diff --git a/t-sql/README.md b/t-sql/README.md
index 2bd646d..d74852e 100644
--- a/t-sql/README.md
+++ b/t-sql/README.md
@@ -13,6 +13,18 @@ commit; -- if all ok
 rollback; --if not ok
 ```
 
+## check memory of DB server
+
+```
+SELECT
+  (physical_memory_in_use_kb/1024) AS Memory_usedby_Sqlserver_MB,
+  (locked_page_allocations_kb/1024) AS Locked_pages_used_Sqlserver_MB,
+  (total_virtual_address_space_kb/1024) AS Total_VAS_in_MB,
+  process_physical_memory_low,
+  process_virtual_memory_low
+FROM sys.dm_os_process_memory;
+```
+
 ## Check if a List of numbers exist in a table:
 
 ``` sql
diff --git a/win-sysadmin/README.md b/win-sysadmin/README.md
index 858138c..168b1ac 100644
--- a/win-sysadmin/README.md
+++ b/win-sysadmin/README.md
@@ -42,3 +42,66 @@ ShellExView can be used for solving context-menu problems in Explorer environmen
 
 http://www.nirsoft.net
 
+## Files
+
+### Find encrypted Files
+
+```
+cmd> cipher /s:D:\beispiel\pfad
+```
+
+## CMD
+
+### run CMD as different user
+
+```
+runas /user:"infra.vs.ch\fedcom" cmd
+```
+
+if you want to use `system` user:
+
+  - Auf Server PsExec installieren https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
+  - CMD als Admin ausführen
+  - `PsExec64.exe -s cmd`
+  - Test mit Befehl: `whoami`. Dann sollte `nt authority\system` erscheinen.
+
+### Access fileshare in CMD
+
+If you’ve ever tried to access a network file share in a command prompt by simply using the cd command, you’ll know that it just complains that “CMD does not support UNC paths as current directories”. Well, there is a way to do it (two in fact):
+
+#### net use
+
+```
+net use z: \\machine\share
+```
+
+It can be combined with the `/user` switch to provide additional user details:
+
+```
+net use z: \\machine\share /user:domain\username
+```
+
+delete:
+
+```
+net use p: /delete
+```
+
+#### pushd
+
+```
+pushd \\machine\share
+```
+
+The bonus of using the `pushd` command over the `net use` command is that it will automatically change the current directory to the mapped drive (which will be the first unused drive letter available in reverse alphabetical order). Also, when finished with the network share, you can use the `popd` command to remove the mapped drive.
+
+### run multiple batch files in one file
+
+`cmd.exe /C`, danach die bat-Datei in Anführungszeichen, und Parameter je nachdem ob sie gebraucht werden. Weil ein Misch ist, ein @ davor setzen.
+
+Bsp. Inhalt einer Master-.bat Datei, mit mehreren bat Aufrufen (und einer env-variable)
+
+```
+cmd.exe /C @"fedora-purge.bat" abc.def.ch:8443 fedoraAdmin %FEDORAPW% CH-000999-4:328110 https "delete because more recent version CH-000917-4:331101"
+cmd.exe /C @"fedora-purge.bat" abc.def.ch:8443 fedoraAdmin %FEDORAPW% CH-000999-4:328111 https "delete because more recent version CH-000917-4:331101"
+```