RunDLL32.exe – Windows CMD Command
Run a 32 bit DLL function.
Rundll32 is available on all version of Windows from Windows 95 onwards, but only runs in 32 bit mode.
Syntax RUNDLL32.EXE dll_name,EntryPoint [optional_arguments] Key dll_name A full path to the DLL to ensure that the correct one is found. For best results, use the short file name. EntryPoint The name of the entry point function.
The dll_name and the EntryPoint function name can be separated by either a space ( ) or a comma (,)
In some cases two or more commas are required, for example here we pass the value 1 as the second argument to Intl.cpl:
Rundll32.exe shell32.dll,Control_RunDLL Intl.cpl,,1
DLL options may be case sensitive, Rundll32 may also fail if there is any additional white space in between the dll_name, the comma, and the EntryPoint function. If you pass the wrong type of DLL to Rundll32, it may fail to run without returning any error message.
Rundll32 was originally designed only for internal use at Microsoft. It can be used generally but requires the DLL being called to include a suitable function signature to match the operation you are calling. See the full details in Q164787.
The internet has many lists of Rundll32 ‘cheat codes’ , that do mostly work, but many are calling an invalid or missing function signature. This means there is a chance they may stop working (or start working in a different way) after some future Windows update.
There are often more robust methods to achieve the same thing such as Start Run commands or Shell: folder shortcuts.
Examples
Add a Network Printer:
RUNDLL32 printui.dll,PrintUIEntry /ia /c\\server /m “AGFA-AccuSet v52.3”
/h “Intel” /v “Windows 2000” /f %windir%\inf\ntprint.inf
Add a Local Printer:
RUNDLL32 printui.dll,PrintUIEntry /if /b “Test Printer” /c\\SERVER
/f “%windir%\inf\ntprint.inf” /r “lpt1:” /m “AGFA-AccuSet v52.3”
Add a printer connection that’s available to anyone who logs on:
Rundll32 printui.dll,PrintUIEntry /ga /n\\Server\PrintShare
Display the per-Machine printer connections:
RUNDLL32 printui.dll,PrintUIEntry /ge /c”\\workstation64″
Display all the available commands for PRINTUI.DLL – add/remove print drivers, print queues, preferences, properties etc:
RUNDLL32 printui.dll,PrintUIEntry /?
Clear IE Tracks:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess number
where number is one (or several added) of the following values:
1 Browsing History 2 Cookies 4 Temporary Internet Files 8 Offline favorites and download history 16 Form Data 32 Passwords 64 Phishing Filter Data 128 Web page Recovery Data 256 Do not Show GUI when running the cache clear 512 Do not use Multi-threading for deletion 1024 Valid only when browser is in private browsing mode 2048 Tracking Data 4096 Data stored by add-ons 8192 Preserve Cached data for Favorite websites
Lock workstation:
RUNDLL32.exe user32.dll, LockWorkStation
n.b. this is an unsupported hack, which may fail in the future – details on oldnewthing
A PowerShell function: Lock-WorkStation is supported.
Very clean website , appreciate it for this post.
Hi there! I know this is kinda off topic but I was wondering which blog platform are you using for this site? I’m getting tired of WordPress because I’ve had issues with hackers and I’m looking at options for another platform. I would be fantastic if you could point me in the direction of a good platform.