windows 2003 自动安全设置

nawawa001

　　@echo off
echo.
echo.
echo.
echo 〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓
echo.
echo.
echo             windows 2003 自动安全设置程序
echo.                           
echo             "为走过的路做纪念,希望你能记得"
echo.
echo      注：     不要放在根目录执行
echo             *请用名为administrator的账号运行
echo.          *执行完成后只能用超级管理员登陆*   
echo.
echo.                                      
echo.                                      
echo 〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓〓
pause
cls
　　echo.
echo.
echo.
echo 内容包括：
echo          更改GUTEST和SUPPORT_388945a0的密码
echo          注消危险组件
echo          取消显示上次登陆用户名
echo          防御TELNET登陆
echo          限制一些险的端口的访问，如135，137，138,139,445
echo          限制RADMIN应用
echo          防御密码记录工具NTPass及类似
echo          关闭一些不常用的服务
echo          优化系统和优化组策略安全
echo          设置超级管理员账号并限制只有这个账号能远程
echo          加强DDOS防御能力
echo          禁用cmd
echo          删除SQL2000危险的存储过程
echo          系统磁盘盘权限设定
echo          WEB权限安全设置
echo          系统垃圾清理
echo.
echo.
echo.
　　cls
echo .
echo ---------------------------------------------------
echo  请先替操作系统打上所有更新补丁!特别是SP2这样的
echo  安全设置后打有可能会打不上，请注意
echo ---------------------------------------------------
echo .
pause
set lb=%cd%
　　cls
echo .
echo ---------------------------------------------------
echo  是否要更改GUTEST和SUPPORT_388945a0的密码
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要更改请按 Y，否请按 N。"
if %errorlevel% equ 2 goto firstgo
net user guest SDFse7%6$3
net user SUPPORT_388945a0 g@#!hao(^$875
:firstgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否要注消危险组件
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要注消请按 Y，否请按 N。"
if %errorlevel% equ 2 goto secgo
regsvr32 /u /s %SystemRoot%\System32\wshom.ocx
regsvr32 /u /s %SystemRoot%\system32\shell32.dll
regsvr32 /u /s %SystemRoot%\system32\npptools.dll
reg copy "HKEY_CLASSES_ROOT\Shell.Application" "HKEY_CLASSES_ROOT\Shell.Application_sfqas" /s /f
reg delete "HKEY_CLASSES_ROOT\Shell.Application" /f
reg delete "HKEY_CLASSES_ROOT\Shell.Application_sfqas\CLSID" /f
reg add HKEY_CLASSES_ROOT\Shell.Application_sfqas\CLSID /v (默认) /t REG_SZ /d
reg copy "HKEY_CLASSES_ROOT\Shell.Application.1" "HKEY_CLASSES_ROOT\Shell.Application.1_sfqas" /s /f
reg delete "HKEY_CLASSES_ROOT\Shell.Application.1" /f
reg delete "HKEY_CLASSES_ROOT\Shell.Application.1_sfqas\CLSID" /f
reg add HKEY_CLASSES_ROOT\Shell.Application.1_sfqas\CLSID /v (默认) /t REG_SZ /d
:secgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否取消显示上次登陆用户名
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要取消请按 Y，否请按 N。"
if %errorlevel% equ 2 goto thirdgo
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DontDisplayLastUserName /t reg_dword /d 00000001 /f
:thirdgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否防御TELNET登陆
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要防御请按 Y，否请按 N。"
if %errorlevel% equ 2 goto sixgo
echo exit>>%SystemRoot%\system32\login.cmd
:sixgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否限制一些险的端口的访问，如135，137，138,139,
echo   445，593,1025,2745,3127,4489,6129
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要限制请按 Y，否请按 N。"
if %errorlevel% equ 2 goto sevengo
echo 名字为sfqas的安全策略
netsh ipsec static add policy name=sfqas的安全策略
netsh ipsec static add filterlist name=允许列表
netsh ipsec static add filterlist name=拒绝列表
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=135
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=137
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=138
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=139
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=445
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=593
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=1025
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=2745
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=3127
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=4489
netsh ipsec static add filter filterlist=拒绝列表  srcaddr=any dstaddr=me description=别人到我特定访问 protocol=tcp mirrored=yes dstport=6129
netsh ipsec static add filteraction name=充许  action=permit
netsh ipsec static add filteraction name=拒绝  action=block
netsh ipsec static add rule name=拒绝规则  policy=sfqas的安全策略 filterlist=拒绝列表 filteraction=拒绝
netsh ipsec static set policy name=sfqas的安全策略 assign=y
:sevengo
　　cls
echo .
echo ---------------------------------------------------
echo  是否限制RADMIN应用
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要限制请按 Y，否请按 N。"
if %errorlevel% equ 2 goto eightgo
if exist %SystemRoot%\system32\r_server.exe echo " 如果有RADMIM，删除"
r_server.exe /stop
r_server /uninstall /silence
del %SystemRoot%\system32\r_server.exe
del %SystemRoot%\system32\admdll.dll
del %SystemRoot%\system32\radbrv.dll
:eightgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否防御密码记录工具NTPass及类似
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要防御请按 Y，否请按 N。"
if %errorlevel% equ 2 goto ninego
if exist %SystemRoot%\system32\ntpass.dll ehco "如果有密码记录器NTPass，删除"
echo you are a bitch>%systemroot%\system32\eulagold.txt
rundll32 NTPass.dll,Remove
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/eulagold.txt /t /e /c /r administrators
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /d service /c
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /d batch /c
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /d interactive /c
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /d system /c
echo y| cacls %SystemRoot%/system32/eulagold.txt /e /d users /c
attrib +R +A +S +H %SystemRoot%/system32/eulagold.txt
if exist %SystemRoot%\system32\GinaPwd.txt ehco "如果有密码记录器GinaPwd，删除"
echo you are a bitch>%systemroot%\system32\GinaPwd.txt
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /t /e /c /r administrators
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /d service /c
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /d batch /c
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /d interactive /c
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /d system /c
echo y| cacls %SystemRoot%/system32/GinaPwd.txt /e /d users /c
attrib +R +A +S +H %SystemRoot%/system32/GinaPwd.txt
:ninego
　　cls
echo .
echo ---------------------------------------------------
echo  是否关闭一些不常用的服务
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要关闭请按 Y，否请按 N。"
if %errorlevel% equ 2 goto eightgo
sc config Alerter start= disabled
sc stop Alerter
sc config dfs start= demand
sc stop Browser
sc config messenger start= disabled
sc stop messenger
sc config tlntsvr start= disabled
sc stop tlntsvr
sc config  Browser start= DISABLED
sc stop Browser
sc config  Spooler start= DISABLED
sc stop Spooler
sc config  RemoteRegistry start= DISABLED
sc stop RemoteRegistry
sc config  lanmanserver start= DISABLED
sc stop lanmanserver
sc config  LmHosts start= DISABLED
sc stop LmHosts
sc config  WZCSVC start= DISABLED
sc stop WZCSVC
sc config  lanmanworkstation start= DISABLED
sc stop lanmanworkstation
sc config SysmonLog start= disabled
:eightgo
　　
cls
echo .
echo ---------------------------------------------------
echo  是否优化系统和优化组策略安全
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要优化请，*（注意优化后只能用超级管理员登陆）按 Y，否请按 N。"
if %errorlevel% equ 2 goto tengo
echo 优化系统
reg add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_DWORD /d 1 /f
reg add "HKCU\Control Panel\Desktop" /v HungAppTimeout /d 50 /f
reg add "HKCU\Control Panel\Desktop" /v WaitToKillAppTimeout /d 200 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v Auto /d 0 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SFCDisable /t REG_DWORD /d 4294967197 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v MaxConnectionsPer1_0Server /t REG_DWORD /d 8 /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v MaxConnectionsPerServer /t REG_DWORD /d 8 /f
reg add HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer /v Link /t REG_BINARY /d 00000000 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /v NoLowDiskSpaceChecks /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v ConfigFileAllocSize /t REG_DWORD /d 500 /f
reg add HKCU\Console /v LoadConIme /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v AutoReboot /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v CrashDumpEnabled /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d %SystemRoot%\MEMORY.DMP /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v LogEvent /t REG_DWORD /d 0 /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d %SystemRoot%\Minidump /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v Overwrite /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\ControlSet001\Control\CrashControl /v SendAlert /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting /v DoReport /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting /v ShowUI /t REG_DWORD /d 0 /f
echo 优化组策略安全
cd /d %lb%
　　echo [Unicode] >sfqas.inf
echo Unicode=yes >>sfqas.inf
echo [System Access] >>sfqas.inf
echo MinimumPasswordAge = 2 >>sfqas.inf
echo MaximumPasswordAge = 42 >>sfqas.inf
echo MinimumPasswordLength = 0 >>sfqas.inf
echo PasswordComplexity = 0 >>sfqas.inf
echo PasswordHistorySize = 24 >>sfqas.inf
echo LockoutBadCount = 5 >>sfqas.inf
echo ResetLockoutCount = 3 >>sfqas.inf
echo LockoutDuration = 3 >>sfqas.inf
echo RequireLogonToChangePassword = 0 >>sfqas.inf
echo ForceLogoffWhenHourExpire = 0 >>sfqas.inf
echo NewGuestName = "MyGuestOne" >>sfqas.inf
echo ClearTextPassword = 0 >>sfqas.inf
echo LSAAnonymousNameLookup = 0 >>sfqas.inf
echo EnableAdminAccount = 1 >>sfqas.inf
echo EnableGuestAccount = 0 >>sfqas.inf
echo [Event Audit] >>sfqas.inf
echo AuditSystemEvents = 3 >>sfqas.inf
echo AuditLogonEvents = 3 >>sfqas.inf
echo AuditObjectAccess = 0 >>sfqas.inf
echo AuditPrivilegeUse = 3 >>sfqas.inf
echo AuditPolicyChange = 3 >>sfqas.inf
echo AuditAccountManage = 3 >>sfqas.inf
echo AuditProcessTracking = 0 >>sfqas.inf
echo AuditDSAccess = 0 >>sfqas.inf
echo AuditAccountLogon = 3 >>sfqas.inf
echo [Registry Values] >>sfqas.inf
echo MACHINE\Software\Microsoft\Driver Signing\Policy=3,1 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateCDRoms=1,"0" >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD=1,"0" >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateFloppies=1,"0" >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"10" >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,1 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,"0" >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,0 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,1 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7, >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption=4,0 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,0 >>sfqas.inf
echo MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UndockWithoutLogon=4,0 >>sfqas.inf
echo MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel=4,5 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\NoDefaultAdminOwner=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine=7, >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\Machine=7, >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optional=7,Posix >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7, >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionShares=7, >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge=4,30 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,0 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1 >>sfqas.inf
echo MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1 >>sfqas.inf
echo [Privilege Rights] >>sfqas.inf
echo SeNetworkLogonRight = IUSR_%COMPUTERNAME%,IWAM_%COMPUTERNAME%,ASPNET,Guests,everyone >>sfqas.inf
echo SeRemoteShutdownPrivilege = Administrators >>sfqas.inf
echo SeIncreaseBasePriorityPrivilege = Administrators >>sfqas.inf
echo SeLoadDriverPrivilege = administrator >>sfqas.inf
echo SeSecurityPrivilege = Administrators >>sfqas.inf
echo SeSystemEnvironmentPrivilege = Administrators >>sfqas.inf
echo SeSystemProfilePrivilege = Administrators >>sfqas.inf
echo SeTakeOwnershipPrivilege = Administrators >>sfqas.inf
echo SeDenyNetworkLogonRight = Administrators >>sfqas.inf
echo SeManageVolumePrivilege = Administrators >>sfqas.inf
echo SeRemoteInteractiveLogonRight = administrator >>sfqas.inf
echo [Version] >>sfqas.inf
echo signature="$CHICAGO$" >>sfqas.inf
echo Revision=1 >>sfqas.inf
secedit /configure /db sfqas.sdb /cfg sfqas.inf /log sfqas.log /overwrite /quiet
del sfqas.*
　　
:tengo
　　cls
echo .
echo ---------------------------------------------------
echo  是否加强DDOS防御能力
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要加强请按 Y，否请按 N。"
if %errorlevel% equ 2 goto elego
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpTimedWaitDelay /t reg_dword /d 00000030 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v SynAttackProtect /t reg_dword /d 00000002 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpen /t reg_dword /d 00000200 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxHalfOpenRetried /t reg_dword /d 00000096 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxConnectResponseRetransmissions /t reg_dword /d 00000003 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxDataRetransmissions /t reg_dword /d 00000005 /f
:elego
　　cls
echo ---------------------------------------------------
echo 是否启用服务器的网络共享?(共享服务可提供网络文件共享实现远程备份,比如NAS备份)
echo 如果前面限制了端口请不指派sfqas的安全策略并删除该策略
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "是请按Y，否请按N。"
echo .
echo ---------------------------------------------------
if %errorlevel% equ 2 goto noshare
reg add HKLM\SOFTWARE\Microsoft\Ole /v EnableDCOM /d Y /f
reg add HKLM\SOFTWARE\Microsoft\Rpc /v "DCOM Protocols" /t REG_MULTI_SZ /d ncacn_ip_tcp\0 /f
reg add HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters /v SMBDeviceEnabled /t REG_DWORD /d 1 /f
sc config MSDTC start= AUTO
sc config lanmanworkstation start= AUTO
sc config lanmanserver start= AUTO
sc config Browser start= AUTO
echo y| cacls %SystemRoot%\system32\activeds.dll /G administrators:F SYSTEM:F IIS_WPG:R
sc start MSDTC
sc start lanmanworkstation
sc start lanmanserver
sc start Browser
:noshare
　　cls
echo .
echo ---------------------------------------------------
echo  是否禁用注册表工具
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要禁用请按 Y，否请按 N。"
if %errorlevel% equ 2 goto fourthgo
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t reg_dword /d 00000001 /f
:fourthgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否禁用cmd
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要禁用请按 Y，否请按 N。"
if %errorlevel% equ 2 goto fifthgo
reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t reg_dword /d 00000001 /f
:fifthgo
　　cls
echo .
echo ---------------------------------------------------
echo  是否开启WINDOWS防火墙，并只开放3389.FTP.80,和自己的远程端口，允许PING
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "要开启请按 Y，否请按 N。"
if %errorlevel% equ 2 goto firewallgo
sc config ShareAccess start= auto
sc start ShareAccess
netsh firewall set opmode mode = ENABLE
netsh firewall set icmpsetting 8
netsh firewall set portopening tcp 3389
netsh firewall set portopening tcp 21 sfqas_ftplink
netsh firewall set portopening tcp 20 sfqas_ftpdata
netsh firewall set portopening tcp 80 sfqas_web
echo .
CHOICE /C YN /M "远程端口是不是3389,要设置请按 Y，否请按 N。"
if %errorlevel% equ 2 goto firewallgo1
set mstscnumb1=
:numnogo
cls
set /p mstscnumb1=你的远程端口号：
if not defined mstscnumb1 goto numnogo
echo  你的远程端口号是：%mstscnumb1%
netsh firewall set portopening tcp %mstscnumb1% sfqas_mstsc
:firewallgo1
:firewallgo
　　cls
echo .
echo ---------------------------------------------------
echo 是否删除SQL2000危险的存储过程(如无安装SQL请不要运行!)
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "删除请按 Y，否请按 N。"
if %errorlevel% equ 2 goto ynono
echo ---------------------------------------------------
echo 请在弹出窗口内点击上方的绿色三角运行里面的代码才生效！准备好请按y
echo ---------------------------------------------------
if %errorlevel% equ 2 goto nono
echo use master
echo exec sp_dropextendedproc 'xp_cmdshell' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_enumgroups' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_loginconfig' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regaddmultistring' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regdeletekey' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regdeletevalue' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regread' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regremovemultistring' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regwrite' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_enumerrorlogs' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_getfiledetails' >>sql.sql
echo go >>sql.sql
echo exec sp_dropextendedproc 'xp_regenumvalues' >>sql.sql
echo go >>sql.sql
copy /Y sql.sql "C:\Documents and Settings\All Users\「开始」菜单\程序\Microsoft SQL Server\sql.sql"
start /d "C:\Documents and Settings\All Users\「开始」菜单\程序\Microsoft SQL Server" 查询分析器 -d master -E -f "C:\Documents and Settings\All Users\「开始」菜单\程序\Microsoft SQL Server\sql.sql"
echo ---------------------------------------------------
echo 请在弹出窗口内点击上方的绿色三角运行里面的代码才生效！你点了么？请按任意键继续. . .
echo ---------------------------------------------------
pause
del sql.sql
del "%systemdrive%\Documents and Settings\All Users\「开始」菜单\程序\Microsoft SQL Server\sql.sql"
　　:ynono
:nono
　　cls
echo 系统磁盘盘权限设定
echo 删除C盘的根目录的权限
echo y| Cacls %systemdrive%\ /e /c /r everyone
echo y| Cacls %systemdrive%\ /e /c /r "creator owner"
echo y| Cacls %systemdrive%\ /e /c /r users
echo y| Cacls "%systemdrive%\Documents and Settings\All Users\Documents" /e /c /r "creator owner"
echo y| Cacls "%systemdrive%\Documents and Settings\All Users\Documents" /e /c /r "power users"
echo y| Cacls "%systemdrive%\Documents and Settings\All Users\Documents" /e /c /r users
echo y| Cacls "%systemdrive%\Documents and Settings" /e /c /r everyone
echo y| Cacls "%systemdrive%\Documents and Settings\Administrator\「开始」菜单\程序\启动" /e /c /r administrators
echo y| Cacls "%systemdrive%\Documents and Settings\Administrator\「开始」菜单\程序\启动" /e /c /r system
echo y| Cacls "%systemdrive%\Documents and Settings\All Users\「开始」菜单\程序\启动" /e /c /r system
echo y| Cacls "%systemdrive%\Documents and Settings\All Users\「开始」菜单\程序\启动" /e /c /r administrators
　　attrib +R +A +S +H %systemdrive%\wmpub
echo y| Cacls %systemdrive%\wmpub /e /c /r "creator owner"
echo y| Cacls %systemdrive%\wmpub /e /c /r "power users"
echo y| Cacls %systemdrive%\wmpub /e /c /r users
echo y| Cacls %systemdrive%\wmpub /e /c /r administrators
echo y| Cacls %systemdrive%\wmpub /e /c /r system
echo y| Cacls %systemdrive%\wmpub /e /c /r administrators
echo y| Cacls %systemdrive%\wmpub /e /c /r system
　　attrib +R +A +S +H %systemdrive%\WINDOWS\addins
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r "creator owner"
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r "power users"
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r users
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r administrators
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r system
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r administrators
echo y| Cacls %systemdrive%\WINDOWS\addins /e /c /r system
　　echo .
echo ---------------------------------------------------
echo 如果你的WEB以前用的USERS或是everyone权限，下面的操作可能会导致无权限访问，是否操作？
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "是请按 Y，否请按 N。"
if %errorlevel% equ 2 goto confirm1
echo "删除D盘的根目录的权限"
echo y| Cacls D:\ /t /e /c /r everyone
echo y| Cacls D:\ /t /e /c /r "creator owner"
echo y| Cacls D:\ /t /e /c /r users
echo "删除E盘的根目录的权限"
echo y| Cacls E:\ /t /e /c /r everyone
echo y| Cacls E:\ /t /e /c /r "creator owner"
echo y| Cacls E:\ /t /e /c /r users
echo "删除F盘的根目录的权限"
echo y| Cacls F:\ /t /e /c /r everyone
echo y| Cacls F:\ /t /e /c /r "creator owner"
echo y| Cacls F:\ /t /e /c /r users
echo "删除G盘的根目录的权限"
echo y| Cacls G:\ /t /e /c /r everyone
echo y| Cacls G:\ /t /e /c /r "creator owner"
echo y| Cacls G:\ /t /e /c /r users
echo "删除H盘的根目录的权限"
echo y| Cacls H:\ /t /e /c /r everyone
echo y| Cacls H:\ /t /e /c /r "creator owner"
echo y| Cacls H:\ /t /e /c /r users
echo "删除I盘的根目录的权限"
echo y| Cacls I:\ /t /e /c /r everyone
echo y| Cacls I:\ /t /e /c /r "creator owner"
echo y| Cacls I:\ /t /e /c /r users
:confirm1
　　echo "2003减少C盘的危险文件的访问权限"
attrib +R +A +S +H %SystemRoot%/system32/shell32.dll
echo y| cacls %SystemRoot%/system32/shell32.dll /e /d guests /c
attrib +R +A +S +H %SystemRoot%/system32/wshom.ocx
echo y| cacls %SystemRoot%/system32/wshom.ocx /e /d guests /c
attrib +R +A +S +H %SystemRoot%/system32/npptools.dll
echo y| cacls %SystemRoot%/system32/npptools.dll /e /d users /c
　　attrib +R +A +S +H %SystemRoot%/system32/Cmd.exe
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /d telnetclients /c
echo y| cacls %SystemRoot%/system32/Cmd.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/net.exe
echo y| cacls %SystemRoot%/system32/net.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/net.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/net.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/net.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/net.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/net.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/net.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/net.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/reg.exe
echo y| cacls %SystemRoot%/system32/reg.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/reg.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/reg.exe /e /d system:r /c
　　attrib +R +A +S +H %SystemRoot%/system32/netsh.exe
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/netsh.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/sc.exe
echo y| cacls %SystemRoot%/system32/sc.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/sc.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/sc.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/sc.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/sc.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/sc.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/sc.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/net1.exe
echo y| cacls %SystemRoot%/system32/net1.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/net1.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/net1.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/netstat.exe
echo y| cacls %SystemRoot%/system32/netstat.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/netstat.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/netstat.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/netstat.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/netstat.exe /e /d batch /c
　　attrib +R +A +S +H %SystemRoot%/system32/ftp.exe
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/ftp.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/ftp.exe /e /d system /c
　　
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/at.exe
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/at.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/at.exe
echo y| cacls %SystemRoot%/system32/at.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/at.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/at.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/at.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/at.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/at.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/at.exe /e /d system /c
　　attrib +R +A +S +H cacls %SystemRoot%/system32/dllcache/utilman.exe
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/utilman.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/utilman.exe
echo y| cacls %SystemRoot%/system32/utilman.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/utilman.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/utilman.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/utilman.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/utilman.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/utilman.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/utilman.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/sethc.exe
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/sethc.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/sethc.exe
echo y| cacls %SystemRoot%/system32/sethc.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/sethc.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/sethc.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/sethc.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/sethc.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/sethc.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/sethc.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/magnify.exe
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/magnify.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/magnify.exe
echo y| cacls %SystemRoot%/system32/magnify.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/magnify.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/magnify.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/magnify.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/magnify.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/magnify.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/magnify.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/osk.exe
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/osk.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/osk.exe
echo y| cacls %SystemRoot%/system32/osk.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/osk.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/osk.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/osk.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/osk.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/osk.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/osk.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/cacls.exe
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/cacls.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/cacls.exe
echo y| cacls %SystemRoot%/system32/cacls.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/cacls.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/cacls.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/cacls.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/cacls.exe /e /d batch /c
　　attrib +R +A +S +H %SystemRoot%/system32/dllcache/attrib.exe
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/dllcache/attrib.exe /e /d system /c
　　attrib +R +A +S +H %SystemRoot%/system32/attrib.exe
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /g administrator:f /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/attrib.exe /e /d system /c
　　echo y| cacls %SystemRoot%/system32/secedit.exe /e /g administrator:f /c
cls
echo .
echo ---------------------------------------------------
echo 是否要修改administrator名字，是按Y，否按N？
echo ---------------------------------------------------
echo .
if %errorlevel% equ 2 goto confirml
set username1=
:usernogo
cls
echo 设置超级管理员账号并只允许此账号远程
set /p username1=请输入新的administrator名字：
if not defined username1 goto usernogo
echo  你设置的超级管理员用户名是：%username1%
　　echo [version] >sfqas.inf
echo signature="$CHICAGO$" >>sfqas.inf
echo Revision=1 >>sfqas.inf
echo [System Access] >>sfqas.inf
echo NewAdministratorName = "%username1%" >>sfqas.inf
secedit /configure /db sfqas.sdb /cfg sfqas.inf /log sfqas.log /overwrite /quiet
del sfqas.*
:confirml
　　attrib +R +A +S +H %SystemRoot%/system32/secedit.exe
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d guests /c
echo y| cacls %SystemRoot%/system32/secedit.exe /e /r administrators
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d interactive /c
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d service /c
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d batch /c
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d users /c
echo y| cacls %SystemRoot%/system32/secedit.exe /e /d system /c
　　cls
echo .
echo ---------------------------------------------------
echo 如果你是虚拟主机系统，如hz，此步请选N？
echo ---------------------------------------------------
echo .
CHOICE /C YN /M "不是请按 Y，是请按 N。"
if %errorlevel% equ 2 goto confirm2
echo y| cacls %SystemRoot%/system32/cacls.exe /e /d system /c
echo y| cacls %SystemRoot%/system32/cacls.exe /e /d interactive /c
:confirm2
　　
　　
cls
@echo 索引系统垃圾列表中....
del /f /s /q %systemdrive%\*.tmp
del /f /s /q %systemdrive%\*._mp
del /f /s /q %systemdrive%\*.log
del /f /s /q %systemdrive%\*.gid
del /f /s /q %systemdrive%\*.chk
del /f /s /q %systemdrive%\*.old
del /f /s /q %systemdrive%\recycled\*.*
del /f /s /q %windir%\*.bak
del /f /s /q %windir%\prefetch\*.*
del  /s /q %windir%\temp\*.*
del /f /q %userprofile%\cookies\*.*
del /f /q %userprofile%\recent\*.*
del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
del /f /s /q "%userprofile%\Local Settings\Temp\*.*"
del /f /s /q "%userprofile%\recent\*.*"
@echo 系统垃圾清理完毕!