@echo off
echo ----------------------------------
echo ----正在備份註冊表 請稍後....----
echo ----------------------------------
reg export "HKEY_LOCAL_MACHINE" C:/reg_backup.reg
echo ----------------------
echo ----註冊表備份完成----
echo ----------------------
ping 127.0.0.1 -n 3 >nul
echo -----------------------------------
echo ----安全配置正在改寫 請稍候...----
echo -----------------------------------
@ping 127.0.0.1 -n 3 >nul
echo ----------------------
echo ----正在禁用空連接----
echo ----------------------
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v restrictanonymous /t reg_dword /d 1 /f
echo --------------------------
echo ----禁用空連接設置完畢----
echo --------------------------
@ping 127.0.0.1 -n 3 >nul
echo ------------------------
echo ----正在刪除默認共享----
echo ------------------------
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /v AutoShareServer /t reg_dword /d 0 /f
echo ----------------------------
echo ----刪除默認共享設置完畢----
echo ----------------------------
@ping 127.0.0.1 -n 3 >nul
echo ------------------------------
echo ----正在修改TTL值請稍後...----
echo ------------------------------
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v DefaultTTL /t reg_dword /d 53 /f
echo -------------------
echo ----TTL修改完畢----
echo -------------------
@ping 127.0.0.1 -n 3 >nul
echo -----------------------
echo ----防止syn洪水***----
echo -----------------------
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v SynAttackProtect /t reg_dword /d 2 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnablePMTUDiscovery /t reg_dword /d 0 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v NoNameReleaseOnDemand /t reg_dword /d 1 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableDeadGWDetect /t reg_dword /d 0 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v KeepAliveTime /t reg_dword /d 300000 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v PerformRouterDiscovery /t reg_dword /d 0 /f
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableICMPRedirects /t reg_dword /d 0 /f
echo -------------------------------
echo ----防止syn洪水***設置完畢----
echo -------------------------------
@ping 127.0.0.1 -n 3 >nul
echo ------------------------------
echo ------------------------------
echo ---- 系統服務修改 ----
echo ------------------------------
echo ------------------------------
@ping 127.0.0.1 -n 3 >nul
echo --------------------
echo ----修改3389端口----
echo --------------------
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\Tds\tcp" /v PortNumber /t reg_dword /d 44454 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentContro1Set\Control\Tenninal Server\WinStations\RDP\Tcp" /v PortNumber /t reg_dword /d 44454 /f
echo --------------------
echo ----修改PORT完畢----
echo --------------------
@ping 127.0.0.1 -n 3 >nul
echo -------------------------------------
echo ----正在開啓系統防火牆 請稍後....----
echo -------------------------------------
sc config sharedaccess start= auto & net start sharedaccess
echo ------------------------
echo ----系統防火牆已開啓----
echo ------------------------
@ping 127.0.0.1 -n 3 >nul
echo ----------------------------
echo ----正在關閉共享打印服務----
echo ----------------------------
@sc config Spooler start= disabled
sc config LanmanServer start= disabled
sc config LmHosts start= disabled
echo --------------------------
echo ----已關閉共享打印服務----
echo --------------------------
@ping 127.0.0.1 -n 3 >nul
echo ----------------------------
echo ----正在關閉遠程協助服務----
echo ----------------------------
@sc config RDSessMgr start= disabled
echo --------------------------
echo ----已關閉遠程協助服務----
echo --------------------------
@ping 127.0.0.1 -n 3 >nul
echo ------------------------------
echo ----正在關閉遠程註冊表服務----
echo ------------------------------
@sc config RemoteRegistry start= disabled
echo ----------------------------
echo ----已關閉遠程註冊表服務----
echo ----------------------------
@ping 127.0.0.1 -n 3 >nul
echo ----------------------------
echo ----關閉自動硬件播放通知----
echo ----------------------------
sc config ShellHWDetection start= disabled
echo -----------------------
echo ----自動播放通知關閉---
echo -----------------------
@ping 127.0.0.1 -n 3 >nul
echo ----------------------------------------
echo ----正在關閉替換憑據下的啓動進程服務----
echo ----------------------------------------
sc config seclogon start= disabled
echo --------------------------
echo ----已關閉啓動進程服務----
echo --------------------------
@ping 127.0.0.1 -n 3 >nul
echo ------------------------------------
echo ----IEEE 802.11 適配器的自動配置----
echo ------------------------------------
sc config WZCSVC start= disabled
echo ------------------
echo ----已關閉IEEE----
echo ------------------
@ping 127.0.0.1 -n 3 >nul
echo --------------------------
echo ----客戶端跟蹤服務關閉----
echo --------------------------
sc config TrkSvr start= disabled
sc config MSDTC start= disabled
echo ----------------------------
echo ----已關閉客戶端跟蹤服務----
echo ----------------------------
@ping 127.0.0.1 -n 3 >nul
echo --------------------
echo ----幫助中心關閉----
echo --------------------
sc config helpsvc start= disabled
echo --------------------------
echo ----已關閉幫助中心服務----
echo --------------------------
@ping 127.0.0.1 -n 3 >nul
echo --------------------------------
echo --------------------------------
echo ---- 系統權限加固 ----
echo --------------------------------
echo --------------------------------
echo -------------------------------------------------------
echo ----C盤(系統盤) (administrators,system完全控制權限)----
echo -------------------------------------------------------
cacls C:\ /t /c /g administrators:F system:F
echo -------------------------------------------
echo ----Common Files (everyone用戶只讀權限)----
echo -------------------------------------------
Cacls "C:\Program Files\Common Files" /t /e /c /g everyone:R
echo -------------------------------------------------------------
echo ----IIS Temporary Compressed Files (everyone用戶更改權限)----
echo -------------------------------------------------------------
Cacls "C:\WINDOWS\IIS Temporary Compressed Files" /t /e /c /g everyone:C
echo --------------------------------------------
echo ----Microsoft.Net (everyone用戶只讀權限)----
echo --------------------------------------------
Cacls C:\WINDOWS\Microsoft.Net /t /e /c /g everyone:R
echo ------------------------------------------------------
echo ----Temporary ASP.NET Files (everyone用戶更改權限)----
echo ------------------------------------------------------
Cacls "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files" /t /e /c /g everyone:C
echo ------------------------------------------------------
echo ----Temporary ASP.NET Files (everyone用戶更改權限)----
echo ------------------------------------------------------
Cacls "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files" /t /e /c /g everyone:C
echo -------------------------------------------
echo ----Registration (everyone用戶讀取權限)----
echo -------------------------------------------
Cacls C:\WINDOWS\Registration /t /e /c /g everyone:R
echo -----------------------------------
echo ----Temp (everyone用戶更改權限)----
echo -----------------------------------
Cacls C:\WINDOWS\Temp /t /e /c /g everyone:C
echo ---------------------------------------
echo ----assembly (everyone用戶讀取權限)----
echo ---------------------------------------
Cacls C:\WINDOWS\assembly /t /e /c /g everyone:R
echo -------------------------------------
echo ----WinSxS (everyone用戶讀取權限)----
echo -------------------------------------
Cacls C:\WINDOWS\WinSxS /t /e /c /g everyone:R
echo ------------------------------------
echo ----Fonts (everyone用戶讀取權限)----
echo ------------------------------------
Cacls C:\WINDOWS\Fonts /t /e /c /g everyone:R
echo ---------------------------------------
echo ----System32 (everyone用戶讀取權限)----
echo ---------------------------------------
Cacls C:\WINDOWS\System32 /t /e /c /g everyone:R
echo ------------------------------------------
echo ----msdtc (networkservice用戶更改權限)----
echo ------------------------------------------
Cacls C:\windows\system32\msdtc /t /e /c /g networkservice:C
echo -----------------------------------------------------
echo ----ASP Compiled Templates (everyone用戶更改權限)----
echo -----------------------------------------------------
Cacls "C:\WINDOWS\system32\inetsrv\ASP Compiled Templates" /t /e /c /g everyone:C
echo ------------------------------------
echo ----*.exe (去除everyone用戶權限)----
echo ------------------------------------
Cacls C:\WINDOWS\System32\*.exe /e /c /r everyone
echo ------------------------------------
echo ----cmd.exe (去除system用戶權限)----
echo ------------------------------------
Cacls C:\WINDOWS\System32\cmd.exe /e /c /r system
echo ------------------------------------
echo ----net.exe (去除system用戶權限)----
echo ------------------------------------
Cacls C:\WINDOWS\System32\net.exe /e /c /r system
echo -------------------------------------
echo ----net1.exe (去除system用戶權限)----
echo -------------------------------------
Cacls C:\WINDOWS\System32\net1.exe /e /c /r system
echo ----------------------------------------
echo ----msdtc.exe (everyone用戶讀取權限)----
echo ----------------------------------------
Cacls C:\WINDOWS\System32\msdtc.exe /e /c /g everyone:R
echo ------------------------------------------
echo ----dllhost.exe (everyone用戶讀取權限)----
echo ------------------------------------------
Cacls C:\WINDOWS\System32\dllhost.exe /e /c /g everyone:R
echo ------------------------------------------
echo ----svchost.exe (everyone用戶讀取權限)----
echo ------------------------------------------
Cacls C:\WINDOWS\System32\svchost.exe /e /c /g everyone:R
echo --------------------
echo --------------------
echo ----系統加固完畢----
echo --------------------
echo --------------------
@ping 127.0.0.1 -n 3 >nul
echo -----------------------------
echo ----安全設置完畢 歡迎使用----
echo -----------------------------
echo ------------------
echo ----重啓服務器----
echo ------------------
@ping 127.0.0.1
shutdown -r
@pause
Windows2003環境下的一鍵系統安全(更新)
發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章
如果同事暗中傷害你,應該怎麼辦?
這個饅頭有餡
2019-02-24 13:59:08
職場中,抱怨越多的員工,越被領導瞧不起!
這個饅頭有餡
2019-02-24 13:59:08
老程序員被裁,應屆生卻能月薪 1.3 萬?這你能忍?
前端高達
2019-02-24 13:48:04
遇到到處蹭吃卻從不請客吃飯的主怎麼辦?
樑軍年
2019-02-24 13:26:35
Linux基本操作命令
wbzjacky
2019-02-24 13:12:38
高標準機房綜合配線安裝
wbzjacky
2019-02-24 13:12:38
IPsec ***實驗
wbzjacky
2019-02-24 13:12:37
真實的模擬***綜合實驗
wbzjacky
2019-02-24 13:12:37
CISCO路由AAA的Easy ***
wbzjacky
2019-02-24 13:12:37
三層交換機的HSRP、vlan、端口聚合
wbzjacky
2019-02-24 13:12:37
CISCO訪問控制列表 企業網絡管理的必殺技
wbzjacky
2019-02-24 13:12:37
HSRP和二層交換機的端口聚合、vlan
wbzjacky
2019-02-24 13:12:37