ฉันพบความลับของรีจิสตรีนี้หลังจากทำการค้นหาเล็กน้อยในความคิดเห็นของหนึ่งในบทความ Remote Desktopทุกสถานที่ แต่ฉันต้องทำการแก้ไขเล็กน้อย
ก่อนอื่นฉันต้องลบกลุ่มผู้ใช้เดสก์ท็อประยะไกลที่ฉันสร้างขึ้นเอง (ตามคำแนะนำของความคิดเห็นอื่น ) (ฉันสร้างด้วยnet localgroup "Remote Desktop Users" /add
ลบลบด้วยnet localgroup "Remote Desktop Users" /delete
)
จากนั้นฉันนำเข้าไฟล์รีจิสทรีเป็นบัญชี SYSTEM ฉันไม่รู้ทุกอย่างที่สคริปต์รีจิสตรีนี้ทำ (ฉันจะอัปเดตหากฉันเข้าใจมากขึ้นเกี่ยวกับสิ่งที่มันทำ) แต่มันใช้ได้สำหรับฉัน สังเกตการเปลี่ยนแปลงที่ฉันทำจากข้อมูลในลิงค์ซอร์ส: ฉันเปลี่ยนอักขระ open-quote และ close-quote เป็นอักขระเครื่องหมายคำพูดคู่ง่าย ๆ และเพิ่มเครื่องหมายทับและ0
อักขระเพิ่มเติมในแต่ละAliases00###
รายการ ( ...\Aliases0000234
กลายเป็น...\Aliases\00000234
)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000243]
"C"=hex:43,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,46,00,00,\
00,00,00,00,00,f8,00,00,00,e2,00,00,00,00,00,00,00,dc,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,41,00,63,00,63,00,65,00,73,00,73,00,20,00,43,00,6f,00,6e,00,\
74,00,72,00,6f,00,6c,00,20,00,41,00,73,00,73,00,69,00,73,00,74,00,61,00,6e,\
00,63,00,65,00,20,00,4f,00,70,00,65,00,72,00,61,00,74,00,6f,00,72,00,73,00,\
00,00,4d,00,65,00,6d,00,62,00,65,00,72,00,73,00,20,00,6f,00,66,00,20,00,74,\
00,68,00,69,00,73,00,20,00,67,00,72,00,6f,00,75,00,70,00,20,00,63,00,61,00,\
6e,00,20,00,72,00,65,00,6d,00,6f,00,74,00,65,00,6c,00,79,00,20,00,71,00,75,\
00,65,00,72,00,79,00,20,00,61,00,75,00,74,00,68,00,6f,00,72,00,69,00,7a,00,\
61,00,74,00,69,00,6f,00,6e,00,20,00,61,00,74,00,74,00,72,00,69,00,62,00,75,\
00,74,00,65,00,73,00,20,00,61,00,6e,00,64,00,20,00,70,00,65,00,72,00,6d,00,\
69,00,73,00,73,00,69,00,6f,00,6e,00,73,00,20,00,66,00,6f,00,72,00,20,00,72,\
00,65,00,73,00,6f,00,75,00,72,00,63,00,65,00,73,00,20,00,6f,00,6e,00,20,00,\
74,00,68,00,69,00,73,00,20,00,63,00,6f,00,6d,00,70,00,75,00,74,00,65,00,72,\
00,2e,00,00,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000227]
"C"=hex:27,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,20,00,00,\
00,00,00,00,00,d0,00,00,00,d2,00,00,00,00,00,00,00,a4,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,42,00,61,00,63,00,6b,00,75,00,70,00,20,00,4f,00,70,00,65,00,\
72,00,61,00,74,00,6f,00,72,00,73,00,42,00,61,00,63,00,6b,00,75,00,70,00,20,\
00,4f,00,70,00,65,00,72,00,61,00,74,00,6f,00,72,00,73,00,20,00,63,00,61,00,\
6e,00,20,00,6f,00,76,00,65,00,72,00,72,00,69,00,64,00,65,00,20,00,73,00,65,\
00,63,00,75,00,72,00,69,00,74,00,79,00,20,00,72,00,65,00,73,00,74,00,72,00,\
69,00,63,00,74,00,69,00,6f,00,6e,00,73,00,20,00,66,00,6f,00,72,00,20,00,74,\
00,68,00,65,00,20,00,73,00,6f,00,6c,00,65,00,20,00,70,00,75,00,72,00,70,00,\
6f,00,73,00,65,00,20,00,6f,00,66,00,20,00,62,00,61,00,63,00,6b,00,69,00,6e,\
00,67,00,20,00,75,00,70,00,20,00,6f,00,72,00,20,00,72,00,65,00,73,00,74,00,\
6f,00,72,00,69,00,6e,00,67,00,20,00,66,00,69,00,6c,00,65,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000239]
"C"=hex:39,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,2e,00,00,\
00,00,00,00,00,e0,00,00,00,76,00,00,00,00,00,00,00,58,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,43,00,72,00,79,00,70,00,74,00,6f,00,67,00,72,00,61,00,70,00,\
68,00,69,00,63,00,20,00,4f,00,70,00,65,00,72,00,61,00,74,00,6f,00,72,00,73,\
00,00,00,4d,00,65,00,6d,00,62,00,65,00,72,00,73,00,20,00,61,00,72,00,65,00,\
20,00,61,00,75,00,74,00,68,00,6f,00,72,00,69,00,7a,00,65,00,64,00,20,00,74,\
00,6f,00,20,00,70,00,65,00,72,00,66,00,6f,00,72,00,6d,00,20,00,63,00,72,00,\
79,00,70,00,74,00,6f,00,67,00,72,00,61,00,70,00,68,00,69,00,63,00,20,00,6f,\
00,70,00,65,00,72,00,61,00,74,00,69,00,6f,00,6e,00,73,00,2e,00,00,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000242]
"C"=hex:42,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,2c,00,00,\
00,00,00,00,00,dc,00,00,00,ae,00,00,00,00,00,00,00,8c,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,48,00,79,00,70,00,65,00,72,00,2d,00,56,00,20,00,41,00,64,00,\
6d,00,69,00,6e,00,69,00,73,00,74,00,72,00,61,00,74,00,6f,00,72,00,73,00,4d,\
00,65,00,6d,00,62,00,65,00,72,00,73,00,20,00,6f,00,66,00,20,00,74,00,68,00,\
69,00,73,00,20,00,67,00,72,00,6f,00,75,00,70,00,20,00,68,00,61,00,76,00,65,\
00,20,00,63,00,6f,00,6d,00,70,00,6c,00,65,00,74,00,65,00,20,00,61,00,6e,00,\
64,00,20,00,75,00,6e,00,72,00,65,00,73,00,74,00,72,00,69,00,63,00,74,00,65,\
00,64,00,20,00,61,00,63,00,63,00,65,00,73,00,73,00,20,00,74,00,6f,00,20,00,\
61,00,6c,00,6c,00,20,00,66,00,65,00,61,00,74,00,75,00,72,00,65,00,73,00,20,\
00,6f,00,66,00,20,00,48,00,79,00,70,00,65,00,72,00,2d,00,56,00,2e,00,00,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022C]
"C"=hex:2c,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,3e,00,00,\
00,00,00,00,00,f0,00,00,00,d8,00,00,00,00,00,00,00,c8,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,20,00,43,00,6f,00,\
6e,00,66,00,69,00,67,00,75,00,72,00,61,00,74,00,69,00,6f,00,6e,00,20,00,4f,\
00,70,00,65,00,72,00,61,00,74,00,6f,00,72,00,73,00,00,00,4d,00,65,00,6d,00,\
62,00,65,00,72,00,73,00,20,00,69,00,6e,00,20,00,74,00,68,00,69,00,73,00,20,\
00,67,00,72,00,6f,00,75,00,70,00,20,00,63,00,61,00,6e,00,20,00,68,00,61,00,\
76,00,65,00,20,00,73,00,6f,00,6d,00,65,00,20,00,61,00,64,00,6d,00,69,00,6e,\
00,69,00,73,00,74,00,72,00,61,00,74,00,69,00,76,00,65,00,20,00,70,00,72,00,\
69,00,76,00,69,00,6c,00,65,00,67,00,65,00,73,00,20,00,74,00,6f,00,20,00,6d,\
00,61,00,6e,00,61,00,67,00,65,00,20,00,63,00,6f,00,6e,00,66,00,69,00,67,00,\
75,00,72,00,61,00,74,00,69,00,6f,00,6e,00,20,00,6f,00,66,00,20,00,6e,00,65,\
00,74,00,77,00,6f,00,72,00,6b,00,69,00,6e,00,67,00,20,00,66,00,65,00,61,00,\
74,00,75,00,72,00,65,00,73,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000223]
"C"=hex:23,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,16,00,00,\
00,00,00,00,00,c8,00,00,00,bc,00,00,00,00,00,00,00,84,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,50,00,6f,00,77,00,65,00,72,00,20,00,55,00,73,00,65,00,72,00,\
73,00,00,00,50,00,6f,00,77,00,65,00,72,00,20,00,55,00,73,00,65,00,72,00,73,\
00,20,00,61,00,72,00,65,00,20,00,69,00,6e,00,63,00,6c,00,75,00,64,00,65,00,\
64,00,20,00,66,00,6f,00,72,00,20,00,62,00,61,00,63,00,6b,00,77,00,61,00,72,\
00,64,00,73,00,20,00,63,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,\
6c,00,69,00,74,00,79,00,20,00,61,00,6e,00,64,00,20,00,70,00,6f,00,73,00,73,\
00,65,00,73,00,73,00,20,00,6c,00,69,00,6d,00,69,00,74,00,65,00,64,00,20,00,\
61,00,64,00,6d,00,69,00,6e,00,69,00,73,00,74,00,72,00,61,00,74,00,69,00,76,\
00,65,00,20,00,70,00,6f,00,77,00,65,00,72,00,73,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022B]
"C"=hex:2b,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,28,00,00,\
00,00,00,00,00,d8,00,00,00,7a,00,00,00,00,00,00,00,54,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,20,00,44,00,65,00,73,00,\
6b,00,74,00,6f,00,70,00,20,00,55,00,73,00,65,00,72,00,73,00,4d,00,65,00,6d,\
00,62,00,65,00,72,00,73,00,20,00,69,00,6e,00,20,00,74,00,68,00,69,00,73,00,\
20,00,67,00,72,00,6f,00,75,00,70,00,20,00,61,00,72,00,65,00,20,00,67,00,72,\
00,61,00,6e,00,74,00,65,00,64,00,20,00,74,00,68,00,65,00,20,00,72,00,69,00,\
67,00,68,00,74,00,20,00,74,00,6f,00,20,00,6c,00,6f,00,67,00,6f,00,6e,00,20,\
00,72,00,65,00,6d,00,6f,00,74,00,65,00,6c,00,79,00,00,00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000228]
"C"=hex:28,02,00,00,00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,14,00,00,\
00,00,00,00,00,c4,00,00,00,4a,00,00,00,00,00,00,00,10,01,00,00,00,00,00,00,\
00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,00,02,\
00,30,00,02,00,00,00,02,c0,14,00,13,00,05,01,01,01,00,00,00,00,00,01,00,00,\
00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,00,4c,\
00,03,00,00,00,00,00,14,00,0c,00,02,00,01,01,00,00,00,00,00,01,00,00,00,00,\
00,00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
00,18,00,1f,00,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,01,02,\
00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,05,20,00,00,\
00,20,02,00,00,52,00,65,00,70,00,6c,00,69,00,63,00,61,00,74,00,6f,00,72,00,\
53,00,75,00,70,00,70,00,6f,00,72,00,74,00,73,00,20,00,66,00,69,00,6c,00,65,\
00,20,00,72,00,65,00,70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,\
20,00,69,00,6e,00,20,00,61,00,20,00,64,00,6f,00,6d,00,61,00,69,00,6e,00,00,\
00
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Access Control Assistance Operators]
@=hex(243):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators]
@=hex(227):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Cryptographic Operators]
@=hex(239):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Hyper-V Administrators]
@=hex(242):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators]
@=hex(22c):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Power Users]
@=hex(223):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users]
@=hex(22b):
[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Replicator]
@=hex(228):
ที่จะนำเข้าไฟล์รีจิสทรีภายใต้บัญชีระบบผมใช้เครื่องมือ PsExec.exe จากแพคเกจ Microsoft TechNet "สาธารณูปโภคกระบวนการ" PsTools มันเป็นแพ็คเกจไปรษณีย์ดังนั้นคุณไม่จำเป็นต้องติดตั้งอะไรเลย หลังจากทำการแตกไฟล์ PsExec.exe ฉันก็รันมันในฐานะผู้ดูแลระบบด้วยคำสั่งต่อไปนี้: PsExec.exe -s -i regedit.exe
. จากหน้าต่าง Registry Editor ฉันเลือกFile > Import
และสำรวจตำแหน่งของไฟล์รีจิสตรี
ในการนำเข้าไฟล์รีจิสตรีสำเร็จคุณไม่จำเป็นต้องใช้ PsExec แต่คุณจำเป็นต้องได้รับอนุญาตให้เขียนลงในHKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\
คีย์ของ Registry ซึ่งคุณสามารถรับได้โดยการจำลองสิทธิ์จากHKEY_LOCAL_MACHINE\SAM
คีย์ไปยังลูก ๆ (คีย์ย่อย) .
หลังจากนำเข้าไฟล์รีจิสตรี้ฉันเพิ่มผู้ใช้ไปยังกลุ่มผู้ใช้เดสก์ท็อประยะไกล ( net localgroup "Remote Desktop Users" [username] /add
) และด้วยผู้ใช้เหล่านั้นฉันสามารถเข้าถึงพีซี Windows 7 Home Premium ด้วย Remote Desktop
net localgroup "Remote Desktop Users" [username] /add
ฉันยังมีการเพิ่มผู้ใช้ไม่ใช่ผู้ดูแลระบบของฉันไปที่กลุ่มที่มี นอกจากนี้ฉันยังเคยสร้างกลุ่มด้วยnet localgroup "Remote Desktop Users" /add
และฉันไม่สามารถเข้าสู่ระบบก่อนที่จะลบกลุ่มท้องถิ่นนั้น