The NT Toolkit is an impressive freeware tool collection from NT Toolkit 2.0 has been released some days ago. All tools come in one ZIP file and don't have to be installed. I am sure you will find some of these free admin tools useful for your daily work.

Latest posts by Michael Pietroforte (see all)

In this post, I listed all 28 utilities with short descriptions which I just copied from the NT ToolKit documentation. Please note that you have to double click to open a section in the navigation bar. New in NT Toolkit 2.0 is IPMon; +IPMon and CheckDB  now also run on on Linux, FreeBSD & OSX.

I will have a closer look at some of the tools in the near future and add them to our list of freeware tools . If you would like to review one of the tools for 4sysops, please leave me a message.

Graphical User Interface Applications

Hardlink Shell Extension

Hardlink Shell Extension is an extension to the Windows shell. It allows you to create hardlinks from within the explorer shell by right-clicking any file.


IPMon+ is the graphical version of IPMon, and also offers additional functionality not available in the command-line version. IPMon+ shows all TCP, UDP, ICMP and ARP connection endpoints between the local computer (default) and remote hosts, including the amount of data being transmitted through these connections. IPMon+ also supports promiscuous mode.


NetSend is an application with a graphical user interface that allows you to send a text message to a remote Windows NT, Windows 2000 or Windows XP computer that is running the Messenger service (activated by default)

Password Assistant

Password Assistant is a GUI application that lets you update passwords of user accounts on multiple Windows NT, Windows 2000 or Windows XP machines. A good example is updating the Administrator password on all of your networks workstations.


ShutdownTimer allows you to perform certain system actions either at a certain time or in a specified amount of time. The new conditional feature allows you to make the selected action based on whether certain files open over the network. See Usage for more information.

Event Message Browser

The Event Message Browser lets you review all the installed Message DLLs used by various system services and applications that log events to the event log. Additionally, you can also generate events to test any event log monitoring solutions (e.g. EventSentry) you have in place.

Applications running as a Service


ServiceScheduler is a scheduler service which controls (stops, starts, ...) services at specified times. It is independent from the Windows built-in scheduler service.

Command Line Applications


ADSList analyzes one or more directories and lists any alternate data streams (aka as "hidden streams") that are associated with a file. When an alternate data stream is found, the name of the stream is displayed along with the regular file the stream is associated with.


CheckDB verifies a database connection through ODBC to ensure that a connection to a database can be established. You can optionally also run a single SQL statement after a successful connection has been established.


CheckTCP is an command line application that can determine whether a TCP port on a host is open. Additionally you can receive initial data sent from the remote host through an open TCP connection, such as when connecting to most SMTP hosts.


CheckURL verifies availability of a web page and can also check for content inside the page and/or verify the checksum of that page. CheckURL can also log its actions to the event log and supports web-based authentication for password-protected web pages.


The Directory Monitor utility monitors a directory (and optionally sub directories) and displays all file changes in real-time. Dirmon will show you when

  • Files are added
  • Files are deleted
  • Files are modified


The Directory Size utility calculates the current size of a directory, including subdirectories, and displays it on the screen. The output shows the number of files and directories searched and the total size in physical (actual size taken up on the disk) and logical (actual file size) bytes.


FileReplace is a command line utility that parses a directory (including subdirectories) and replaces multiple occurrances of one template file.


FPing (Fast Ping) is an command line application that sends ICMP echo-type packets pings remote

hosts to determine whether they are up and running. FPing is intended to be a replacement for the ping.exe utility that ships with Windows. FPing will ping remote hosts much faster the built-in ping utility, but offers only the most commonly used features.


GetHTTP is an command line application that allows you to retrieve files through the HTTP protocol. Please note that SSL is not currently supported.


IPMon is a command-line utility that utilizes the WinPcap network driver to monitor IP traffic to the local host for troubleshooting and monitoring purposes. Unlike full blown network sniffers, IPMon only shows the IP addresses and ports (for TCP/UDP) affected, and groups output so that repetitive traffic is not being displayed. For example, any IP address that communicates with the local host where IPMon runs is only displayed once.


IsAdmin detects whether a user is a member of the local Administrators group, either through direct membership in the Administrators group or through indirect membership through another group.

Logoff Delay

Logoff Delay lets you log off a user in a specified amount of time. This can be useful if you want to restrict the logon time of users.


NTPClient returns the current time as reported by a NTP server and calculates the local clock offset based on RFC 1315 and RFC 2030. NTPClient supports the NTP (Network Time Protocol) up to version 3.


PageSNPP (SNPP stands for Simple Network Paging Protocol) is a command line application that sends short messages to pages using the SNPP protocol. You can only use PageSNPP if your paging provider supports SNPP.


ServiceSecure allows you to reset service passwords by specifying the username and password rather than having to specify the service names themselves or changing the password manually.

SHA Checksum Generator

The SHA Checksum Generator generates the SHA-256 checksum of a file and displays it on the screen. This is useful to ensure the integrity of a file and make sure that it has not been modified.


Sleep is an command line application that sleeps for Xmilliseconds and is most useful for use in batch files.


SuperDelete is a command line utility that parses a directory (including subdirectories) and deletes multiple occurrances of one file.


TaskSecure allows you to reset scheduled tasks passwords by specifying the username and password rather than having to manually open and reset each scheduled task on your network after a password change.


Uptime shows you the current uptime of the local host. Uptime can either update the current uptime every second and display it on the screen, or it can return the uptime one time and return. You can also have uptime return the uptime in seconds.

Subscribe to 4sysops newsletter!


The WakeOnLAN (WOL) utility sends a "magic" package to a network card, based on the MAC address. If the network card supports the "Wake On Lan" feature (and the feature is enabled in the BIOS of the computer), then the computer will power on automatically after receiving the packet.


Leave a reply

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account