A Syntax Reference and Index of Small Windows Command Line Tools

A reference for a specific and slightly awkward class of documentation: instructions for command line tools for windows that were freeware twenty years ago, are not distributed any more, and still appear in runbooks, forum answers and internal wikis that people follow today. Each page here decodes one such tool's syntax and names the supported command that now does the job.

The bracket notation in an old command line switch, marking the part the parser requires and the optional remainder, with the abbreviations that mean the same thing.

The index

Service permissions
Twelve access rights and four composites on a service or driver. The access mask, the Win32 constant and the SDDL token for each, plus the read-modify-write rule that stops you locking yourself out. The strongest reason to read any of this.
Remote shutdown
Which power states have a remote interface and which do not, why hibernate is refused over the network, and what a tool is really doing when it offers remote hibernate anyway.
Run as different user
Secondary logon, the three spellings of the same operation, why a saved credential is a credential store, and the privilege that tells you a run-as utility is unsafe.
Explorer tags
Why file metadata shows in one program and not another, what the shell will write back, and how a third-party tab got into a property sheet. The mechanism is unchanged.
The nine utilities
Hardlinks, error codes, clipboard, environment variables, battery state, account information. Seven have built-in replacements; the switch tables are here in full.
Tool index
The four areas side by side, the conventions of the period, and one console block of supported commands by task.

What the syntax notation means

Documentation for windows command line tools of this period is dense in a particular way, and two conventions carry most of the meaning. Switches are forward-slashed and often single letters, with the long form in brackets in the usage text: /R[eboot] means the tool accepts both. And a set of rights is written as a run of letters rather than a list, so a mask is a string.

down [\\COMPUTER [/C | /I]] [/R | /L | /P | /S | /H | /A] [/Q] [/F] [Time] [Message]
                                ↑ one action per call, chosen from a group

scacl.exe [\\MACHINE] service [/E] [/G User:Mask] [/D User:Mask] [/R User]
                                                    ↑ a mask is a string of right letters

The consequence for a reader is that the interesting information is usually in a table below the usage line rather than in the usage line itself. A syntax summary tells you the shape of the call; the letter table tells you what it does. Both are reproduced on the page for each tool, because one without the other is not enough to judge whether an instruction is safe to follow.

How each page is arranged

Opening: What part of the system owns the operation, which decides everything else
Original syntax: The usage text and switch table as the tool printed them
Reference tables: Rights, constants, tokens, or format fields: whatever the area turns on
Current equivalent: The supported command, with the differences called out
Where it is different: Cases where the old approach is deliberately not supported now

Why small windows command line tools are worth an index

Because the pattern behind them is consistent enough to be predictive. Almost every one of these small windows command line tools was a thin cover over a capability the operating system already had and had not exposed with a command: hardlinks on NTFS, service access lists, per-session drive letters, file metadata in the shell. The tool was the gap, not the feature.

Which is why the replacements are nearly all built-in commands rather than other third-party programs, and why the object models described here are still accurate. When you find command line tools for windows in an old instruction and cannot identify them, the useful question is not "where do I download this" but "which interface was it wrapping". That interface almost certainly still exists and almost certainly has a command now.

Scope of this reference

The subject is narrow on purpose: small windows command line tools from one period, and the interfaces underneath them. It documents; it does not distribute. No binaries, no archives, no mirrors. Every page names the current supported route, and where there is none it says so instead of proposing something that behaves differently in a way that matters.

It is also not a general command line course. The material assumes you can read a usage line and know what a service and a token are; what it supplies is the specific notation, the specific rights, and the specific mapping from an old switch to a current one. Both a German and an English version of every page exist, each written for its own audience.

Questions about this reference

What is this reference for?

Decoding instructions written for tools that are no longer distributed, and finding the supported command that does the same job. Every page pairs an original switch table with its current equivalent, so a fifteen-year-old runbook line can be read accurately rather than pasted hopefully.

Are the tools themselves available here?

No. Nothing is distributed from this site. The LS-Tools utilities were freeware for Windows NT and Windows 2000, and the shell extension for Windows 9x as well; all of it is unmaintained, and every capability it had has a supported replacement. Which is what each page points at.

Which page should I start with?

Service permissions, if you have a service a non-administrator needs to control. That is the most common real problem in this material and the one where the object model is unchanged, so what you learn applies directly to a current machine.

Why do old switch letters matter?

Because a letter is an access right, and granting the wrong one can be the difference between "may restart this service" and "may replace the program this service runs". The letters compress a real security decision into one character, which is efficient and unforgiving.

Is any of this specific to a Windows version?

The original tools targeted Windows NT 4.0 and Windows 2000. The object models they exposed are all still present: service security descriptors, the secondary logon path, shell property handlers. Power management is the exception: that interface predates ACPI and no longer maps cleanly.

Does anything here need administrator rights?

Editing a service access list does, on the object being changed. A remote shutdown needs a specific right on the target. Everything else described: reading descriptors, checking a token, translating an error number, creating a hardlink in a directory you can write to. Runs as an ordinary account.

How current are the replacement commands?

All of them ship with supported versions of Windows and are documented by the vendor. Where no built-in replacement exists, the page says so plainly rather than suggesting a substitute that does something subtly different.

Is there a German version?

Yes. Each page has a German counterpart covering the same ground for a German-language audience, reachable from the language control in the header.