Netsh commands for RAS

You can administer remote access servers by typing commands at the command prompt for the Netsh RAS context. By using the Netsh RAS command prompt, you can administer servers more quickly over slow network connections, and you can create scripts that automate the administration of many servers.

To run these Netsh commands on a remote Windows 2000 Server, you must first use Remote Desktop Connection to connect to a Windows 2000 Server that is running Terminal Server. There might be functional differences between Netsh context commands on Windows 2000 and Windows XP.

For more information on Netsh, see Using Netsh

To view the command syntax, click a command:

help

Displays command-line help for commands you can use in the Netsh RAS context.

Syntax

help

Parameters

none

Remarks

• You can also display command-line help by typing any of the following at the command prompt for the Netsh RAS context: ?, /?, or -?.

show activeservers

Displays a list of remote access server advertisements.

Syntax

show activeservers

Parameters

none

show client

Lists remote access clients connected to this server.

Syntax

show client

Parameters

none

dump

Displays the configuration of the remote access server in script form.

Syntax

dump

Parameters

none

show tracing

Shows whether tracing is enabled for the specified component. Used without parameters, show tracing lists all installed components and whether tracing is enabled for each.

Syntax

show tracing [Component]

Parameters

Component   : Specifies the component for which to display information.

set tracing

Enables or disables tracing for the specified component.

Syntax

set tracing Component {enabled | disabled}

Parameters

Component   : Required. Specifies the component for which you want to enable or disable tracing. Use * to specify all components.

{ enabled | disabled } : Required. Specifies whether to enable or disable tracing for the specified component.

Remarks

• To see a list of all installed components, use the show tracing command without parameters.

Examples

To set tracing for the PPP component, type:

set tracing ppp enabled

show authmode

Shows whether dial-up clients using certain types of devices should be authenticated.

Syntax

show authmode

Parameters

none

set authmode

Specifies whether dial-up clients using certain types of devices should be authenticated.

Syntax

set authmode {standard | nodcc | bypass}

Parameters

{ standard | nodcc | bypass } : Required. Specifies whether dial-up clients using certain types of devices should be authenticated. The parameter standard specifies that clients using any type of device should be authenticated. The parameter nodcc specifies that clients using any type of device except a direct-connect device should be authenticated. The parameter bypass specifies that no clients should be authenticated.

add authtype

Adds an authentication type to the list of types through which the remote access server should attempt to negotiate authentication.

Syntax

add authtype {pap|spap|md5chap|mschap|mschapv2|eap}

Parameters

{ pap | spap | md5chap | mschap | mschapv2 | eap } : Required. Specifies which authentication type to add to the list of types through which the remote access server should attempt to negotiate authentication. The pap parameter specifies that the remote access server should use the Password Authentication Protocol (clear text). The spap parameter specifies that the remote access server should use the Shiva Password Authentication Protocol. The md5chap parameter specifies that the remote access server should use the Challenge Handshake Authentication Protocol (using the Message Digest 5 hashing scheme to encrypt the response). The mschap parameter specifies that the remote access server should use the Microsoft Challenge-Handshake Authentication Protocol. The mschapv2 parameter specifies that the remote access server should use Version 2 of MSCHAP. The eap parameter specifies that the remote access server should use Extensible Authentication Protocol.

Remarks

• The remote access server will attempt to negotiate authentication by using protocols in order from the most secure to the least secure. After both the client and the server have agreed on an authentication type, PPP negotiation proceeds according to the appropriate RFCs.

delete authtype

Deletes an authentication type from the list of types through which the remote access server should attempt to negotiate authentication.

Syntax

delete authtype {pap|spap|md5chap|mschap|mschapv2|eap}

Parameters

{ pap | spap | md5chap | mschap | mschapv2 | eap } : Required. Specifies which authentication type to delete from the list of types through which the remote access server should attempt to negotiate authentication. The pap parameter specifies that the remote access server should not use the Password Authentication Protocol (clear text). The spap parameter specifies that the remote access server should not use the Shiva Password Authentication Protocol. The md5chap parameter specifies that the remote access server should not use the Challenge Handshake Authentication Protocol (using the Message Digest 5 hashing scheme to encrypt the response). The mschap parameter specifies that the remote access server should not use the Microsoft Challenge-Handshake Authentication Protocol. The mschapv2 parameter specifies that the remote access server should not use Version 2 of MSCHAP. The eap parameter specifies that the remote access server should not use Extensible Authentication Protocol.

show authtype

Lists the authentication type (or types) that the remote access server uses to attempt to negotiate authentication.

Syntax

show authtype

Parameters

none

add link

Adds a link property to the list of link properties PPP should negotiate.

Syntax

add link {swc | lcp}

Parameters

{ swc | lcp } : Required. Specifies which link property to add to the list of link properties PPP should negotiate. The parameter swc specifies that software compression (MPPC) should be added. The parameter lcp specifies that Link Control Protocol extensions from the PPP suite of protocols should be added.

delete link

Deletes a link property from the list of link properties PPP should negotiate.

Syntax

delete link {swc | lcp}

Parameters

{ swc | lcp } : Required. Specifies which link property to delete from the list of link properties PPP should negotiate. The parameter swc specifies that software compression (MPPC) should be deleted. The parameter lcp specifies that Link Control Protocol extensions from the PPP suite of protocols should be deleted.

show link

Displays the link properties PPP should negotiate.

Syntax

show link

Parameters

none

add multilink

Adds a multilink type to the list of multilink types PPP should negotiate.

Syntax

add multilink {multi | bacp}

Parameters

{ multi | bacp } : Required. Specifies which multilink type to add to the list of multilink types PPP should negotiate. The parameter multi specifies that multilink PPP sessions should be added. The parameter bacp specifies that Bandwidth Allocation Control Protocol should be added.

delete multilink

Deletes a multilink type from the list of multilink types PPP should negotiate.

Syntax

delete multilink {multi | bacp}

Parameters

{ multi | bacp } : Required. Specifies which multilink type to delete from the list of multilink types PPP should negotiate. The parameter multi specifies that multilink PPP sessions should be deleted. The parameter bacp specifies that Bandwidth Allocation Control Protocol should be deleted.

show multilink

Shows the multilink types PPP should negotiate.

Syntax

show multilink

Parameters

none

add registeredserver

Registers the specified server as a remote access server in the specified Active Directory domain. Used without parameters, add registeredserver registers the computer from which you type the command in its primary domain.

Syntax

add registeredserver [[domain=]DomainName] [[server=]ServerName]

Parameters

[ domain= ] DomainName   : Specifies, by domain name, the domain in which to register the server. If you do not specify a domain, the server is registered in its primary domain.

[ server= ] ServerName   : Specifies, by DNS name or IP address, the server to register. If you do not specify a server, the computer from which you type the command is registered.

delete registeredserver

Deletes the registration of the specified server as a remote access server from the specified Active Directory domain. Used without parameters, delete registeredserver deletes the registration of the computer from which you type the command from its primary domain.

Syntax

delete registeredserver [[domain=]DomainName] [[server=]ServerName]

Parameters

[ domain= ] DomainName   : Specifies, by domain name, the domain from which to remove the registration. If you do not specify a domain, the registration is removed from the primary domain of the computer from which you type the command.

[ server= ] ServerName   : Specifies, by IP address or DNS name, the server whose registration you want to remove. If you do not specify a server, the registration is removed for the computer from which you type the command.

show registeredserver

Displays status information about the specified server registered as a remote access server in the specified Active Directory domain. Used without parameters, show registeredserver displays information about the computer from which you type the command in its primary domain.

Syntax

show registeredserver [[domain=]DomainName] [[server=]ServerName]

Parameters

[ domain= ] DomainName   : Specifies, by domain name, the domain in which the server about which you want to display information is registered. If you do not specify a domain, information is displayed about the server as it is registered in the primary domain of the computer from which you type the command.

[ server= ] ServerName   : Specifies, by IP address or DNS name, the server about which you want to display information. If you do not specify a server, information about the computer from which you typed the command is displayed.

show user

Displays the properties of a specified remote access user or users. Used without parameters, show user displays the properties of all remote access users.

Syntax

show user [**name=**UserName] [[mode=] {permit | report}]

Parameters

name= UserName   : Specifies, by logon name, the user whose properties you want to display. If you do not specify a user, the properties of all users are displayed.

mode= { permit | report } : Specifies whether to show properties for all users or only those whose dial-up permission is set to permit. The permit parameter specifies that properties should be displayed only for users whose dial-up permission is permit. The report parameter specifies that properties should be displayed for all users.

set user

Sets the properties of the specified remote access user.

Syntax

set user [name=]UserName [dialin] {permit | deny | policy} [cbpolicy] {none | caller | admin [cbnumber=]CallbackNumber}

Parameters

name= UserName   : Required. Specifies, by logon name, the user for which you want to set properties.

[ dialin ] { permit | deny | policy } : Required. Specifies under what circumstances the user should be allowed to connect. The permit parameter specifies that the user should always be allowed to connect. The deny parameter specifies that the user should never be allowed to connect. The policy parameter specifies that remote access policies should determine whether the user is allowed to connect.

[ cbpolicy ] { none | caller | admin [ cbnumber= ] CallbackNumber } : Required. Specifies the callback policy for the user. The callback feature saves the user the cost of the phone call used to connect to a remote access server. The none parameter specifies that the user should not be called back. The caller parameter specifies that the user should be called back at a number specified by the user at connection time. The admin parameter specifies that the user should be called back at the number specified by the CallbackNumber parameter.

Remarks

• For users in a mixed-mode domain, the policy parameter and the deny parameter are equivalent.

Examples

To allow GuestUser to connect and be called back at 4255551212, type:

set user guestuser permit admin 4255551212

Netsh RAS IP context commands

The following commands are specific to the RAS IP context within the Netsh environment.

To view the command syntax, click a command:

dump 

Creates a script that contains the IP configuration of a remote access server. If you save this script to a file, you can use it to restore IP configuration settings.

Syntax

dump

Parameters

none

show config

Displays the current IP configuration of the remote access server.

Syntax

show config

Parameters

none

set negotiation

Specifies whether the remote access server should allow IP to be configured for any client connections the server accepts.

Syntax

set negotiation {allow | deny}

Parameters

{ allow | deny } : Required. Specifies whether to permit IP over client connections. The allow parameter allows IP over client connections. The deny parameter prevents IP over client connections.

set access

Specifies whether IP network traffic from any client should be forwarded to the network or networks to which the remote access server is connected.

Syntax

set access {all | serveronly}

Parameters

{ all | serveronly } : Required. Specifies whether clients should be able to reach the remote access server and any networks to which it is connected. The all parameter allows clients to reach networks through the server. The serveronly parameter allows clients to reach only the server.

set addrassign

Sets the method by which the remote access server should assign IP addresses to its clients.

Syntax

set addrassign {auto | pool}

Parameters

{ auto | pool } : Required. Specifies whether IP addresses should be assigned by using DHCP or from a pool of addresses held by the remote access server. The auto parameter specifies that addresses should be assigned by using DHCP. If no DHCP server is available, a random, private address is assigned. The pool parameter specifies that addresses should be assigned from a pool.

set addrreq

Specifies whether dial-up clients should be able to request their own IP addresses.

Syntax

set addrreq {allow | deny}

Parameters

{ allow | deny } : Required. Specifies whether clients should be able to request their own IP addresses. The allow parameter allows clients to request addresses. The deny parameter prevents clients from requesting addresses.

set broadcastnameresolution

Enables or disables broadcast name resolution using NetBIOS over TCP/IP.

Syntax

set broadcastnameresolution {enabled | disabled}

Parameters

{ enabled | disabled } : Required. Specifies whether to enable or disable broadcast name resolution using NetBIOS over TCP/IP.

add range

Adds a range of addresses to the pool of static IP addresses that the remote access server can assign to clients.

Syntax

add range [from=]StartingIPAddress [to=]EndingIPAddress

Parameters

[ from =] StartingIPAddress [ to =] EndingIPAddress   : Required. Specifies the range of IP addresses to add. The StartingIPAddress parameter specifies the first IP address in the range. The EndingIPAddress parameter specifies the last IP address in the range.

Examples

To add the range of IP addresses 10.2.2.10 to 10.2.2.20 to the static pool of IP addresses that the remote access server can assign, type:

add range from=10.2.2.10 to=10.2.2.20

delete range

Deletes a range of addresses from the pool of static IP addresses that the remote access server can assign to clients.

Syntax

delete range [from=]StartingIPAddress [to=]EndingIPAddress

Parameters

[ from =] StartingIPAddress [ to =] EndingIPAddress   : Required. Specifies the range of IP addresses to delete. The StartingIPAddress parameter specifies the first IP address in the range. The EndingIPAddress parameter specifies the last IP address in the range.

Examples

To delete the range of IP addresses 10.2.2.10 to 10.2.2.20 from the pool of static IP addresses that the remote access server can assign, type:

delete range from=10.2.2.10 to=10.2.2.20

delete pool

Deletes all addresses from the pool of static IP addresses that the remote access server can assign to clients.

Syntax

delete pool

Parameters

Netsh RAS IPX context commands

The following commands are specific to the RAS IPX context within the Netsh environment. The IPX/SPX protocol is not available on Windows XP 64-Bit Edition.

To view the command syntax, click a command:

dump 

Creates a script that contains the IPX configuration of the remote access server. If you save this script to a file, you can use it to restore IPX configuration settings.

Syntax

dump

Parameters

none

show config

Displays the current IPX configuration of the remote access server.

Syntax

show config

Parameters

none

set negotiation

Specifies whether the remote access server should allow IPX to be configured for any client connections it accepts.

Syntax

set negotiation {allow | deny}

Parameters

{ allow | deny } : Required. Specifies whether to allow IPX configuration. The allow parameter allows IPX configuration. The deny parameter prevents IPX configuration.

set access

Specifies whether IPX network traffic from any client should be forwarded to the network or networks to which the remote access server is connected.

Syntax

set access {all | serveronly}

Parameters

{ all | serveronly } : Required. Specifies whether IPX traffic should be forwarded. The all parameter allows IPX traffic to be forwarded. The serveronly parameter prevents traffic from being forwarded.

set netassign

Specifies the method by which the remote access server assigns IPX addresses to its clients.

Syntax

set netassign [method] {auto | pool | autosame | poolsame}

Parameters

[ method ] { auto | pool | autosame | poolsame } : Required. Specifies the method by which the remote access server assigns IPX addresses to clients. The auto parameter specifies that the remote access server should assign a different random IPX network number to each client. The pool parameter specifies that the remote access server should assign a different IPX address from a pool of addresses to each client. The autosame parameter specifies that the remote access server should generate a random IPX network number and assign it to all clients. The poolsame parameter specifies that the remote access server should assign an address from a pool to all clients.

Remarks

• For most configurations, either the autosame parameter or the poolsame parameter is recommended because they conserve network numbers and reduce network traffic.

• Before the remote access server assigns a network number to a client, the server must verify whether the number is already in use on the intranet to which the remote access server is connected. As a result, some addresses in the pool might not be assigned.

set pool

Specifies the pool of IPX addresses from which the remote access server can assign addresses to clients.

Syntax

set pool [firstnet=]IPXAddress [size=]{PoolSize | 0}

Parameters

[ firstnet =] IPXAddress   : Required. Specifies, in hexadecimal notation, the first IPX address in the pool.

[ size =]{ PoolSize | 0 } : Required. Specifies the size of the pool or that the pool should grow as needed. The PoolSize parameter specifies, in decimal notation, the number of IPX addresses in the pool. The 0 parameter specifies that the pool should grow as needed.

Examples

To specify that the pool of IPX addresses should start at AAAAAAA and grow as needed, type:

set pool AAAAAAA 0

set nodereq

Specifies whether dial-up clients should be permitted to request their own IPX node numbers.

Syntax

set nodereq {allow | deny}

Parameters

{ allow | deny } : Required. Specifies whether to allow clients to request their own IPX node numbers. The allow parameter grants such requests. The deny parameter ignores such requests.

Netsh RAS AppleTalk context commands

The following commands are specific to the RAS AppleTalk context within the Netsh environment. The AppleTalk protocol is not available on Windows XP Home Edition or Windows XP Professional.

To view the command syntax, click a command:

dump 

Creates a script that contains the AppleTalk configuration of the remote access server. If you save this script to a file, you can use it to restore AppleTalk configuration settings.

Syntax

dump

Parameters

none

show config

Displays the current AppleTalk configuration of the remote access server.

Syntax

show config

Parameters

none

set negotiation

Specifies whether the remote access server should allow AppleTalk to be configured for any client connections the server accepts.

Syntax

set negotiation {allow | deny}

Parameters

{ allow | deny } : Required. Specifies whether to allow AppleTalk configuration. The allow parameter allows configuration. The deny parameter prevents configuration.

set access

Specifies whether AppleTalk network traffic from any client should be forwarded to the network or networks to which the remote access server is connected.

Syntax

set access {all | serveronly}

Parameters

{ all | serveronly } : Required. Specifies whether to forward AppleTalk network traffic. The all parameter allows traffic to be forwarded. The serveronly parameter prevents traffic from being forwarded.

Netsh RAS AAAA context commands

The following commands are specific to the RAS AAAA context within the Netsh environment.

To view the command syntax, click a command:

dump 

Displays the AAAA configuration of a remote access server in script form.

Syntax

dump

Parameters

none

add acctserv

Specifies the IP address or the DNS name of a RADIUS server to use for accounting and specifies accounting options.

Syntax

add acctserv [name=]ServerID [[secret=]SharedSecret] [[init-score=]ServerPriority] [[port=]Port] [[timeout=]Seconds] [[messages] {enabled | disabled}]

Parameters

[ name =] ServerID   : Required. Specifies, by IP address or DNS name, the RADIUS server.

[ secret =] SharedSecret   : Specifies the shared secret.

[ init-score =] ServerPriority   : Specifies the initial score (server priority).

[ port =] Port   : Specifies the port to which accounting requests should be sent.

[ timeout =] Seconds   : Specifies the timeout period, in seconds, during which the RADIUS server can be idle before it should be marked unavailable.

[ messages ] { enabled | disabled } : Specifies whether to send accounting on/off messages. The enabled parameter specifies that messages should be sent. The disabled parameter specifies that messages should not be sent.

delete acctserv

Deletes a RADIUS accounting server.

Syntax

delete acctserv [name=]ServerID

Parameters

[ name =] ServerID   : Required. Specifies, by DNS name or IP address, which server to delete.

set acctserv

Provides the IP address or the DNS name of a RADIUS server to use for accounting.

Syntax

add acctserv [name=]ServerID [[secret=]SharedSecret] [[init-score=]ServerPriority] [[port=]Port] [[timeout=]Seconds] [[messages] {enabled | disabled}]

Parameters

[ name= ] ServerID   : Required. Specifies, by IP address or DNS name, the RADIUS server.

[ secret= ] SharedSecret   : Specifies the shared secret.

[ init-score= ] ServerPriority   : Specifies the initial score (server priority).

[ port= ] Port   : Specifies the port on which to send the authentication requests.

[ timeout= ] Seconds   : Specifies, in seconds, the amount of time that should elapse before the RADIUS server is marked unavailable.

[ messages= ] { enabled | disabled } : Specifies whether accouting on/off messages should be sent.

show acctserv

Displays detailed information about an accounting server. Used without parameters, show acctserv displays information about all configured accounting servers.

Syntax

show acctserv [[name=]ServerID]

Parameters

[ name =] ServerID   : Specifies, by DNS name or IP address, the RADIUS server about which to display information.

add authserv

Provides the IP address or the DNS name of a RADIUS server to which authentication requests should be passed.

Syntax

add authserv [name=]ServerID [[secret=]SharedSecret] [[init-score=]ServerPriority] [[port=]Port] [[timeout=]Seconds] [[signature] {enabled | disabled}]

Parameters

[ name =] ServerID   : Required. Specifies, by IP address or DNS name, the RADIUS server.

[ secret =] SharedSecret   : Specifies the shared secret.

[ init-score =] ServerPriority   : Specifies the initial score (server priority).

[ port =] Port   : Specifies the port to which authentication requests should be sent.

[ timeout =] Seconds   : Specifies the timeout period, in seconds, during which the RADIUS server can be idle before it should be marked unavailable.

[ signature ] { enabled | disabled } : Specifies whether to use digital signatures. The enabled parameter specifies that digital signatures should be used. The disabled parameter specifies that digital signatures should not be used.

delete authserv

Deletes a RADIUS authentication server.

Syntax

delete authserv [name=]ServerID

Parameters

[ name =] ServerID   : Required. Specifies, by DNS name or IP address, which server to delete.

set authserv

Provides the IP address or the DNS name of a RADIUS server to which authentication requests should be passed.

Syntax

set authserv [name=]ServerID [[secret=]SharedSecret] [[init-score=]ServerPriority] [[port=]Port] [[timeout=]Seconds] [[signature] {enabled | disabled}]

Parameters

[ name= ] ServerID   : Required. Specifies, by IP address or DNS name, the RADIUS server.

[ secret= ] SharedSecret   : Specifies the shared secret.

[ init-score= ] ServerPriority   : Specifies the initial score (server priority).

[ port= ] Port   : Specifies the port on which to send the authentication requests.

[ timeout= ] Seconds   : Specifies the amount of time, in seconds, that should elapse before the RADIUS server is marked unavailable.

[ signature= ] { enabled | disabled } : Specifies whether digital signatures should be used.

show authserv

Displays detailed information about an authentication server. Used without parameters, show authserv displays information about all configured authentication servers.

Syntax

show authserv [[name=]ServerID]

Parameters

[ name =] ServerID   : Specifies, by DNS name or IP address, the RADIUS server about which to display information.

set acco

Specifies the accounting provider.

Syntax

set acco provider {windows | radius | none}

Parameters

provider { windows | radius | none } : Required. Specifies whether accounting should be performed and by which server. The windows parameter specifies that Windows security should perform accounting. The radius parameter specifies that a RADIUS server should perform accounting. The none parameter specifies that no accounting should be performed.

show acco

Displays the accounting provider.

Syntax

show acco

Parameters

none

set authe

Specifies the authentication provider.

Syntax

set authe provider {windows | radius}

Parameters

provider { windows | radius } : Required. Specifies which technology should perform authentication. The windows parameter specifies that Windows security should perform authentication. The radius parameter specifies that a RADIUS server should perform authentication.

show authe

Displays the authentication provider.

Syntax

show authe

Parameters

none

Formatting legend

Format	Meaning
Italic	Information that the user must supply
Bold	Elements that the user must type exactly as shown
Ellipsis (...)	Parameter that can be repeated several times in a command line
Between brackets ([])	Optional items
Between braces ({}); choices separated by pipe (|). Example: {even|odd}	Set of choices from which the user must choose only one
Courier font	Code or program output