Get-NetAdapter -Physical | Format-Table Name,InterfaceDescription,ifIndex,Status,LinkSpeed




# 自动找到你的有线网卡
$if = Get-NetAdapter -InterfaceDescription "*ASIX*" | Select-Object -First 1
if (-not $if) { $if = Get-NetAdapter -Physical | Where-Object { $_.Status -eq 'Up' } | Select-Object -First 1 }

# 配置静态 IP / 网关 / DNS（需管理员权限）
New-NetIPAddress -InterfaceIndex $if.ifIndex -IPAddress 202.120.3.46 -PrefixLength 27 -DefaultGateway 202.120.3.33
Set-DnsClientServerAddress -InterfaceIndex $if.ifIndex -ServerAddresses 202.120.2.100,202.120.2.101


### 开启远程桌面

```powershell
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
```

---

### 开启网络级别认证（NLA）

```powershell
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f
```

---

### 创建远程运维账号

```powershell
net user ops_admin "Jc#2026_Ops@Remote!7" /add

net localgroup Administrators ops_admin /add

net localgroup "Remote Desktop Users" ops_admin /add
```

---

### 禁用默认 Administrator

```powershell
net user Administrator /active:no
```

---

### 查看网卡名称

```powershell
Get-NetAdapter
```

---

### 配置静态IP

```powershell
New-NetIPAddress `
-InterfaceAlias "Ethernet" `
-IPAddress 192.168.10.20 `
-PrefixLength 24 `
-DefaultGateway 192.168.10.1

Set-DnsClientServerAddress `
-InterfaceAlias "Ethernet" `
-ServerAddresses 223.5.5.5,119.29.29.29
```

---

### 只允许特定IP访问3389

先查看规则：

```powershell
Get-NetFirewallRule -DisplayGroup "Remote Desktop"
```

配置允许来源：

```powershell
Get-NetFirewallRule -DisplayGroup "Remote Desktop" |
Set-NetFirewallRule -RemoteAddress 192.168.10.5
```

如果报错：

```powershell
Get-NetFirewallRule -DisplayGroup "Remote Desktop" |
Get-NetFirewallAddressFilter |
Set-NetFirewallAddressFilter -RemoteAddress 192.168.10.5
```

---

### 查看3389监听

```powershell
Get-NetTCPConnection -LocalPort 3389
```

或者：

```cmd
netstat -ano | findstr 3389
```

---

### 开启登录审计

```powershell
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
```

---

### 查看登录失败记录

```powershell
Get-WinEvent -FilterHashtable @{
LogName='Security'
ID=4625
} -MaxEvents 20
```

---

### 查看登录成功记录

```powershell
Get-WinEvent -FilterHashtable @{
LogName='Security'
ID=4624
} -MaxEvents 20
```

---

### 验证RDP配置

```powershell
qwinsta

Get-Service TermService

Test-NetConnection localhost -Port 3389
```

---

### 客户端连接

```cmd
mstsc /v:192.168.10.20
```

或

```cmd
mstsc /v:hostname
```

---

### 一键检查状态

```powershell
Get-Service TermService
Get-NetTCPConnection -LocalPort 3389
Get-NetFirewallRule -DisplayGroup "Remote Desktop"
quser
hostname
ipconfig
```

这套是 Win11 Pro 新装机最小安全远程接入配置。公网访问的话不要映射 3389，直接装 Tailscale 后用其虚拟 IP 连接。






Test-NetConnection localhost -Port 3389

netstat -ano | findstr 3389