远程桌面端口

很多朋友不知道怎样在cmd下查看3389被 修改成了什麽。有时候注册表读其来不是太方便。、

REG query HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server\WinStations\RDP-Tcp /v PortNumber 这条命令是查看远程桌面连接所开的端口是多少 一般默认显示是0xd3d   也就是3389 。

其实两个 常见的cmd命令就可以搞定下来·

先用
tasklist /svc
C:\>tasklist /svc
图像名                       PID 服务
========================= ====== =============================================
System Idle Process            0 暂缺
System                         4 暂缺
smss.exe                     704 暂缺
csrss.exe                    772 暂缺
winlogon.exe                 796 暂缺
services.exe                 840 Eventlog, PlugPlay
lsass.exe                    852 PolicyAgent, ProtectedStorage, SamSs
svchost.exe                 1028 DcomLaunch, TermService                              、//这里TermService就是对应的3389服务，记下进程的PID：1028
svchost.exe                 1092 RpcSs
svchost.exe                 1180 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 EventSystem, FastUserSwitchingCompatibility,
                                 LanmanServer, lanmanworkstation, Netman,
                                 Nla, RasMan, seclogon, SENS, SharedAccess,
                                 ShellHWDetection, TapiSrv, Themes, TrkWks,
                                 W32Time, winmgmt, wscsvc, wuauserv, WZCSVC
svchost.exe                 1260 Dnscache
svchost.exe                 1336 LmHosts, SSDPSRV, WebClient
spoolsv.exe                 1416 Spooler
Explorer.EXE                1788 暂缺
vsnpstd3.exe                1948 暂缺
egui.exe                    1968 暂缺
ctfmon.exe                  2044 暂缺
ekrn.exe                     484 ekrn
svchost.exe                  604 stisvc
wdfmgr.exe                   620 UMWdf
alg.exe                      324 ALG
iexplore.exe                2552 暂缺
cmd.exe                     2236 暂缺
conime.exe                   124 暂缺
wmiprvse.exe                 292 暂缺
mstsc.exe                   3580 暂缺
tasklist.exe                 188 暂缺
====================================================================================================
然后使用netstat命令查看对应的端口号：
C:\>netstat /ano
Active Connections
Proto Local Address          Foreign Address        State           PID
TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1092
TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
TCP    0.0.0.0:5389           0.0.0.0:0              LISTENING       1028      //这里的对应的上面的进程PID号1028，即是远程桌面对应的端口5389.
TCP    60.xxx.xxx.xxx:1349     220.xxx.xxx.xxx:8081     TIME_WAIT       0
TCP    60..xxx.xxx.xxx::1360     121.xxx.xxx.xxx:8449       TIME_WAIT       0
TCP    60..xxx.xxx.xxx::1525     121.xxx.xxx.xxx:80       TIME_WAIT       0
TCP    127.0.0.1:1030         0.0.0.0:0              LISTENING       324
TCP    127.0.0.1:1522         127.0.0.1:30606        TIME_WAIT       0
TCP    127.0.0.1:30606        0.0.0.0:0              LISTENING       484
TCP    127.0.0.1:30606        127.0.0.1:1520         TIME_WAIT       0
TCP    192.168.1.12:139       0.0.0.0:0              LISTENING       4
UDP    0.0.0.0:445            *:*                                    4
UDP    0.0.0.0:500            *:*                                    852
UDP    0.0.0.0:4500           *:*                                    852
UDP    60.xxx.xxx.xxx::123      *:*                                    1180
UDP    60.xxx.xxx.xxx::1900     *:*                                    1336
UDP    127.0.0.1:123          *:*                                    1180
UDP    127.0.0.1:1047         *:*                                    2552
UDP    127.0.0.1:1900         *:*                                    1336
UDP    192.168.1.12:123       *:*                                    1180
UDP    192.168.1.12:137       *:*                                    4
UDP    192.168.1.12:138       *:*                                    4
UDP    192.168.1.12:1900      *:*                                    1336
C:\>