Windows帳戶管理

windows帳戶管理

最近部署人員給咱們提了一個需求，就是但願簡化部署過程。
爲了可以遠程桌面控制終端電腦，他們須要爲每臺終端設置進行一些設置，例如建立用戶名和密碼，開啓容許
遠程桌面設置，以及開機免登陸的設置，這部分的操做加大了部署人員的工做量，因此他們提出是否可以提供
一個軟件，直接在終端設備上安裝一下，那麼這些設置就自動設置好了，並且還能支持後面平臺下發修改用戶名
和密碼的功能。因此有了這些功能的探索，註冊表修改部分，用到了註冊表比對工具現整理一下成果。
建立管理員帳戶

//傳入參數：Username要建立的用戶名，Userpassword用戶密碼，Path主文件夾路徑 
public static bool CreateNTUser(string username, string userpassword, string path)
{
    try
    {
        DirectoryEntry obDirEntry = new DirectoryEntry("WinNT://" + Environment.MachineName);

        DirectoryEntry obUser = obDirEntry.Children.Add(username, "User"); //增長用戶名 
        obUser.Properties["FullName"].Add(username); //用戶全稱 
        obUser.Invoke("SetPassword", userpassword); //用戶密碼 
        obUser.Invoke("Put", "Description", "遠程用戶");//用戶詳細描述 
        //obUser.Invoke("Put","PasswordExpired",1); //用戶下次登陸需更改密碼 
        obUser.Invoke("Put", "UserFlags", 66049); //密碼永不過時 
        obUser.Invoke("Put", "HomeDirectory", path); //主文件夾路徑 
        obUser.CommitChanges();//保存用戶 
        //DirectoryEntry grp = obDirEntry.Children.Find("Users", "group");//Users組 
        DirectoryEntry grp = obDirEntry.Children.Find("Administrators", "group");
        if (grp.Name != "")
        {
            grp.Invoke("Add", obUser.Path.ToString());//將用戶添加到某組 
        }
        return true;
    }
    catch(Exception ex)
    {
        RGCommon.Log(ex.Message);
        return false;
    }
}

刪除帳戶

//傳入參數：Username用戶名 
public static bool DelNTUser(string Username)
{
    try
    {
        DirectoryEntry localMachine = new DirectoryEntry("WinNT://" + Environment.MachineName + ",computer");
        DirectoryEntry obUser = localMachine.Children.Find(Username, "User");//找得用戶 
        localMachine.Children.Remove(obUser);//刪除用戶 
        localMachine.Close();
        return true;
    }
    catch(Exception ex)
    {
        RGCommon.Log(ex.Message);
        return false;
    }
}

重命名帳戶

/// <summary>
/// 重命名帳戶
/// </summary>
/// <param name="username"></param>
/// <param name="newname"></param>
/// <returns></returns>
public static bool Rename(string username, string newname)
{
    try
    {
        DirectoryEntry localMachine = new DirectoryEntry($"WinNT://{Environment.MachineName},computer");
        DirectoryEntry obUser = localMachine.Children.Find(username, "User");
        obUser.Rename(newname);//重命名
        obUser.CommitChanges();
        obUser.Close();
        localMachine.Close();
        return true;
    }
    catch (Exception ex)
    {
        RGCommon.Log(ex.Message);
        return false;
    }
}

修改用戶密碼

//修改NT用戶密碼 
//傳入參數：Username用戶名，Userpassword用戶新密碼 
public static bool InitNTPwd(string username, string userpassword)
{
    try
    {
        DirectoryEntry localMachine = new DirectoryEntry("WinNT://" + Environment.MachineName + ",computer");
        DirectoryEntry obUser = localMachine.Children.Find(username, "User");
        obUser.Invoke("SetPassword", userpassword);
        obUser.CommitChanges();
        obUser.Close();
        localMachine.Close();
        return true;
    }
    catch(Exception ex)
    {
        RGCommon.Log(ex.Message);
        return false;
    }
}

判斷用戶是否存在

/// <summary>
/// 判斷用戶是否存在
/// </summary>
/// <param name="userName"></param>
/// <returns></returns>
public static bool ExistWinUser(string userName)
{
    try
    {
        using(DirectoryEntry localMachine = new DirectoryEntry($"WinNT://{Environment.MachineName},computer"))
        {
            var user = localMachine.Children.Find(userName, "user");
            return user != null;
        }
    }
    catch(Exception ex)
    {
        RGCommon.Log(ex.Message);
    }
    return false;
}

啓用/禁用帳戶

/// <summary>
/// 啓用/禁用帳戶
/// </summary>
/// <param name="userName"></param>
/// <param name="isDisable"></param>
public static void Disable(string userName, bool isDisable)
{
    DirectoryEntry user = new DirectoryEntry($"WinNT://{Environment.MachineName}/{userName},user");
    user.InvokeSet("AccountDisabled", isDisable);
    user.CommitChanges();
    user.Close();
}

防火牆入站規則添加

/// <summary>
/// 添加入站規則
/// </summary>
/// <param name="name"></param>
/// <param name="port">要入站的端口號</param>
/// <param name="protocol"></param>
public static void NetFwAddPorts(string name, int port, string protocol)
{
    INetFwMgr netFwMgr = (INetFwMgr)Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FwMgr"));
    INetFwOpenPort objPort = (INetFwOpenPort)Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FwOpenPort"));
    objPort.Name = name;
    objPort.Port = port;
    if(protocol.ToUpper() == "TCP")
    {
        objPort.Protocol = NET_FW_IP_PROTOCOL_.NET_FW_IP_PROTOCOL_TCP;
    }
    else
    {
        objPort.Protocol = NET_FW_IP_PROTOCOL_.NET_FW_IP_PROTOCOL_UDP;
    }
    objPort.Scope = NET_FW_SCOPE_.NET_FW_SCOPE_ALL;
    objPort.Enabled = true;
    bool exist = false;
    //加入到防火牆管理策略
    foreach(INetFwOpenPort mPort in netFwMgr.LocalPolicy.CurrentProfile.GloballyOpenPorts)
    {
        if(objPort == mPort)
        {
            exist = true;
            break;
        }
    }
    if (!exist)
    {
        netFwMgr.LocalPolicy.CurrentProfile.GloballyOpenPorts.Add(objPort);
    }
}

開機免登陸設置

/// <summary>
/// 免登錄設置
/// </summary>
public static void AutoAdminLogon(string userName, string password)
{
    Microsoft.Win32.RegistryKey root = Microsoft.Win32.RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, Microsoft.Win32.RegistryView.Registry64);
    Microsoft.Win32.RegistryKey item = root.OpenSubKey(@"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\", true);
    if(item != null)
    {
        item.SetValue("AutoAdminLogon", "1");
        item.SetValue("DefaultUserName", userName);
        item.SetValue("DefaultPassword", password);
    }
}

容許遠程桌面設置

/// <summary>
/// 容許遠程桌面設置
/// </summary>
public static void AllowRemote()
{
    Microsoft.Win32.RegistryKey root = Microsoft.Win32.RegistryKey.OpenBaseKey(Microsoft.Win32.RegistryHive.LocalMachine, Microsoft.Win32.RegistryView.Registry64);
    Microsoft.Win32.RegistryKey item = root.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\Remote Assistance\", true);
    if(item != null)
    {
        item.SetValue("fAllowToGetHelp", "1");
    }
    item = root.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\Terminal Server\", true);
    if(item != null)
    {
        item.SetValue("fDenyTSConnections", 0, Microsoft.Win32.RegistryValueKind.DWord);
    }
    item = root.OpenSubKey(@"SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\", true);
    if(item != null)
    {
        item.SetValue("RemoteDesktop-In-TCP", "v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|LPort=3389|App=System|Name=@FirewallAPI.dll,-28753|Desc=@FirewallAPI.dll,-28756|EmbedCtxt=@FirewallAPI.dll,-28752|");
    }
}