How to realize the batch bat recording every time you enter the 3389 remote Desktop IP
Editor to share with you how to record each entry into the 3389 remote Desktop IP batch bat, I believe that most people do not know much, so share this article for your reference, I hope you can learn a lot after reading this article, let's go to know it!
The code is as follows:
MD C:\ WINDOWS\ PDPLOG
Echo date / t ^ > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD
Echo time / t ^ > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD
Echo netstat-n-p tcp ^ | find ": 3389" > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD
Echo start Explorer > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD
:: add the IP that users automatically record every time they enter the remote desktop, which can be used to find hackers!
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v fInheritInitialProgram / t REG_DWORD / d "00000000" / f
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v WorkDirectory / t REG_SZ / d C:\ WINDOWS\ PDPLOG\ / f
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v InitialProgram / t REG_SZ / d "C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD" / f
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v fInheritInitialProgram / t REG_DWORD / d "00000000" / f
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v WorkDirectory / t REG_SZ / d C:\ WINDOWS\ PDPLOG\ / f
REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v InitialProgram / t REG_SZ / d "C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD" / f
Echo record remote Desktop IP policy added! Please press any key to exit!
PAUSE > nul
Echo netstat-n-p tcp ^ | find ": 3389" > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD
There is a number 3389 in the above sentence, which is the default port for remote desktops.
If you change your remote desktop friend, you need to replace 3389 with the port you changed.
The place to view the records is C:\ WINDOWS\ PDPLOG\ RDPlog.txt
The above is all the contents of the article "how to record batch bat every time you enter the 3389 remote Desktop IP". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!
