortcut " "~$folder.desktop$ "Hide All IE" win hide class "IEFrame"

Create a shortcut on your desktop that shows back all your Internet Explorer windows

nircmd.exe cmdshortcut " "~$folder.desktop$ "Show All IE" win show class "IEFrame"

Set the Windows Calculator as top-most window (above all other windows)

nircmd.exe win settopmost title "Calculator" 1

Set the Windows Calculator back to regular window (non top-most window)

nircmd.exe win settopmost title "Calculator" 0

Create a shortcut to Windows calculator under Start Menu->Programs->Calculators

nircmd.exe shortcut "f:winntsystem32calc.exe" "~$folder.programs$Calculators" "Windows Calculator"

Hide the desktop window

nircmd.exe win hide class progman

Show the desktop window (After hiding it in previous example)

nircmd.exe win show class progman

Hide the start button on the system tray

nircmd.exe win child class "Shell_TrayWnd" hide class "button"

Show the start button on the system tray

nircmd.exe win child class "Shell_TrayWnd" show class "button"

Hide the clock on the system tray

nircmd.exe win child class "Shell_TrayWnd" hide class "TrayClockWClass"

Show the clock on the system tray

nircmd.exe win child class "Shell_TrayWnd" show class "TrayClockWClass"

Kill (terminate) all instance of Internet Explorer processes

nircmd.exe killprocess iexplore.exe

Create a shortcut on your desktop that opens the door of K: CDROM drive when you run it.

nircmd.exe cmdshortcut "~$folder.desktop$" "Open CDROM" cdrom open k:

Create a shortcut to NirSoft Web site on your desktop

nircmd.exe urlshortcut "http://www.nirsoft.net" "~$folder.desktop$" "NirSoft"

Add NirSoft Web site to your Favorities under Links folder.

nircmd.exe urlshortcut "http://www.nirsoft.net" "~$folder.favorites$Links" "NirSoft"

Create a shortcut to NirSoft Web site on the desktop of all computers listed in computers.txt

nircmd.exe multiremote copy "c:tempcomputers.txt" urlshortcut "http://www.nirsoft.net" "~$folder.common_desktop$" "NirSoft"

Set the display mode to 800x600x24bit colors

nircmd.exe setdisplay 800 600 24

Create a shortcut on the desktop that set the display mode to 800x600x24bit colors

nircmd.exe cmdshortcut "~$folder.desktop$" "800x600x24" setdisplay 800 600 24

Copy all shortcuts on your desktop to another folder (f:tempdesktop).

nircmd.exe execmd copy "~$folder.desktop$*.lnk" f:tempdesktop

Restart your Apache server (under Windows NT/2000/XP/2003)

nircmd.exe service restart apache

Create a shortcut on your desktop that restarts the Apache server

nircmd.exe cmdshortcut "~$folder.desktop$" "Restart Apache" service restart apache

Restart your IIS

nircmd.exe service restart w3svc

Restart MySql

nircmd.exe service restart MySql

Open the desired Registry key/value in RegEdit

nircmd.exe regedit "HKLMSoftwareMicrosoftWindowsCurrentVersion" "CommonFilesDir"

Open the Registry key that you copied to the clipboard in RegEdit.

nircmd regedit "~$clipboard$"

Disable the screen saver

nircmd.exe regsetval sz "HKCUcontrol paneldesktop" "ScreenSaveActive" 0

Enable the screen saver

nircmd.exe regsetval sz "HKCUcontrol paneldesktop" "ScreenSaveActive" 1

Change the date/time of the specified filename (creation time and modified time)

nircmd.exe setfiletime "c:tempmyfile.txt" "24-06-2003 17:57:11" "22-11-2005 10:21:56"

Copy your desktop folder path to the clipboard

nircmd.exe clipboard set ~$folder.desktop$

Copy your start menu folder path to the clipboard

nircmd.exe clipboard set ~$folder.start_menu$

Copy the content of info1.txt (simple text file) to the clipboard

nircmd.exe clipboard readfile "c:My Filesinfo1.txt"

Add the text content of clipboard to info1.txt

nircmd.exe clipboard addfile "c:My Filesinfo1.txt"

Clear the clipboard

nircmd.exe clipboard clear

Create all folders specified in "c:tempfolders.txt". The folder path names areseparated by CRLF characters.

nircmd.exe paramsfile "c:tempfolders.txt" "" "" execmd md ~$fparam.1$

Install the specified .NET assembly in the global assembly cache (like gacutil)

nircmd.exe gac install "C:tempMyAssemblybinMyAssembly.dll"

Empty the recycle bin in all drives.

nircmd.exe emptybin

24/07/2006

1.85

15/07/2006

1.84

20/05/2006

1.83

18/02/2006

1.82

19/11/2005

1.81

24/09/2005

1.80

07/07/2005

1.70

10/06/2005

1.62

26/05/2005

1.61

07/05/2005

1.60

28/12/2004

1.56

07/12/2004

1.55

18/11/2004

1.54

03/11/2004

1.53

09/10/2004

1.52

29/09/2004

1.51

22/09/2004

1.50

05/05/2004

1.40

01/03/2004

1.30

08/01/2004

1.20

19/11/2003

1.11

10/10/2003

1.10

09/09/2003

1.00

~n

New line characters (CR-LF)

~q

Double-quote character: "

~t

Tab character

~xnn

Allows you to represent any character by providing its ascii code in 2-digit Hexadecimal number.For Example: ~x41 ('A' character), ~x27 (single-quote character)

~$variable$

Represents a system variable. For more information about this option, read below

~~

Represents a single '~' character.

clipboard

Represents the text that you copied into the clipboard.

param.paramname

When you specify a param variable, an input window will appear on the screen,and will ask you to type the text for this variable.The text that you type will be inserted into the command line.For example: in the following command, you will be asked to type 2 parameters (1 and 2),and the text that you type will appear in the message box.nircmd infobox ~$param.1$ ~$param.2$

fparam.number

Sepcifies a parameter loaded from a text file.For more information, see paramsfile command

sys.varname

You can use this option to represent any environment variable on your system.For example:~$sys.username$, ~$sys.windir$, ~$sys.computername$, ~$sys.logonserver$, ~$sys.temp$, and so on...

nir.exefile

Represents the full-path exe file of the current running NirCmd (For example: c:winntircmd.exe)

folder.nircmd

Represents the folder the NirCmd is running from.

folder.desktop

Represents the user's desktop folder.

folder.start_menu

Represents the user's start-menu folder.

folder.programs

Represents the user's programs folder (under the start-menu folder).

folder.startup

Represents the user's startup folder.

folder.recent

Represents the user's recent folder.

folder.favorites

Represents the user's favorites folder.

folder.cookies

Represents the user's cookies folder.

folder.appdata

Represents the user's Application Data folder. (For example: C:Documents and SettingsAdministratorApplication Data)

folder.common_desktop

Represents the common desktop folder.

folder.common_start_menu

Represents the common start menu folder.

folder.common_programs

Represents the common programs folder.

folder.common_startup

Represents the common startup folder.

folder.common_favorites

Represents the common favorites folder.

folder.windows

Represents the windows folder. (e.g.: C:Windows)

folder.system

Represents the system folder. (e.g.: C:WindowsSystem32)

remote

Executes NirCmd command in a remote computer.if {copy} parameter is specified, NirCmd will copyitself to the Windows directory of the remote machine. You must specify this parameter if NirCmd doesn't exist in the Windows directory of the remote machine. Examples:remote copy \comp1 exitwin poweroffremote \comp2 infobox "This is a message from NirCmd" "Hello !"remote \comp3 lockws

multiremote

Executes NirCmd command in multiple remote machines.if {copy} parameter is specified, NirCmd will copyitself to the Windows directory of the remote machines. You must specify this parameter if NirCmd doesn't exist in the Windows directory of the remote machines. The [computers file] parameter is a file that containsthe computers list separated by Enter characters (CRLF).Example for computers list file:

The command specified in [NirCmd command]will be executed in all computers specified in the computers file.Examples:

cmdwait

Wait the specified number of Milliseconds, and then execute the specified NirCmd command.

Example:cmdwait 1000 monitor off

paramsfile

This powerfull command allows you to execute NirCmd Command multiple times, by loadingone or more parameters from a text file. The text file can be comma-delimited, tab-delimited,semicolon-delimited, or delimited by any char that you specify in [Delimiters] parameter.

Here's an example... Let's say that you have the following text file, containing user names and passwords, delimited by comma:

The following NirCmd commands sequence will create 4 users with the specified user-names and passwords (by using 'net user' command provided by Windows 2000/XP operating system)nircmd.exe paramsfile "c:tempusers.txt" "," "" execmd net user ~$fparam.1$ ~$fparam.2$ /add

The ~$fparam.1$ specifies the first entry in each line - the user name.The ~$fparam.2$ specifies the second entry in each line - the password.

Examples:paramsfile "c:tempfolders.txt" "" "" execmd md ~$fparam.1$paramsfile "c:tempshortcuts.txt" "," "~q" shortcut ~$fparam.1$ "~$folder.desktop$" ~$fparam.2$

infobox

Displays a simple message box on the screen.Example:infobox "This is a message box !" "message"

qbox

Displays a question dialog-box on the screen. If the user answers "Yes", run a programExample:qbox "Do you want to run the calculator ?" "question" "calc.exe"

qboxcom

Displays a question dialog-box on the screen. If the user answers "Yes", execute theNirCmd command in the third parameter.Examples:qboxcom "Do you want to lock your workstation ?" "question" lockwsqboxcom "Do you want to turn off the monitor ?" "monitor" monitor off

script

This command allows you to execute a sequence of commands stored inside the file specifiedin [Script File] parameter.Example:script "c:tempmsg.ncl"Example for a script:

regedit

Opens RegEdit with the specified key/value.Examples:regedit "HKLMSoftwareMicrosoftWindowsCurrentVersion" "CommonFilesDir" regedit "HKEY_CURRENT_USERControl PanelDesktop" "Wallpaper"

regsetval

Writes a value to the Registry. the [type] parameter canbe "sz" or "expand_sz" for strings, "dword" for 32-bit number, or "binary" forbinary data. If the key you specify in [key] parameterdoesn't exist, it'll automatically be created.Examples:regsetval dword "HKEY_CURRENT_USERSoftwareTest" "Value1" "0xaabbccdd"regsetval dword "HKCUSoftwareTest" "Value2" "10561"regsetval sz "HKCUSoftwareTest" "Value3" "string value"regsetval binary "HKLMSoftwareTest" "Value4" "6a cb ab dd 80 86 95"

regdelval

Deletes a value from the Registry. Example:regdelval "HKEY_CURRENT_USERSoftwareTest" "Value1"

regdelkey

Deletes entire key from the Registry. This command will failed if the specified key has one or more subkeys.Example:regdelkey "HKEY_CURRENT_USERSoftwareTest"

inisetval

Writes a value into INI file. If the file doesn't exist, it'll automatically be created.Example:inisetval "c:windowstest.ini" "section1" "TestValue" "1"

inidelval

Deletes a key-value pair inside INI file. Example:inidelval "c:windowstest.ini" "section1" "TestValue"

inidelsec

Deletes entire section in INI file, including all values in it. Example:inidelsec "c:windowstest.ini" "section1"

regsvr

Register or unregister DLL/OCX files.In the first parameter, specify "reg" for registering files, or "unreg" for unregistering files.In the second parameter, you can specify a single file that you want to register or unregister, or multiple files, by using wildcard.The third parameter is optional, and specifies a log filename for saving the results of the registering operation.Examples:regsvr reg "f:winntsystem32fv*.ocx" "c:templog1.txt" regsvr unreg "f:winntsystem32ab*.dll"

rasdial

Dials to RAS entry (VPN or phone line), without displaying any user interface.Except the [Entry Name] parameter, all other parameters are optional.If you don't specify the optional parameters or you specify empty string (""),the default values are used.Examples:rasdial "My Internet"rasdial "VPN1" "" "user1" "abc1234" "domain1"

inetdial

Dials to RAS entry (VPN or phone line), and display informational dialog-box during the dialing process.This command is only supported If Internet Explorer version 4.0 or greater is installed.Be aware that this command might not work on old versions of Windows 98. Examples:inetdial "VPN1"

rasdialdlg

Displays a RAS entry for dialing. The {Phonebook File} and {Phone Number} parameters areoptional. If you don't specify the {Phonebook File} parameter or you specify an empty string,the default phonebook is used.This command is only supported on Windows NT, Windows 2000, and Windows XP.It's not supported on Windows 98/ME. Examples:rasdialdlg "Internet1" "" "9876543"rasdialdlg "VPN1"

rashangup

Hangs up a RAS connection. You can use this command to disconnect a connection that you previously createdwith inetdial or rasdial commands.If you don't specify the {Entry Name} parameter, all active connections will be disconnected.Examples:rashangup "VPN1"rashangup

setdialuplogon

Modifies the user name, password and domain of a dial-up item.The parameters:

Examples:setdialuplogon "VPN1" "user1" "asder443" "domain1"setdialuplogon "Internet1" "nirs3" "q5r4df7yh5"

exitwin

This command terminates the current session of Windows.The [shutdown type] parameter can be one of the following values:

You can also use one of the following additional options:

Examples:exitwin rebootexitwin poweroff forceexitwin logoff forceifhung

initshutdown

Initiate a system shutdown. This command is somewhat similar to exitwin command, butit has some other features that exitwin doesn't support. This command is not supportedon Windows 95/98/ME.All parameters of this command are optional. If you don't specify any parameter,the system shutdown is initiated without displaying message and without waiting. The parameters:

Examples:initshutdown "shutting down the system within 60 seconds" 60 rebootinitshutdown "" 0 force

abortshutdown

Abort the system shutdown that initiated with initshutdown command.This command doesn't accept any additional parameters. Example:abortshutdown

lockws

Lock the workstation. After locking your workstation, you must type your password in orderto continue your work. This command is only available on Windows 2000 and Windows XP.

monitor

Changes the state of the display monitor. The [action]parameter may contain the following values:

This command only works in systems that support this feature.Examples:monitor offmonitor on

screensaver

Starts the default screen saver.

standby

Shuts down the computer and puts it in 'standby' mode.If the {force} parameter is specified, the system is forced to go into standby mode without asking for permission from all applications.Generally, it's not recommended to use this parameter.This command works only in systems that supports standby mode.Example:standby forcestandby

hibernate

Shuts down the computer and puts it in 'hibernate' mode.If the {force} parameter is specified, the system is forced to go into hibernate mode without asking for permission from all applications.Generally, it's not recommended to use this parameter.This command works only in systems that supports hibernate mode.Example:hibernate forcehibernate

shortcut

Creates a shortcut to a file. The parameters:

Examples:shortcut "f:winntsystem32calc.exe" "~$folder.desktop$" "Windows Calculator"shortcut "f:winntsystem32calc.exe" "~$folder.programs$Calculators" "Windows Calculator"shortcut "f:Program FilesKaZaAKazaa.exe" "c:tempMyShortcuts" "Kazaa"shortcut "f:Program Files" "c:tempMyShortcuts" "Program Files Folder" "" "f:winntsystem32shell32.dll" 45shortcut "f:Program Files" "c:tempMyShortcuts" "Program Files Folder" "" "" "" "max"

cmdshortcut

Creates a shortcut to NirCmd command. When you activate the shortcut (by doubleclicking it),The command that you specify in [command] parameter will be executed.Examples:cmdshortcut "~$folder.desktop$" "Open CDROM" cdrom open k:cmdshortcut "c:temp" "Turn Monitor Off" monitor off

cmdshortcutkey

Similar to cmdshortcut command, but also allows you to specify an hot key to activate the command.Examples:cmdshortcutkey "~$folder.desktop$" "Open CDROM" "Ctrl+Shift+K" cdrom open k:cmdshortcutkey "c:temp" "Turn Monitor Off" "Ctrl+Shift+M" monitor off

urlshortcut

Creates a shortcut to URL address. (Like the shortcuts in Favorities of Internet Explorer)The [Folder] parameter specifies the destination folder that inside it the shortcut will be created. If you want to create the shortcut inside your default Favorities folder, use ~$folder.favorites$ variable.Examples:urlshortcut "http://www.nirsoft.net" "~$folder.favorites$" "NirSoft Web Site"urlshortcut "http://www.google.com" "~$folder.favorites$Search Engines" "Google"urlshortcut "http://www.yahoo.com" "c:temp" "Yahoo"

exec

Runs an application, and optionally specify one or more command-line parameters for the executed application.The [show/hide] parameter specifies whether therunning application will be visible or not.If 'hide' is specified, the running application won't be visible to the user.Example:exec show "f:winntsystem32calc.exe"exec hide "c:tempwul.exe" /savelangfile

exec2

Similar to exec command, but also provide another parameter, [working folder], thatspecifies the default working folder for the application that you run.Example:exec2 show "f:winntsystem32" "f:winntsystem32calc.exe"exec2 hide c:temp "c:tempwul.exe" /savelangfile

execmd

Executes a command of Command-Prompt (Console Window) without displaying anythingon the screen.Examples:execmd del "~$folder.desktop$calc.lnk"execmd mkdir f:tempdesktop1execmd copy "~$folder.desktop$*.lnk" f:tempdesktop

shexec

Opens or Prints a filename according to the definition of the file extension in the Registry.For example: a filename with .doc extension will be opened with MS-Word, a filename with.html extension will be opened with your default browser.If you specify a valid web site address, the Web site will be opened in your default browser.the [operation] parameter can be "open" or "print".Examples:shexec "open" "c:my documentsabc.doc"shexec "print" "d:files1.pdf"shexec "open" "http://www.nirsoft.net"

setfiletime

Changes the Created/Modified/Accessed date of one or more files.The first parameter can be a single filename or wildcard string.The dates parameters must be specified in the following format: "dd-mm-yyyy hh:nn:ss"if a date parameter is not specified or you specify an empty string (""), the date won't be changed. If you specify "now" as date parameter, the current date and time will be usedExamples:setfiletime "c:temp*.exe" "15-05-2004 11:22:12" "22-01-2005 21:22:55"setfiletime "c:tempmyfile.txt" "24-06-2003 17:57:11" "" "22-11-2005 10:21:56"setfiletime "c:tempmyfile.txt" now now

setfilefoldertime

Changes the Created/Modified/Accessed date of one or more files/folders.This command is very similar to setfiletime command.The only difference is that setfilefoldertime command can also change the date of a folder - only under Windows 2000/XP.Examples:setfilefoldertime "c:tempmyfolder" "10-01-2003 11:22:12" "12-11-2002 02:34:11"setfilefoldertime "c:tempmyfolder" now now

emptybin

Empty the Recycle Bin.the {drive} parameter specifies the drive of the Recycle Bin that you want to empty.If the {drive} parameter is not specified, all Recycle Bin on all drives will be emptied.Example:emptybin f:emptybin

setdisplay

Changes your display settings. The [width] and [height] parameters representsthe number of pixels on your screen. The [color bits] parameter represents thenumber of colors shown on your screen (8 - 256 color, 16 - 16bit color, 24 - 24bit color, and so on).{refresh rate} is an optional parameter that specifies the monitor refresh rate.If you specify the {-updatereg} parameter, the new settings will be saved in the Registry.If you specify both {-updatereg} and {-allusers} parameters, the new settings will be saved in the Registry for all users.Example:setdisplay 800 600 24 -updateregsetdisplay 1024 768 24 90setdisplay 1024 768 8

killprocess

Terminates the specified process.In the [process] parameter, you can specify the full pathof the process filename (e.g: 'C:Program FilesInternet Exploreriexplore.exe') or the name of the process only, without the path (e.g.: iexplore.exe).You can also specify the Process ID, by adding the '/' character as a prefix (e.g. /1120). Examples:killprocess iexplore.exekillprocess "c:winntsystem32calc.exe"killprocess /1830

closeprocess

Terminates the specified process, by closing its top level windows.As opposed to killprocess command, closeprocess doesn't force the process to be closed immediately. Instead, it send WM_CLOSE message to all top level windows of the specified process.However, be aware that this command will not work on process with no user interface.

In the [process] parameter, you can specify the full pathof the process filename (e.g: 'C:Program FilesInternet Exploreriexplore.exe') or the name of the process only, without the path (e.g.: iexplore.exe).You can also specify the Process ID, by adding the '/' character as a prefix (e.g. /1120). Examples:closeprocess iexplore.execloseprocess "c:winntsystem32calc.exe"closeprocess /1830

memdump

Reads the memory of process according to the parameters you specify, and writes itinto a text file.The parameters:

Examples:memdump iexplore.exe "c:tempdump.txt" "16" "0x10000" "0x400000"memdump calc.exe "c:tempcalc.txt" "32" "0x30000" "0x400000" nohexmemdump /525 "c:tempdump.txt" "16" "0x100000" "0x120000" noascii

service

Changes the status and the startup type of services and drivers.The parameters:

Examples:service start scheduleservice \remote stop scheduleservice restart w3svc

win

For child windows:

This command allows you to close, hide, show, maximize, and minimize the specified window.The parameters:

Examples:win close title "calculator"win hide stitle "calculat"win hide ititle "culat"win show class "SciCalc"win activate title "my computer"win max handle 0x00009c01win redraw alltopwin trans ititle "internet explorer" 192 win setsize class "IEFrame" 50 50 400 300win settopmost class "SciCalc" 1win child class "Shell_TrayWnd" hide class "button"win child class "Shell_TrayWnd" show class "button"win child title "calculator" hide id 128 win -style title "my computer" 0x00C00000win child title "my computer" +exstyle all 0x00400000win sendmsg title "calculator" 0x10 0 0

cdrom

This command allows you to open and close the door of your CD-ROM drive.The