Shulou(Shulou.com)06/03 Report--

Editor to share with you how to record each entry into the 3389 remote Desktop IP batch bat, I believe that most people do not know much, so share this article for your reference, I hope you can learn a lot after reading this article, let's go to know it!

The code is as follows:

MD C:\ WINDOWS\ PDPLOG

Echo date / t ^ > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD

Echo time / t ^ > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD

Echo netstat-n-p tcp ^ | find ": 3389" > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD

Echo start Explorer > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD

:: add the IP that users automatically record every time they enter the remote desktop, which can be used to find hackers!

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v fInheritInitialProgram / t REG_DWORD / d "00000000" / f

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v WorkDirectory / t REG_SZ / d C:\ WINDOWS\ PDPLOG\ / f

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v InitialProgram / t REG_SZ / d "C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD" / f

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v fInheritInitialProgram / t REG_DWORD / d "00000000" / f

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v WorkDirectory / t REG_SZ / d C:\ WINDOWS\ PDPLOG\ / f

REG ADD "HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp" / v InitialProgram / t REG_SZ / d "C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD" / f

Echo record remote Desktop IP policy added! Please press any key to exit!

PAUSE > nul

Echo netstat-n-p tcp ^ | find ": 3389" > ^ > RDPlog.txt > > C:\ WINDOWS\ PDPLOG\ PdPLOG.CMD

There is a number 3389 in the above sentence, which is the default port for remote desktops.

If you change your remote desktop friend, you need to replace 3389 with the port you changed.

The place to view the records is C:\ WINDOWS\ PDPLOG\ RDPlog.txt

The above is all the contents of the article "how to record batch bat every time you enter the 3389 remote Desktop IP". Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.