TAT执行远程操作时指定用户名的话一定要在用户名之前加.\

原创

Windows技术交流

修改于 2023-03-15 13:51:42

8860

修改于 2023-03-15 13:51:42

公共镜像买台windows机器，执行以下powershell命令以支持WinRM

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\WinRM" /f 2>&1 >$null
stop-service mpssvc 2>&1 > $null
winrm quickconfig -q 2>&1 > $null
winrm quickconfig -q -force 2>&1 > $null
restart-service winrm 2>&1 > $null
winrm set winrm/config/client '@{TrustedHosts="*"}' 2>&1 > $null
netstat -ato|findstr :5985

然后关机做自定义镜像 → 假如基于此镜像买4台机器，在其中1台机器的TAT上执行以下代码可以重启其他3台机（具体化代码中的密码、IP）

$Username = '.\Administrator'
$Password = '密码'
$pass = ConvertTo-SecureString -AsPlainText $Password -Force
$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList $Username,$pass

Restart-Computer -ComputerName 10.255.4.2 -Credential $Cred -Force
Restart-Computer -ComputerName 10.255.4.31 -Credential $Cred -Force
Restart-Computer -ComputerName 10.255.4.137 -Credential $Cred -Force

TAT代码健壮性很重要，其中Administrator前面的.\非常重要，没有这个的话，在TAT执行时会报错access denied

如果是用wmic命令重启，也是一样的，用户名前面必须得有.\，否则在TAT执行时会报access denied

①wmic调用cmd命令

wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -r -t 0"
wmic /node:"10.255.4.31" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -r -t 0"
wmic /node:"10.255.4.137" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -r -t 0"

②wmic调用powershell命令

wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command Restart-Computer -force"
wmic /node:"10.255.4.31" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command Restart-Computer -force"
wmic /node:"10.255.4.137" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command Restart-Computer -force"

如果是修改主机名，也得注意在用户名之前加.\

$Username = '.\Administrator'
$Password = '密码'
$pass = ConvertTo-SecureString -AsPlainText $Password -Force
$Cred = New-Object System.Management.Automation.PSCredential -ArgumentList $Username,$pass
Rename-Computer -ComputerName 10.255.4.2 -NewName "ins-bncpvh9p" -LocalCredential $Cred -Force -Restart
Rename-Computer -ComputerName 10.255.4.31 -NewName "ins-6cw479bj" -LocalCredential $Cred -Force -Restart
Rename-Computer -ComputerName 10.255.4.137 -NewName "ins-mybe6ww1" -LocalCredential $Cred -Force -Restart
其中的-LocalCredential也可以换成-DomainCredential

如果是用wmic来实现修改主机名：

wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Get-WmiObject Win32_ComputerSystem).Rename('ins-bncpvh9p')"
wmic /node:"10.255.4.31" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Get-WmiObject Win32_ComputerSystem).Rename('ins-6cw479bj')"
wmic /node:"10.255.4.137" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Get-WmiObject Win32_ComputerSystem).Rename('ins-mybe6ww1')"

wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -f -r -t 0"
wmic /node:"10.255.4.31" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -f -r -t 0"
wmic /node:"10.255.4.137" /USER:".\administrator" /password:"密码" process call create "shutdown.exe -f -r -t 0"

或者

wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Rename-Computer -ComputerName 10.255.4.2 -NewName 'ins-bncpvh9p' -Force -Restart) "
wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Rename-Computer -ComputerName 10.255.4.31 -NewName 'ins-6cw479bj' -Force -Restart) "
wmic /node:"10.255.4.2" /USER:".\administrator" /password:"密码" process call create "powershell.exe -command (Rename-Computer -ComputerName 10.255.4.137 -NewName 'ins-mybe6ww1' -Force -Restart) "

如果出现ReturnValue = 2的这种情况，可能是OS内有第三方安全软件拦截了命令，比如360，退出了再试，就成功了