windows 2003安全设置去权限批处理

echo.
rem 删除共享
echo =========================================================
net share c$ /delete
net share d$ /delete
net share e$ /delete
net share f$ /delete
net share admin$ /delete
net share ipc$ /delete
net stop server
net stop lanmanworkstation
echo =========================================================
rem 设置shell32.dll和wshom.ocx的权限
echo ======================================================
regsvr32 /u /s C:\WINDOWS\System32\wshom.ocx
ren C:\WINDOWS\System32\wshom.ocx wshom.ocx.bak
regsvr32 /u /s C:\WINDOWS\system32\shell32.dll
echo y|cacls c:\WINDOWS\system32\shell32.dll /g administrators:f system:f
echo y|cacls c:\WINDOWS\system32\shell.dll /g administrators:f system:f
echo =========================================================
rem 设置硬盘的更目录权限
echo =========================================================
echo y|cacls c:\    /g administrators:f system:f
echo y|cacls d:\    /g administrators:f system:f
echo y|cacls e:\  /t /g administrators:f system:f
echo.
echo ..........
echo.
echo =========================================================
rem 设置重要exe文件权限
echo ==============================================================
echo y|cacls C:\WINDOWS\system32\at.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\attrib.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\cacls.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\cmd.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\command.com /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\ftp.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\format.com /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\tftp.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\telnet.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\net.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\net1.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\debug.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\cacls.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\cscript.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\netsh.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\nbtstat.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\netstat.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\quser.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\regedit.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\regsvr32.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\hostname.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\wscript.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\ping.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\pathping.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\ipconfig.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\iisreset.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\logoff.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\setreg.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\setpwd.exe /g administrators:f system:f
echo y|cacls C:\WINDOWS\system32\setreg.exe /g administrators:f system:f
echo.
echo ..........
echo.
echo ==============================================================
rem 设置重要文件夹权限--这是IIS服务的最小权限
echo ==============================================================
cd/
echo "删除users和everyone的部分文件夹权限"
echo y|cacls "%SystemDrive%/Documents and Settings" /t /g administrators:f system:f
echo y|cacls "%SystemDrive%" /r "everyone" /e
echo y|cacls "%SystemRoot%" /r "everyone" /e
echo y|cacls "%SystemRoot%/Registration" /r "everyone" /e
echo y|cacls "%SystemDrive%/Documents and Settings" /r "everyone" /e
echo y|cacls "%SystemDrive%" /r "users" /e
echo y|cacls "%SystemDrive%/Program Files" /r "users" /e
echo y|cacls "%SystemDrive%/Documents and Settings" /r "users" /e
echo y|cacls "%SystemRoot%" /r "users" /e
echo y|cacls "%SystemRoot%/addins" /r "users" /e
echo y|cacls "%SystemRoot%/AppPatch" /r "users" /e
echo y|cacls "%SystemRoot%/Connection Wizard" /r "users" /e
echo y|cacls "%SystemRoot%/Debug" /r "users" /e
echo y|cacls "%SystemRoot%/Driver Cache" /r "users" /e
echo y|cacls "%SystemRoot%/Help" /r "users" /e
echo y|cacls "%SystemRoot%/IIS Temporary Compressed Files" /r "users" /e
echo y|cacls "%SystemRoot%/java" /r "users" /e
echo y|cacls "%SystemRoot%/msagent" /r "users" /e
echo y|cacls "%SystemRoot%/mui" /r "users" /e
echo y|cacls "%SystemRoot%/repair" /r "users" /e
echo y|cacls "%SystemRoot%/Resources" /r "users" /e
echo y|cacls "%SystemRoot%/security" /r "users" /e
echo y|cacls "%SystemRoot%/system" /r "users" /e
echo y|cacls "%SystemRoot%/TAPI" /r "users" /e
echo y|cacls "%SystemRoot%/Temp" /r "users" /e
echo y|cacls "%SystemRoot%/twain_32" /r "users" /e
echo y|cacls "%SystemRoot%/Web" /r "users" /e
echo y|cacls "%SystemRoot%/WinSxS" /r "users" /e
echo y|cacls "%SystemRoot%/system32/3com_dmi" /r "users" /e
echo y|cacls "%SystemRoot%/system32/administration" /r "users" /e
echo y|cacls "%SystemRoot%/system32/Cache" /r "users" /e
echo y|cacls "%SystemRoot%/system32/CatRoot2" /r "users" /e
echo y|cacls "%SystemRoot%/system32/Com" /r "users" /e
echo y|cacls "%SystemRoot%/system32/config" /r "users" /e
echo y|cacls "%SystemRoot%/system32/dhcp" /r "users" /e
echo y|cacls "%SystemRoot%/system32/drivers" /r "users" /e
echo y|cacls "%SystemRoot%/system32/export" /r "users" /e
echo y|cacls "%SystemRoot%/system32/icsxml" /r "users" /e
echo y|cacls "%SystemRoot%/system32/lls" /r "users" /e
echo y|cacls "%SystemRoot%/system32/LogFiles" /r "users" /e
echo y|cacls "%SystemRoot%/system32/MicrosoftPassport" /r "users" /e
echo y|cacls "%SystemRoot%/system32/mui" /r "users" /e
echo y|cacls "%SystemRoot%/system32/oobe" /r "users" /e
echo y|cacls "%SystemRoot%/system32/ShellExt" /r "users" /e
echo y|cacls "%SystemRoot%/system32/wbem" /r "users" /e
echo y|cacls "%SystemRoot%/system32/inetsrv/iisadmpwd/" /r "Everyone" /e
echo y|cacls "%SystemRoot%/system32/inetsrv/MetaBack/" /r "Everyone" /e
echo y|cacls "%SystemRoot%/system32/inetsrv/ASP Compiled Templates/" /g Everyone:f /e
echo "添加users的访问权限"
echo y|cacls "%SystemRoot%" /g users:r /e
echo y|cacls "%SystemDrive%/Program Files/Common Files" /g users:r /e
echo y|cacls "%SystemRoot%/Downloaded Program Files" /g users:c /e
echo y|cacls "%SystemRoot%/Help" /g users:c /e
echo y|cacls "%SystemRoot%/IIS Temporary Compressed Files" /g users:c /e
echo y|cacls "%SystemRoot%/Offline Web Pages" /g users:c /e
echo y|cacls "%SystemRoot%/System32" /g users:c /e
echo y|cacls "%SystemRoot%/Tasks" /g users:c /e
echo y|cacls "%SystemRoot%/Temp" /g users:c /e
echo y|cacls "%SystemRoot%/Web" /g users:c /e
echo "添加users的访问权限[.net专用]"
echo y|cacls "%SystemRoot%/Assembly" /g users:c /e
echo y|cacls "%SystemRoot%/Microsoft.NET" /g users:c /e
echo y|cacls "%SystemRoot%/Microsoft.NET/Framework/v2.0.50727/Temporary ASP.NET Files" /g users:c /e
echo y|cacls "%SystemRoot%/Microsoft.NET/Framework/v1.1.4322/Temporary ASP.NET Files " /g users:c /e
echo y|cacls c:\windows\assembly /e /t /p "network service":r
echo y|cacls c:\windows\Microsoft.NET /e /t /p "network service":r
echo y|cacls "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files" /e /t /p "network service":c
echo y|cacls "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files" /e /t /p "network service":c
echo y|cacls C:\WINDOWS\system32\mscoree.dll /e /g everyone:r
echo y|cacls C:\WINDOWS\system32\ws03res.dll /e /g everyone:r
rem echo y|cacls 客户站点目录 /e /t /p "network service":f 如果有需要可以取用
echo "添加users的访问权限[装了MACFEE的软件专用]"
echo y|cacls "%SystemDrive%/Program Files/Network Associates" /g users:r /e
echo "添加users的访问权限[装了WEBMAIL的专用]"
echo "E:\为安装webmail的根目录盘符!,根据实际情况修改后并且去掉下面两行的rem"
rem echo y|cacls E:\ /g users:r /e
rem echo y|cacls E:\WinWebMail /t /p users:f /e
echo.
echo ..........
echo.
echo ==============================================================
rem 其他相关的一些设置
echo ==============================================================
echo 禁止保留文档记录
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /V NORECENTDOCSHISTORY /T REG_DWORD /D 1 /F
rem 禁止重启后自动共享
echo =======================================================
echo.
echo .................
echo.
echo .. delshare.reg .......
echo Windows Registry Editor Version 5.00> c:\delshare.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]>> c:\delshare.reg
echo "AutoShareWks"=dword:00000000>> c:\delshare.reg
echo "AutoShareServer"=dword:00000000>> c:\delshare.reg
echo .. delshare.reg .....
regedit /s c:\delshare.reg
echo .. delshare.reg ....
del c:\delshare.reg
echo .
echo ........
echo .
echo =========================================================
rem 禁止httperr日志生成
echo =========================================================
echo .
echo .....................httplog.......................
echo .
echo .........
echo Windows Registry Editor Version 5.00> c:\httplog.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters]>> c:\httplog.reg
echo "EnableErrorLogging"=dword:00000000>> c:\httplog.reg
echo .
echo .. httplog.reg .....
regedit /s c:\httplog.reg
echo .. httplog.reg ....
del c:\httplog.reg
echo =========================================================
rem 设置cmd等的dos程序权限
echo =========================================================
echo .
echo .....................dos....
echo .
echo .........
echo Windows Registry Editor Version 5.00> c:\dosforwin.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]>> c:\dosforwin.reg
echo "EnableICMPRedirect"=dword:00000000>> c:\dosforwin.reg
echo "DeadGWDetectDefault"=dword:00000001>> c:\dosforwin.reg
echo "DontAddDefaultGatewayDefault"=dword:00000000>> c:\dosforwin.reg
echo "EnableSecurityFilters"=dword:00000000">> c:\dosforwin.reg
echo "AllowUnqualifiedQuery"=dword:00000000>> c:\dosforwin.reg
echo "PrioritizeRecordData"=dword:00000001>> c:\dosforwin.reg
echo      "ReservedPorts"=hex(7):31,00,34,00,33,00,33,00,2d,00,31,00,34,00,33,00,34,00,\>> c:\dosforwin.reg
echo 00,00,00,00>> c:\dosforwin.reg
echo "SynAttackProtect"=dword:00000002>> c:\dosforwin.reg
echo "TcpMaxPortsExhausted "=dword:00000001>> c:\dosforwin.reg
echo "TcpMaxHalfOpen "=dword:00000500>> c:\dosforwin.reg
echo "TcpManHalfOpenRetried "=dword:00000400>> c:\dosforwin.reg
echo "TcpMaxConnectResponseRetransmissions "=dword:00000002>> c:\dosforwin.reg
echo "TcpMaxDataRetransmissions "=dword:00000002>> c:\dosforwin.reg
echo "EnablePMTUDiscovery"=dword:00000000>> c:\dosforwin.reg
echo "KeepAliveTime"=dword:00300000>> c:\dosforwin.reg
echo "NoNameReleaseOnDemand"=dword:00000001>> c:\dosforwin.reg
echo "EnableDeadGWDetect"=dword:00000000>> c:\dosforwin.reg
echo "PerformRouterDiscovery"=dword:00000000>> c:\dosforwin.reg
echo "EnableICMPRedirects"=dword:00000000>> c:\dosforwin.reg
echo .
echo .. dosforwin.reg .....
regedit /s c:\dosforwin.reg
echo .. dosforwin.reg ....
del c:\dosforwin.reg
echo ==========================================================
rem 禁用telnet
echo ==============================================================
echo .
echo ..........(......................).
echo .
echo ..telnet,......telnet.
echo ..........
echo Windows Registry Editor Version 5.00> c:\telnet.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr]>> c:\telnet.reg
echo "Start"=dword:00000004>> c:\telnet.reg
echo .
echo .. telnet.reg .....
regedit /s c:\telnet.reg
echo .
echo .. telnet.reg ....
del c:\telnet.reg
echo .
echo ===============================================================
rem 禁止远程修改注册表服务
echo ===============================================================
echo ..Remote Registry Service...........
echo .........
echo .
echo Windows Registry Editor Version 5.00> c:\regedit.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry]>> c:\regedit.reg
echo "Start"=dword:00000004>> c:\regedit.reg
echo .
echo .. regedit.reg .....
regedit /s c:\regedit.reg
echo .
echo ......
del c:\regedit.reg
echo ===============================================================
rem 禁用Messager信息服务
echo ===============================================================
echo ..Messenger.......
echo .........
echo Windows Registry Editor Version 5.00> c:\message.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]>> c:\message.reg
echo "Start"=dword:00000004>> c:\message.reg
echo .
echo .. message.reg .....
regedit /s c:\message.reg
echo .
echo .. message.reg
del c:\message.reg
echo ===============================================================
rem 禁用workstation服务
echo ===============================================================
echo ..lanmanworkstation.......
echo .........
echo Windows Registry Editor Version 5.00> c:\lanmanworkstation.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]>> c:\lanmanworkstation.reg
echo "Start"=dword:00000004>> c:\lanmanworkstation.reg
echo .
echo .. lanmanworkstation.reg .....
regedit /s c:\lanmanworkstation.reg
echo .
echo .. lanmanworkstation.reg
del c:\lanmanworkstation.reg
echo ===============================================================
rem 禁用server服务
echo ===============================================================
echo ..lanmanserver.......
echo .........
echo Windows Registry Editor Version 5.00> c:\lanmanserver.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]>> c:\lanmanserver.reg
echo "Start"=dword:00000004>> c:\lanmanserver.reg
echo .
echo .. lanmanserver.reg .....
regedit /s c:\lanmanserver.reg
echo .
echo .. lanmanserver.reg
del c:\lanmanserver.reg
echo ===============================================================
rem 禁用alerter服务
echo ===============================================================
echo ..Alerter.......
echo .........
echo Windows Registry Editor Version 5.00> c:\Alerter.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]>> c:\Alerter.reg
echo "Start"=dword:00000004>> c:\Alerter.reg
echo .
echo .. Alerter.reg .....
regedit /s c:\Alerter.reg
echo .
echo .. Alerter.reg
del c:\Alerter.reg
echo ===============================================================
rem 禁用Browser服务
echo ===============================================================
echo ..Browser.......
echo .........
echo Windows Registry Editor Version 5.00> c:\Browser.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser]>> c:\Browser.reg
echo "Start"=dword:00000004>> c:\Browser.reg
echo .
echo .. Browser.reg .....
regedit /s c:\Browser.reg
echo .
echo .. Browser.reg
del c:\Browser.reg
echo ===============================================================
rem 禁用Dfs服务【将分散的文件共享合并成一个逻辑名称空间并在局域网或广域网上管理这些逻辑卷】
echo ===============================================================
echo ..Dfs.......
echo .........
echo Windows Registry Editor Version 5.00> c:\Dfs.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs]>> c:\Dfs.reg
echo "Start"=dword:00000004>> c:\Dfs.reg
echo .
echo .. Dfs.reg .....
regedit /s c:\Dfs.reg
echo .
echo .. Dfs.reg
del c:\Dfs.reg
echo ===============================================================
rem 禁用打印机服务
echo ===============================================================
echo ..Spooler.......
echo .........
echo Windows Registry Editor Version 5.00> c:\Spooler.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler]>> c:\Spooler.reg
echo "Start"=dword:00000004>> c:\Spooler.reg
echo .
echo .. Spooler.reg .....
regedit /s c:\Spooler.reg
echo .
echo .. Spooler.reg
del c:\Spooler.reg
echo ===============================================================
rem 禁用NetBIOS服务
echo ==============================================================
echo ...TCP/IP NetBIOS Helper Service
echo .........
echo Windows Registry Editor Version 5.00> c:\netbios.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts]>> c:\netbios.reg
echo "Start"=dword:00000004>> c:\netbios.reg
echo .
echo .. netbios.reg .....
regedit /s c:\netbios.reg
echo .
echo .. netbios.reg
del c:\netbios.reg
echo ===============================================================
rem 禁用Help and Support服务
echo ===============================================================
echo ..hrlpsvc.......
echo .........
echo Windows Registry Editor Version 5.00> c:\hrlpsvc.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hrlpsvc]>> c:\hrlpsvc.reg
echo "Start"=dword:00000004>> c:\hrlpsvc.reg
echo .
echo .. hrlpsvc.reg .....
regedit /s c:\hrlpsvc.reg
echo .
echo .. hrlpsvc.reg
del c:\hrlpsvc.reg
echo ===============================================================
echo ===========================END=================================