Release Notes (Readme.htm) for Windows Support Tools for Microsoft Windows XP Professional

Configures Internet Protocol Security (IPSec) policies in a directory service or in a local or remote registry. Ipseccmd is a command-line alternative to the IP Security Policies Microsoft Management Console (MMC) snap-in. Ipseccmd has six modes: dynamic mode, static mode, show mode, set mode, import mode, and export mode.

You can use Ipseccmd dynamic mode to add anonymous rules to the existing IPSec policy by adding them to the IPSec security policies database. The rules added will be present even after the IPSEC Services service is restarted. The benefit of using dynamic mode is that the rules you add coexist with domain-based IPSec policy. Dynamic mode is the default mode for Ipseccmd.

Syntax

Option	Parameters	Meaning
/i	FullPath\suptools.msi [/qb]	Installs or configures. /qb performs unattended installation (optional).
/f	[ReinstallModes] FullPath\suptools.msi	Repairs a previous installation.
/a	FullPath\suptools.msi	Admin Installation. Installs on the network.
/x	FullPath\suptools.msi	Uninstalls.
/l	[i\|w\|e\|f\|a\|r\|u\|c\|m\|p\|+]FullPath\LogFile	Specifies path to log file. The flags indicate what information to log. i – Status messages. w – Nonfatal warnings. e – All error messages. f – List of replaced files. a – Startup of actions. r – Action-specific records. u – User requests. c – Initial UI parameters. m – Out of memory. p – Terminal properties. + – Append to existing file.

ipseccmd [\\ComputerName] -f FilterList [-n NegotiationMethodList] [-t TunnelAddr] [-a AuthMethodList] [-1s SecurityMethodList] [-1k MMRekeyTime] [-1e SoftSAExpirationTime] [-soft] [-confirm] [{-dialup | -lan}]

Parameters

Specifies the computer name of a remote computer to which you want to add a rule.

Required for first syntax. Specifies one or more filter specifications, separated by spaces, for quick mode security associations (SAs). Each filter specification defines a set of network traffic affected by this rule.

Specifies one or more security methods, separated by spaces, for securing traffic defined by the filter list.

Specifies the tunnel endpoint for tunnel mode as either an IP address or a DNS domain name.

Specifies that a confirmation prompt appears before the rule or policy is added.

Specifies whether the rule applies only to remote access or dial-up connections or whether the rule applies only to local area network (LAN) connections.

Remarks

· If you do not specify the \\ComputerName parameter, the rule is added to the local computer.

· If you use the \\ComputerName parameter, you must use it before all the other parameters, and you must have administrator permissions on the computer to which you want to add the rule.

· For the -f parameter, a filter specification is one or more filters that are separated by spaces and is defined by the following format:

SourceAddress/SourceMask:SourcePort=DestAddress/DestMask:DestPort:Protocol

o SourceMask, SourcePort, DestMask, and DestPort are optional. If you omit them, the mask of 255.255.255.255 and all ports are used for the filter.

o Protocol is optional. If you omit it, all protocols are used for the filter. If you specify a protocol, you must specify the port or precede the protocol with two colons (::). (See the first example for dynamic mode.) The protocol must be the last item in the filter. You can use the following protocol symbols: ICMP, UDP, RAW, or TCP.

o You can create mirrored filters by replacing the equals sign (=) with a plus sign (+).

o You can replace SourceAddress/SourceMask or DestAddress/DestMask with the values in the following table.

o You can enable the default response rule by specifying the filter specification of default.

o You can specify a permit filter by surrounding the filter specification with parentheses. You can specify a blocking filter by surrounding the filter specification with brackets ([ ]).

o If you are using Internet address class-based subnet masks (the subnet masks are defined along octet boundaries), you can use wildcard notation to specify subnet masks. For example, 10.*.*.* is the same as 10.0.0.0/255.0.0.0 and 10.92.*.* is the same as 10.92.0.0/255.255.0.0.

To create mirrored filters to filter TCP traffic between Computer1 and Computer2, type:

To create a filter for all TCP traffic from the subnet 172.31.0.0/255.255.0.0, port 80, to the subnet 10.0.0.0/255.0.0.0, port 80, type:

To create a mirrored filter that permits traffic between the local IP address and the IP address 10.2.1.1, type:

· For the -n parameter, one or more negotiation policies are separated by spaces and follow one of the following forms:

where EncrypAlg can be none, des, or 3des, AuthAlg can be none, md5, or sha, and HashAlg can be md5 or sha.

o The Rekey parameter is optional, and it specifies the number of kilobytes (indicated by placing a K after the number) or the number of seconds (indicated by placing an S after the number) that precede a rekeying of the quick mode SA. To specify both rekey parameters, separate the two numbers with a slash (/). For example, to rekey the quick mode SA every hour and after every 5 megabytes of data, type:

o The PFS parameter is optional, and it enables session key perfect forward secrecy. By default, session key perfect forward secrecy is disabled.

o The Group parameter is optional, and it specifies the Diffie-Hellman group for session key perfect forward secrecy. For the Low(1) Diffie-Hellman group, specify PFS1. For the Medium(2) Diffie-Hellman group, specify PFS2. For the High(3) Diffie-Hellman group, specify PFS3. By default, the group value for session key perfect forward secrecy is taken from the current main mode settings.

o If you do not specify negotiation policies, the default negotiation policies are the following:

· For the -a parameter, one or more authentication methods are separated by spaces and are in one of the following forms:

The PresharedKeyString parameter specifies the string of characters of the preshared key. The CAInfo parameter specifies the distinguished name of the certificate as displayed in the IP Security Policies snap-in when the certificate is selected as an authentication method for a rule. The PresharedKeyString and CAInfo parameters are case-sensitive. You can abbreviate the authentication method by using the first letter: p, k, or c. If you omit the -a parameter, the default authentication method is Kerberos.

· For the -1s parameter, one or more key exchange security methods are separated by spaces and defined by the following format:

where EncrypAlg can be des or 3des, HashAlg can be md5 or sha, and GroupNum can be 1 for the Low(1) Diffie-Hellman group, 2 for the Medium(2) Diffie-Hellman group, or 3 for the High(3) Diffie-Hellman group. If you omit the -1s parameter, the default key exchange security methods are 3des-sha-2, 3des-md5-2, des-sha-1, and des-md5-1.

· For the -1k parameter, you can specify the number of quick mode SAs (indicated by placing a Q after the number) or the number of seconds (indicated by placing an S after the number) to rekey the main mode SA. To specify both rekey parameters, you must separate the two numbers with a slash (/). For example, to rekey the main mode SA after every 10 quick mode SAs and every hour, type:

If you omit the -1k parameter, the default values for main mode rekey are an unlimited number of quick mode SAs and 480 minutes.

If you omit the -1e parameter, the expiration time for soft SAs is 300 seconds. However, soft SAs are disabled unless you include the -soft parameter, which then sets the value to the main mode lifetime.

· The -confirm parameter allows confirmation before setting policy and is available for dynamic mode only.

· The -dialup parameter is optional and sets policy on addresses of dial-up adapters. The -lan parameter is optional and sets policy on addresses of LAN adapters. If you specify neither the -dialup parameter nor the -lan parameter, the rule applies to all adapters.

Examples

To create a rule that uses the Authentication Header (AH) with MD5 hashing for all traffic to and from the local computer, type:

To create a tunnel rule for traffic from 10.2.1.1 and 10.2.1.13 by using the tunnel endpoint 10.2.1.13, with AH tunnel mode by using the SHA1 hash algorithm, with master key perfect forward secrecy enabled, and with a confirmation prompt for the rule before it is created, type:

To create a rule on the computer named corpsrv1 for all traffic between the computers named corpsrv1 and corpsrv2, by using the combination of both AH and Encapsulating Security Payload (ESP), with preshared key authentication, type:

ipseccmd \\corpsrv1 -f corpsrv2+corpsrv1 -n ah[md5]+esp[des,sha] -a p:"corpauth"

Ipseccmd static mode

Creates named policies and named rules. You can also use static mode to modify existing policies and rules, provided they were originally created with Ipseccmd. The syntax for static mode combines the syntax for dynamic mode with parameters that enable it to work at a policy level.

Syntax

ipseccmd DynamicModeParameters -w Location -p PolicyName[:PollInterval] -r RuleName [{-x | -y}] [-o]

Parameters

DynamicModeParameters

Required. Specifies a set of dynamic mode parameters for an IPSec rule as described earlier.

-w Location

Required. Specifies that the policies and rules are written to the local registry, a remote computer's registry, or to persistent storage.

-p PolicyName[:PollInterval]

Required. Specifies the name of the policy and how often, in minutes, the policy is checked for changes. If PolicyName contains any spaces, use quotation marks around the text (that is, "Policy Name").

-r RuleName

Required. Specifies the name of the rule. If RuleName contains any spaces, use quotation marks around the text (that is, "Rule Name").

[{-x | -y}]

Optional parameters. The -x parameter requires the -p option and specifies that the local registry policy is assigned. The -y parameter specifies that the local registry policy is unassigned.

-o

Specifies that the rule or policy should be deleted.

Displays help at the command prompt.

Remarks

o For the -w parameter, the Location is either reg to specify the registry of the local computer or a remote computer, or pers to specify persistent storage. With reg, if you specified \\ComputerName, the policy is written to the remote computer's registry.

o For the -p parameter, if a policy with this name already exists, the rule you specify is added to the policy. Otherwise, a policy is created with the name you specify. The PollInterval parameter is optional and specifies when IPSec should check for policy updates, for example, when there are changes to assigned DNS servers. If you specify an integer for PollInterval, the polling interval for the policy is set to that number of minutes. If you do not specify PollInterval, the polling interval defaults to 480 minutes.

o For the -r parameter, if a rule with that name already exists, the rule is modified to reflect the parameters you specify in the command. For example, if you include the -f parameter for an existing rule, only the filters of that rule are replaced. If no rule exists with the name you specify, a rule with that name is created.

o For the -o parameter, all aspects of the specified policy are deleted. Do not use this parameter if you have other policies that point to the objects in the policy you want to delete.

o Static mode usage differs from dynamic mode usage in one respect. When you use dynamic mode, you indicate permit and blocking filters in FilterList, which you identify by using the -f parameter. When you use static mode, you indicate permit and blocking filters in NegotiationMethodList, which you identify by using the -n parameter. In addition to the parameters described for NegotiationMethodList under dynamic mode, you can also use the block, pass, or inpass parameters in static mode. The following table lists these parameters and descriptions of their behavior.

Parameter	Description
block	The rest of the policies in NegotiationMethodList are ignored, and all of the filters become blocking filters.
pass	The rest of the policies in NegotiationMethodList are ignored, and all of the filters become permit filters.
inpass	Inbound filters allow initial communication to be unsecured, but responses are secured using IPSec.

Examples

To create a policy named Default Domain Policy with a 30-minute polling interval in which policy changes are written to persistent storage, with a rule named Secured Servers for traffic between the local computer and computers named SecuredServer1 and SecuredServer2, and by using Kerberos and preshared key authentication methods, type:

ipseccmd -f 0+SecuredServer1 0+SecuredServer2 -a k p:"corpauth" -w pers -p "Default Domain Policy":30 -r "Secured Servers"

To create and assign a local policy named Me to Anyone, with a rule named Secure My Traffic, by using a mirrored filter for any traffic to the local computer, and by using a preshared key as the authentication method, type:

ipseccmd -f 0+* -a p:"localauth" -w reg -p "Me to Anyone" -r "Secure My Traffic" -x

Ipseccmd show mode

Displays data from the IPSec policies database.

Syntax

ipseccmd [\\ComputerName] show {{[gpo] | [filters] | [policies] | [auth] | [stats] | [sas]} | all}

Parameters

\\ComputerName

Specifies by name the remote computer for which you want to display data.

show

Required. Specifies that Ipseccmd must run in show mode.

gpo

Displays static policy assignment information.

filters

Displays main mode and quick mode filters.

policies

Displays main mode and quick mode policies.

auth

Displays main mode authentication methods.

stats

Displays statistics about Internet Key Exchange (IKE) and IPSec.

sas

Displays main mode and quick mode security associations (SAs).

all

Displays data provided by all of the parameters except /?.

Displays help at the command prompt.

Remarks

o Ipseccmd does not display IPSec data for computers running Windows 2000.

o If you do not use the \\ComputerName parameter, information about the local computer is displayed.

o If you use the \\ComputerName parameter, you must use it before all the other parameters, and you must have administrator permissions on the computer for which you want to display information.

Examples

To display the main mode and quick mode filters and policies for the local computer, type:

ipseccmd show filters policies

To display all IPSec information for the remote computer Server1, type the following command:

ipseccmd \\Server1 show all

Ipseccmd set mode

Sets configuration parameters for IPSec.

Syntax

ipseccmd [\\ComputerName] set [{logike | dontlogike}]

Parameters

\\ComputerName

Specifies by name the remote computer for which you want to have configuration parameters set.

set

Required. Specifies that Ipseccmd must run in set mode.

logike

Turns on Internet Key Exchange (IKE) logging.

dontlogike

Turns off IKE logging.

Displays help at the command prompt.

Examples

To turn off IKE logging on the local computer, type:

ipseccmd set dontlogike

To turn on IKE logging on the computer named server2, type:

ipseccmd \\server2 set logike

Ipseccmd import/export mode

Imports or exports policy data files (files containing an .ipsec extension).

Syntax

ipseccmd [\\ComputerName] [{import | export}] Location FileName

Parameters

\\ComputerName

Specifies by name the remote computer from which you want to import policy data, or to which you want to export policy data.

{import | export}

Required. Specifies that Ipseccmd must run in import or export mode.

Location

Required. Specifies that the policy data is read from or written to the local registry, a remote computer's registry, or to persistent storage.

FileName

Required. Specifies the name of the file to import from or export to. If an export file name does not specify the .ipsec extension, the extension is automatically appended.

Displays help at the command prompt.

Remarks

o The Location is either reg to specify the registry of the local computer or a remote computer, or pers to specify persistent storage. If you use reg and you specify \\ComputerName, the policy is read from or written to the remote computer's registry.

Examples

To export policy data to persistent storage, type:

ipseccmd export pers persistent.ipsec

To import policy data from the file named server1.ipsec on the computer named server1, type:

ipseccmd \\server1 import reg server1.ipsec

Value	Description
O	owner
G	group
D	DACL
S	SACL

Value	Description
O	owner
G	group
D	DACL
S	SACL

Value	Description
PRECONFIG	Use the owner's IE defaults.
AUTODETECT	Turn on auto-detection of the proxy.
NO_PROXY	Do not use a proxy server.
OVERRIDE	Must be followed by an explicit proxy list and a proxy bypass list. NULL or "" can be used as an empty proxy bypass list.

Value	Description
NO_PROXY	Specify direct connection (Do not use a proxy server).
AUTODETECT	Turn on auto-detection of the proxy.
MANUAL_PROXY	Use an explicit proxy list and bypass list. Must be followed by a proxy list and a proxy bypass list (comma-delimited). NULL or "" can be used as an empty proxy bypass list.
AUTOSCRIPT	Specify a script to be run during proxy auto-discovery. AUTOSCRIPT must be followed by a URL indicating the script location.

Value	Description
0	My address or addresses
*	Any address
DNSName	DNS domain name. If the DNS name resolves to multiple addresses, it is ignored. You can specify DNS, WINS, DHCP, or GATEWAY. The security policy database (SPD) dynamically replaces these specifications with the associated addresses set on the computer.

Release Notes (Readme.htm) for Windows Support Tools for Microsoft Windows XP Professional

Contents

Unattended Installation

Syntax

Parameters

Remarks

Examples

Create BITS Job

Get a Job's Type

Get a Job's Size

Get the Number of Bytes Transferred for a Job

Get the Number of Files in a Job

Get the Number of Files Transferred for a Job

Get a Job's Creation Time

Get a Job's Last Modification Time

Get a Job's Completion Time

Get a Job's State

Get a Job's Owner

Get a Job's Display Name

Add a File to a Specified Job

Resume a Job

Delete All Jobs in the Manager

List Transfer Jobs

Delete a Specified Job

Perform a Series of Operations Simultaneously

Run /list /allusers /verbose

Syntax

Parameters

Action commands

Store arguments

Remarks

· The -a Parameter and Security Descriptor Definition Language

· Httpcfg.exe and the HTTP API

· Httpcfg.exe return codes

Examples

Using the httpcfg ssl command

Using the httpcfg urlacl command

Using the httpcfg iplisten command

Syntax

Parameters

Remarks

Examples

Ipseccmd static mode

Syntax

Parameters

Remarks

Examples

Ipseccmd show mode

Syntax

Parameters

Remarks

Examples

Ipseccmd set mode

Syntax

Parameters

Examples

Ipseccmd import/export mode

Syntax

Parameters

Remarks

Examples