Skip to main content
Most situational awareness commands require you to first set a target device using the interact [ResourceID] command. You can find ResourceIDs using the database query commands.

​
System Information Commands

​
administrators

​
Description

Query the interactive device for members of the device’s local administrators group.

​
Usage

administrators

​
Example

(16777221) (C:\) >> administrators
[19:38:17] INFO     Tasked SCCM to run Administrators.
[19:38:19] INFO     Got OperationId 16779666. Sleeping 10 seconds to wait for host to call home.
[19:38:29] INFO     No results yet, sleeping 10 seconds.
[19:38:41] INFO     +---------------+----------------------+-------------------+----------+
                    | ObjectClass   | Name                 | PrincipalSource   | Device   |
                    +===============+======================+===================+==========+
                    | User          | DP\Administrator     | Local             | DP       |
                    +---------------+----------------------+-------------------+----------+
                    | Group         | LAB\Domain Admins    | ActiveDirectory   | DP       |
                    +---------------+----------------------+-------------------+----------+
                    | Group         | LAB\SCCM_SiteServers | ActiveDirectory   | DP       |
                    +---------------+----------------------+-------------------+----------+

​
console_users

​
Description

Returns data detailing the users that have logged on to the target system.

​
Usage

console_users

​
Example

(16777221) (C:\) >> console_users
[19:39:28] INFO     Tasked SCCM to show all users that have signed in.
[19:39:31] INFO     Got OperationId 16779667. Sleeping 10 seconds to wait for host to call home.
[19:39:41] INFO     +---------------------+-------------------------+-------------------------------+---------------------------+----------+
                    | LastConsoleUse      |   NumberOfConsoleLogons | SystemConsoleUser             |   TotalUserConsoleMinutes | Device   |
                    +=====================+=========================+===============================+===========================+==========+
                    | 2024-01-27 14:08:00 |                       1 | win-3sflnhdib39\administrator |                       495 | DP       |
                    +---------------------+-------------------------+-------------------------------+---------------------------+----------+
                    | 2024-01-28 22:42:35 |                       1 | lab\administrator             |                      2435 | DP       |
                    +---------------------+-------------------------+-------------------------------+---------------------------+----------+

​
sessions

​
Description

List active sessions on the interactive device.

​
Usage

sessions

​
Example

(16777221) (C:\) >> sessions
[19:50:29] INFO     Tasked SCCM to show users currently signed in to 16777221.
[19:50:31] INFO     Got OperationId 16779679. Sleeping 10 seconds to wait for host to call home.
[19:50:41] INFO     +---------------------+----------+
                    | UserName            | Device   |
                    +=====================+==========+
                    | DP\DefaultAppPool   | DP       |
                    +---------------------+----------+
                    | DP\IUSR             | DP       |
                    +---------------------+----------+
                    | DP\LOCAL SERVICE    | DP       |
                    +---------------------+----------+
                    | DP\NETWORK SERVICE  | DP       |
                    +---------------------+----------+
                    | LAB\Administrator   | DP       |
                    +---------------------+----------+
                    | NT AUTHORITY\SYSTEM | DP       |
                    +---------------------+----------+

​
Hardware Information Commands

​
disk

​
Description

List available disk drives and space on the interactive system.

​
Usage

disk

​
Example

(16777221) (C:\) >> disk
[19:40:23] INFO     Tasked SCCM to show disk information of 16777221.
[19:40:24] INFO     Got OperationId 16779668. Sleeping 10 seconds to wait for host to call home.
[19:40:35] INFO     +--------+------------------+-------------+-------------+--------------+----------------------+----------+
                    | Name   | Description      |        Size |   FreeSpace | Compressed   | VolumeSerialNumber   | Device   |
                    +========+==================+=============+=============+==============+======================+==========+
                    | C:     | Local Fixed Disk | 53012852736 | 40399273984 | False        | 5E2D550E             | DP       |
                    +--------+------------------+-------------+-------------+--------------+----------------------+----------+
                    | D:     | CD-ROM Disc      |  5044094976 |           0 | False        | D10C768B             | DP       |
                    +--------+------------------+-------------+-------------+--------------+----------------------+----------+

​
list_disk

​
Description

Lists available disk drives on the interactive system.

​
Usage

list_disk

​
Example

(16777221) (C:\) >> list_disk
[19:43:02] INFO     Tasked SCCM to show mounted drives on 16777221.
[19:43:04] INFO     Got OperationId 16779671. Sleeping 10 seconds to wait for host to call home.
[19:43:17] INFO     +------------------+-----------+------------+----------+
                    | Description      | Caption   | DeviceID   | Device   |
                    +==================+===========+============+==========+
                    | Local Fixed Disk | C:        | C:         | DP       |
                    +------------------+-----------+------------+----------+
                    | CD-ROM Disc      | nan       | D:         | DP       |
                    +------------------+-----------+------------+----------+

​
System Configuration Commands

​
environment

​
Description

List environment variables from the interactive system.

​
Usage

environment

​
Example

(16777221) (C:\) >> environment
[19:40:51] INFO     Tasked SCCM to show Environment variables of 16777221.
[19:40:53] INFO     Got OperationId 16779669. Sleeping 10 seconds to wait for host to call home.
[19:41:03] INFO     No results yet, sleeping 10 seconds.
[19:41:14] INFO     +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+
                    | Caption                           | Description                       | Name                   | Status   | SystemVariable   | UserName                     | VariableValue                                                                                                                  | Device   |
                    +===================================+===================================+========================+==========+==================+==============================+================================================================================================================================+==========+
                    | <SYSTEM>\ComSpec                  | <SYSTEM>\ComSpec                  | ComSpec                | OK       | True             | <SYSTEM>                     | %SystemRoot%\system32\cmd.exe                                                                                                 | DP       |
                    +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+
                    | <SYSTEM>\DriverData               | <SYSTEM>\DriverData               | DriverData             | OK       | True             | <SYSTEM>                     | C:\Windows\System32\Drivers\DriverData                                                                                        | DP       |
                    +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+
                    | <SYSTEM>\OS                       | <SYSTEM>\OS                       | OS                     | OK       | True             | <SYSTEM>                     | Windows_NT                                                                                                                     | DP       |
                    +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+--------------------------------------------------------------------------------------------------------------------------------+----------+

​
ipconfig

​
Description

Run ipconfig on the interactive host and retrieve networking info.

​
Usage

ipconfig

​
Example

(16777221) (C:\) >> ipconfig
[19:42:23] INFO     Tasked SCCM to run IPCONFIG.
[19:42:27] INFO     Got OperationId 16779670. Sleeping 10 seconds to wait for host to call home.
[19:42:39] INFO     +------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+
                    | InterfaceAlias   | Name         | InterfaceDescription                       | Status   | IPV4Address   | IPV4DefaultGateway   | DNSServerList               | Device   |
                    +==================+==============+============================================+==========+===============+======================+=============================+==========+
                    | Ethernet0        | internal.lab | Intel(R) 82574L Gigabit Network Connection | Up       | 10.10.100.11  | 10.10.100.10         | 10.10.100.100; 10.10.100.10 | DP       |
                    +------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+

​
osinfo

​
Description

Query operating system and architecture info for the interactive device.

​
Usage

osinfo

​
Example

(16777221) (C:\) >> osinfo
[19:45:22] INFO     Tasked SCCM to show system info of 16777221.
[19:45:25] INFO     Got OperationId 16779673. Sleeping 10 seconds to wait for host to call home.
[19:45:35] INFO     +---------------------------------------------------+------------+------------------+----------+
                    | Caption                                           | Version    | OSArchitecture   | Device   |
                    +===================================================+============+==================+==========+
                    | Microsoft Windows Server 2022 Standard Evaluation | 10.0.20348 | 64-bit           | DP       |
                    +---------------------------------------------------+------------+------------------+----------+

​
Process and Service Information Commands

​
ps

​
Description

List current running processes for the interactive device.

​
Usage

ps

​
Example

(16777221) (C:\) >> ps
[19:45:52] INFO     Tasked SCCM to list processes.
[19:45:53] INFO     Got OperationId 16779674. Sleeping 10 seconds to wait for host to call home.
[19:46:04] INFO     No results yet, sleeping 10 seconds.
[19:46:16] INFO     +---------------------+-------------+---------------------+------------------+---------------+----------+
                    | Name                |   ProcessId | CreationDate        |   WorkingSetSize |   HandleCount | Device   |
                    +=====================+=============+=====================+==================+===============+==========+
                    | System Idle Process |           0 | 2024-01-30 02:48:49 |             8192 |             0 | DP       |
                    +---------------------+-------------+---------------------+------------------+---------------+----------+
                    | System              |           4 | 2024-01-30 02:48:49 |           151552 |          1420 | DP       |
                    +---------------------+-------------+---------------------+------------------+---------------+----------+
                    | Registry            |         100 | 2024-01-30 02:48:43 |         75931648 |             0 | DP       |
                    +---------------------+-------------+---------------------+------------------+---------------+----------+
                    | smss.exe            |         300 | 2024-01-30 02:48:49 |          1298432 |            57 | DP       |
                    +---------------------+-------------+---------------------+------------------+---------------+----------+
                    | csrss.exe           |         408 | 2024-01-30 02:48:50 |          6266880 |           385 | DP       |
                    +---------------------+-------------+---------------------+------------------+---------------+----------+

​
services

​
Description

List current running services on the interactive device.

​
Usage

services

​
Example

(16777221) (C:\) >> services
[19:47:25] INFO     Tasked SCCM to list services.
[19:47:27] INFO     Got OperationId 16779676. Sleeping 10 seconds to wait for host to call home.
[19:47:38] INFO     +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
                    | Name                                     | PathName                                                                                 |   ProcessId | ServiceType   | Started   | Device   |
                    +==========================================+==========================================================================================+=============+===============+===========+==========+
                    | AJRouter                                 | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p                      |           0 | Share Process | False     | DP       |
                    +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
                    | ALG                                      | C:\Windows\System32\alg.exe                                                              |           0 | Own Process   | False     | DP       |
                    +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
                    | AppHostSvc                               | C:\Windows\system32\svchost.exe -k apphost                                               |        1172 | Share Process | True      | DP       |
                    +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+

​
software

​
Description

List currently installed software on the interactive device.

​
Usage

software

​
Example

(16777221) (C:\) >> software
[19:52:10] INFO     Tasked SCCM to list software installed 16777221.
[19:52:12] INFO     Got OperationId 16779681. Sleeping 10 seconds to wait for host to call home.
[19:52:23] INFO     +--------------------------------------------------------------------+-----------------------+------------------+----------+
                    | ProductName                                                        | Publisher             | ProductVersion   | Device   |
                    +====================================================================+=======================+==================+==========+
                    | VMware Tools                                                       | VMware, Inc.          | 12.0.0.19345655  | DP       |
                    +--------------------------------------------------------------------+-----------------------+------------------+----------+
                    | Microsoft Visual C++ 2019 X64 Additional Runtime - 14.29.30133     | Microsoft Corporation | 14.29.30133      | DP       |
                    +--------------------------------------------------------------------+-----------------------+------------------+----------+
                    | Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.29.30133        | Microsoft Corporation | 14.29.30133      | DP       |
                    +--------------------------------------------------------------------+-----------------------+------------------+----------+

​
Network Information Commands

​
shares

​
Description

List all available file shares on the interactive device.

​
Usage

shares

​
Example

(16777221) (C:\) >> shares
[19:51:39] INFO     Tasked SCCM to list file shares.
[19:51:41] INFO     Got OperationId 16779680. Sleeping 10 seconds to wait for host to call home.
[19:51:52] INFO     +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
                    | Name            | Description                                                      | Path              |       Type | AllowMaximum   | Device   |
                    +=================+==================================================================+===================+============+================+==========+
                    | ADMIN$          | Remote Admin                                                     | C:\Windows        | 2147483648 | True           | DP       |
                    +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
                    | C$              | Default share                                                    | C:\               | 2147483648 | True           | DP       |
                    +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
                    | IPC$            | Remote IPC                                                       |                   | 2147483651 | True           | DP       |
                    +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
                    | SCCMContentLib$ | 'Configuration Manager' Content Library for site LAB (1/27/2024) | C:\SCCMContentLib |          0 | True           | DP       |
                    +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+

​
File System Commands

​
cd

​
Description

Change directories on the command line. This is required for both the ls and cat commands.

​
Usage

cd [filepath]

​
Example

(16777221) (C:\) >> cd C:\Users
(16777221) (C:\Users\) >> ls
[23:25:28] INFO     Tasked SCCM to list files in C:\Users\.
[23:25:28] INFO     Got OperationId 16779694. Sleeping 10 seconds to wait for host to call home.
[23:25:41] INFO     +----------------------------+--------+---------------------+--------+----------+
                    | FileName                   | Mode   | LastWriteTime       |   Size | Device   |
                    +============================+========+=====================+========+==========+
                    | C:\Users\Administrator     | d----- | 2024-01-27 05:53:07 |      1 | DP       |
                    +----------------------------+--------+---------------------+--------+----------+
                    | C:\Users\administrator.LAB | d----- | 2024-02-08 07:21:12 |      1 | DP       |
                    +----------------------------+--------+---------------------+--------+----------+

​
ls

​
Description

Will list the contents of the current directory represented on the command line. Defaults to C:. You must issue a cd command to another known directory (i.e. cd C:\Users) to list the contents of that Users directory and so on.

​
Usage

ls

​
Example

(16777221) (C:\) >> ls
[19:43:31] INFO     Tasked SCCM to list files in C:\.
[19:43:33] INFO     Got OperationId 16779672. Sleeping 10 seconds to wait for host to call home.
[19:43:47] INFO     +------------------------------+--------+---------------------+--------+----------+
                    | FileName                     | Mode   | LastWriteTime       |   Size | Device   |
                    +==============================+========+=====================+========+==========+
                    | C:\$Recycle.Bin              | d--hs- | 2024-01-27 06:07:22 |      1 | DP       |
                    +------------------------------+--------+---------------------+--------+----------+
                    | C:\$WinREAgent               | d--h-- | 2024-01-27 14:07:43 |      1 | DP       |
                    +------------------------------+--------+---------------------+--------+----------+
                    | C:\Documents and Settings    | d--hsl | 2024-01-27 21:59:32 |      1 | DP       |
                    +------------------------------+--------+---------------------+--------+----------+

​
cat

​
Description

Display the contents of a file on the interactive device. The command line must be configured with the path to the file contents directory. For example, if the file you want to display is in “C:\Windows\Temp”, you must issue a cd command to configure the command line with that file path in addition to the interactive device.

​
Usage

cat [filename]

​
Example

(16777221) (C:\) >> cd C:\Users\administrator.LAB\.ssh
(16777221) (C:\Users\administrator.LAB\.ssh\) >> cat id_rsa
[23:21:41] INFO     Tasked SCCM to show id_rsa
[23:21:43] INFO     [+] Updates script created successfully with GUID 22057b18-d704-4734-ac35-2641eae96fb4.
[23:21:47] INFO     [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 approved.
[23:21:49] INFO     [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 executed.
[23:22:08] INFO     [+] Got result:
[23:22:08] INFO     -----BEGIN OPENSSH PRIVATE KEY-----
                    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
                    NhAAAAAwEAAQAAAYEAv0P8SG6b1AfXaWVmslD32pxVgncux1cxgNv6CnnG/OxDvAQdsBiB
                    [... content truncated for brevity ...]
                    -----END OPENSSH PRIVATE KEY-----
[23:22:12] INFO     [+] Script with GUID 22057b18-d704-4734-ac35-2641eae96fb4 deleted.
SCCM limits the result returned from scripts to 4KB. If the file size is larger it will be truncated or unreliable. Additionally, since scripts are used, you may need to supply alternate credentials.
All situational awareness commands operate through CMPivot and may take 10+ seconds to complete as they wait for the target system to call home and execute the commands.