Windows Server 2003 server maintenance

The Windows Server 2003 server hosted in the telecommunications room was in the program test phase. Many people in the administrator account knew that the suspicious program network monitoring software was found, but it was not determined whether the hacker was invaded or installed by other administrators. Sunday, March 31, 2013 Log in again using the administrator administrator. The prompt is as follows. Log in using the administrator account created yesterday, indicating that the password is incorrect. Therefore, it is concluded that the server has been hacked into www.dnzg.cn. Now the remote desktop of the server is still enabled, that is, you cannot log in using the remote desktop. Fortunately, the password of the administrator has not changed. How to determine that the password has not changed? I use Windows Server 2003 to access the shared resources of the server, then I need to enter the administrator account and password to access the server. Enter the account number and password, select Remember my password, enter the server's administrator account and password, can open the server's shared folder, so it is determined that the password of the administrator user has not been changed after the hacker. When you use the management tool to remotely manage the server, you do not need to enter an account and password. On the local computer, open the Computer Management tool and connect to another computer to enter the IP address of the compromised server. You can see that you can successfully connect to the past, but local users and groups cannot be remotely managed and can manage the services of remote servers. Www.dnzg.cn The following operation enables the server's telnet service, use the telnet service to re-create a new administrator on the server telnet remote server input y input server administrator's account and password using telnet remote login to the server, use the command to create The user wang password is wang added to the administrator group, and the administrator group name of the remote server has been changed to another name other than administrators. Now you need to determine the name of the remote server administrator group. The registry allows you to view the names of users and groups on your computer. How to open the registry of the remote server? , you need to enable the remote register service. Open the registry management tool locally. The default is to open the local registry, click on the link network registry to enter the server's IP address. Can open the registry of the remote computer, as shown in the figure, but can not open the SAM registry sub-key, you need to change the permissions. Set the administrators group to full control. Press F5 to refresh. You can expand the SAM as shown in the following figure. The administrator group has been changed to administrators to determine the name of the administrator group. Use telnet to log in to the server and add the created users to the administrator group. . Now connect to the server remotely using the newly created administrator. Logging in successfully to open the computer management tool You can see that there is no user management to install 360 anti-virus software, install 360 security guards to scan, found stubborn viruses and problems that need to be fixed.