windows服務(wù)器記錄3389遠(yuǎn)程桌面IP策略

2024-09-10 00:01:45

字體：大中小

供稿：網(wǎng)友

下面的代碼復(fù)制一下存成一個(gè)批處理文件后雙擊即可! 3389IP日志路徑是C:/WINDOWS/PDPLOG/RDPlog.txt
程序代碼
復(fù)制代碼代碼如下:
MD C:/WINDOWS/PDPLOG
echo date /t ^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo time /t ^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo netstat -n -p tcp ^| find ":3389"^>^>RDPlog.txt >>C:/WINDOWS/PDPLOG/PdPLOG.CMD
echo start Explorer >>C:/WINDOWS/PDPLOG/PdPLOG.CMD

:: 添加用戶每次進(jìn)入遠(yuǎn)程桌面時(shí)自動(dòng)記錄下來(lái)所用IP，可用來(lái)發(fā)現(xiàn)黑客蹤跡！
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d "00000000" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v WorkDirectory /t REG_SZ /d C:/WINDOWS/PDPLOG/ /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/ControlSet001/Control/Terminal Server/WinStations/RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:/WINDOWS/PDPLOG/PdPLOG.CMD" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v fInheritInitialProgram /t REG_DWORD /d "00000000" /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v WorkDirectory /t REG_SZ /d C:/WINDOWS/PDPLOG/ /f
REG ADD "HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/WinStations/RDP-Tcp" /v InitialProgram /t REG_SZ /d "C:/WINDOWS/PDPLOG/PdPLOG.CMD" /f

Echo 記錄遠(yuǎn)程桌面IP策略添加完畢! 請(qǐng)按任意鍵退出!
PAUSE >nul

上一篇：Windows服務(wù)器SNMP服務(wù)的配置方法

下一篇：windows上面安裝squid加速代理網(wǎng)站配置方法