Windows7/windows2008 modifies remote Desktop connection and modifies firewall configuration script

I. explanation

For security, we often change the default remote connection port (tcp 3389) to other ports for the management of windows. When there are more windows machines to connect and manage, it is more complicated to modify. In addition, it is even more troublesome to modify the firewall. Moreover, modification errors may lock yourself out and cannot log on to the system, so at this time you need a scripting tool to modify the port and firewall with one click. Back up the registry before modification.

II. Script

@ echo off@echo [remote Desktop Port Modification] CLS MODE con: COLS=68 LINES=20:: MODE statement sets the width and height of the form SetLocal EnableDelayedExpansion set/p d = "enter a new remote desktop port:" set port=%d% echo will modify the remote desktop port to [% d%]. Echo allows the [% d%] port to pass through the [% d%] port if [system Firewall] or [IPSec Policy] or [TCP/IP filtering] and other echo protection software are enabled. Otherwise, it is possible to be locked out of the system, resulting in the system can not connect remotely! Echo press any key to continue operation. Pause > nul set Str=0123456789ABCDEF: loop set/a yearly% d%% set/a d=%d%%/16 set yawning Strange% y% pommel 1! Set e% y% e% if% d% geq 1 goto loop echo-echo is creating a registry file. Ping-n 2 127.0.1 > nul echo Windows Registry Editor Version 5.00 > c:\ Remote.reg echo [HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ Wds\ rdpwd\ Tds\ tcp] > > c:\ Remote.reg echo "PortNumber" = dword:0000%e% > > c:\ Remote.reg echo [HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Control\ Terminal Server\ WinStations\ RDP-Tcp] > c:\ Remote.reg echo "PortNumber" = dword:0000%e% > c:\ Remote.reg echo Importing registry files to change system default settings. Ping-n 2127.0.1 > nul regedit / s c:\ Remote.reg del c:\ Remote.reg & & echo temporary file has been deleted. Ping-n 2127.0.1 > nul echo-echo port has been modified (restart takes effect! To modify the firewall policy. Netsh advfirewall firewall delete rule name= "mstsc_port%port%" netsh advfirewall firewall add rule name= "mstsc_port%port%" protocol=TCP dir=in localport= "% port%" action=allow remoteip= echo Firewall opened remote port [% port%] successfully! Echo press any key to exit. Pause > nul

III. Supplement-add rules to the head of the fire wall through python

Add ip and service ports in real time through python to add blacklist

Import osimport time# add os.system ("netsh advfirewall firewall add rule name=%s dir=in action=block protocol=TCP remoteip=%s localport=%s"% ("deny_3389", "172.16.3.140", 3389)) # Delete os.system ("netsh advfirewall firewall delete rule name=%s"% "deny_3389")