命令行下，远程解锁WINDOWS 帐号的方法（原创）

纯命令行，在无法利用GUI工具时使用。

C:\>net use \9.181.162.31\ipc$ /user:te\teserver
密码在 \9.181.162.31\ipc$ 无效。

请键入 \9.181.162.31\ipc$ 的密码:
命令成功完成。

C:\>sc getkeyname telnet
[SC] GetServiceKeyName SUCCESS  Name = TlntSvr

C:\>sc \9.181.162.31 query TlntSvr

SERVICE_NAME: TlntSvr
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
                                (NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\>sc \9.181.162.31 query RemoteRegistry

SERVICE_NAME: RemoteRegistry
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\>reg query \9.181.162.31\HKLM\SOFTWARE\Microsoft\TelnetServer.0

! REG.EXE VERSION 2.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer.0
    AllowTrustedDomain  REG_DWORD       0x1
    DefaultDomain       REG_EXPAND_SZ   .
    DefaultShell        REG_EXPAND_SZ   %SystemRoot%\system32\cmd.exe /q /k
    LoginScript REG_EXPAND_SZ   %SystemRoot%\system32\login.cmd
    MaxConnections      REG_DWORD       0x3f
    MaxFailedLogins     REG_DWORD       0x3
    NTLM        REG_DWORD       0x2
    TelnetPort  REG_DWORD       0x17
    AltKeyMapping       REG_DWORD       0x1
    Termcap     REG_EXPAND_SZ   %SystemRoot%\system32\termcap

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer.0\Performance

C:\>reg add \9.181.162.31\HKLM\SOFTWARE\Microsoft\TelnetServer.0 /V NTLM /T REG_DWORD /D 0 /F

The operation completed suclearcase/" target="_blank" >ccessfully

C:\>sc \9.181.162.31 start TlntSvr

SERVICE_NAME: TlntSvr
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (STOPPABLE,PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\>telnet 9.181.162.31

Microsoft (R) Windows (TM) Version 5.00 (Build 2195)
Welcome to Microsoft Telnet Service
Telnet Server Build 5.00.99206.1
login: te\teserver
password:*********

C:\>net user rdu4 /active:yes
The command completed successfully.

C:\>exit

遗失对主机的连接。
C:\>reg add \9.181.162.31\HKLM\SOFTWARE\Microsoft\TelnetServer.0 /V NTLM /T REG_DWORD /D 2 /F

The operation completed successfully

C:\>sc \9.181.162.31 stop TlntSvr

SERVICE_NAME: TlntSvr
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (STOPPABLE,PAUSABLE,IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\>

原文转自：http://www.ltesting.net