HKEY_CLASSES_ROOT  (HKCR)  — 文件關(guān)聯(lián)和 COM 類信息
HKEY_CURRENT_USER  (HKCU)  — 當(dāng)前用戶配置
HKEY_LOCAL_MACHINE (HKLM)  — 本機(jī)系統(tǒng)配置（最常用）
HKEY_USERS         (HKU)   — 所有用戶配置
HKEY_CURRENT_CONFIG(HKCC)  — 當(dāng)前硬件配置

import winreg

def read_registry(key_path, value_name, hive=winreg.HKEY_LOCAL_MACHINE):
    """
    讀取注冊表值
    key_path: 例如 r"SOFTWARE\Microsoft\Windows\CurrentVersion"
    value_name: 值的名稱，如 "ProgramFilesDir"
    """
    try:
        key = winreg.OpenKey(hive, key_path)
        value, value_type = winreg.QueryValueEx(key, value_name)
        winreg.CloseKey(key)
        return value, value_type
    except FileNotFoundError:
        print(f"鍵或值不存在: {key_path}\\{value_name}")
        return None, None
    except Exception as e:
        print(f"讀取失敗: {e}")
        return None, None

# 示例：讀取 Windows 安裝路徑
path, vtype = read_registry(
    r"SOFTWARE\Microsoft\Windows\CurrentVersion",
    "ProgramFilesDir"
)
print(f"安裝路徑: {path}, 類型: {vtype}")
# 輸出: 安裝路徑: C:\Program Files, 類型: 1 (REG_SZ)

def write_registry(key_path, value_name, value, hive=winreg.HKEY_LOCAL_MACHINE):
    """
    寫入注冊表值（自動(dòng)判斷類型）
    """
    # 類型映射
    type_map = {
        str: winreg.REG_SZ,
        int: winreg.REG_DWORD,
        bytes: winreg.REG_BINARY,
        list: winreg.REG_MULTI_SZ,
    }

    reg_type = type_map.get(type(value), winreg.REG_SZ)

    try:
        # 打開鍵（不存在則創(chuàng)建）
        key = winreg.CreateKeyEx(hive, key_path, 0, winreg.KEY_WRITE)
        winreg.SetValueEx(key, value_name, 0, reg_type, value)
        winreg.CloseKey(key)
        return True
    except PermissionError:
        print("權(quán)限不足，請以管理員身份運(yùn)行！")
        return False
    except Exception as e:
        print(f"寫入失敗: {e}")
        return False

# 示例：修改代理設(shè)置
write_registry(
    r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
    "ProxyEnable",
    1  # 啟用代理
)
write_registry(
    r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
    "ProxyServer",
    "proxy.company.com:8080"
)

def enumerate_registry(key_path, hive=winreg.HKEY_LOCAL_MACHINE):
    """列舉某個(gè)鍵下的所有子鍵和值"""
    key = winreg.OpenKey(hive, key_path)

    print(f"=== {key_path} 的子鍵 ===")
    idx = 0
    while True:
        try:
            subkey_name = winreg.EnumKey(key, idx)
            print(f"  [{subkey_name}]")
            idx += 1
        except OSError:
            break

    print(f"\n=== {key_path} 的值 ===")
    idx = 0
    while True:
        try:
            name, value, vtype = winreg.EnumValue(key, idx)
            type_names = {
                winreg.REG_SZ: "REG_SZ",
                winreg.REG_DWORD: "REG_DWORD",
                winreg.REG_BINARY: "REG_BINARY",
                winreg.REG_EXPAND_SZ: "REG_EXPAND_SZ",
                winreg.REG_MULTI_SZ: "REG_MULTI_SZ",
            }
            type_name = type_names.get(vtype, f"UNKNOWN({vtype})")
            # 二進(jìn)制數(shù)據(jù)截?cái)囡@示
            if isinstance(value, bytes):
                display = f"<{len(value)} bytes>"
            elif isinstance(value, list):
                display = ", ".join(str(v) for v in value[:3])
                if len(value) > 3:
                    display += f" ... ({len(value)} items)"
            else:
                display = str(value)
            print(f"  {name} = {display}  ({type_name})")
            idx += 1
        except OSError:
            break

    winreg.CloseKey(key)

# 示例：查看當(dāng)前運(yùn)行的服務(wù)
enumerate_registry(r"SYSTEM\CurrentControlSet\Services")

import subprocess
import datetime
from pathlib import Path

def export_registry(key_path, output_dir=None, hive="HKLM"):
    """
    導(dǎo)出注冊表分支到 .reg 文件
    使用 Windows 自帶的 reg.exe 命令
    """
    if output_dir is None:
        output_dir = Path("registry_backups")
    output_dir.mkdir(exist_ok=True)

    timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
    safe_name = key_path.replace("\\", "_").replace(" ", "")
    filename = output_dir / f"{hive}_{safe_name}_{timestamp}.reg"

    cmd = f'reg export "{hive}\\{key_path}" "{filename}" /y'

    result = subprocess.run(
        cmd, shell=True, capture_output=True, text=True
    )

    if result.returncode == 0:
        print(f"備份成功: {filename}")
        return str(filename)
    else:
        print(f"備份失敗: {result.stderr}")
        return None

# 示例：備份代理設(shè)置
export_registry(
    r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"
)

def import_registry(reg_file):
    """從 .reg 文件恢復(fù)注冊表"""
    cmd = f'reg import "{reg_file}"'
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

    if result.returncode == 0:
        print(f"恢復(fù)成功: {reg_file}")
        return True
    else:
        print(f"恢復(fù)失敗: {result.stderr}")
        return False

# 使用
import_registry("registry_backups/HKLM_SOFTWARE_Microsoft_...20260506.reg")

def backup_key_recursive(key_path, hive=winreg.HKEY_LOCAL_MACHINE):
    """
    遞歸備份注冊表鍵，返回嵌套字典結(jié)構(gòu)
    """
    try:
        key = winreg.OpenKey(hive, key_path)
    except FileNotFoundError:
        return None

    data = {"_values": {}, "_subkeys": {}}

    # 備份所有值
    idx = 0
    while True:
        try:
            name, value, vtype = winreg.EnumValue(key, idx)
            data["_values"][name] = {"value": value, "type": vtype}
            idx += 1
        except OSError:
            break

    # 遞歸備份子鍵
    idx = 0
    while True:
        try:
            subkey_name = winreg.EnumKey(key, idx)
            sub_path = f"{key_path}\\{subkey_name}"
            data["_subkeys"][subkey_name] = backup_key_recursive(sub_path, hive)
            idx += 1
        except OSError:
            break

    winreg.CloseKey(key)
    return data

# 導(dǎo)出為 JSON
import json

backup = backup_key_recursive(
    r"SOFTWARE\MyApp\Config"
)
with open("registry_backup.json", "w", encoding="utf-8") as f:
    json.dump(backup, f, ensure_ascii=False, indent=2, default=str)

import wmi
from concurrent.futures import ThreadPoolExecutor, as_completed

def remote_read_registry(
    computer, key_path, value_name,
    hive="HKEY_LOCAL_MACHINE",
    username=None, password=None
):
    """
    通過 WMI 遠(yuǎn)程讀取注冊表
    需要目標(biāo)電腦開啟 WMI 服務(wù)和遠(yuǎn)程管理
    """
    try:
        if username and password:
            # 帶憑據(jù)連接
            c = wmi.WMI(
                computer,
                user=f".\\{username}",
                password=password
            )
        else:
            # 當(dāng)前域憑據(jù)連接
            c = wmi.WMI(computer)

        # 使用 StdRegProv 類
        registry = c.StdRegProv

        # hive 映射
        hive_map = {
            "HKEY_CLASSES_ROOT": 0x80000000,
            "HKEY_CURRENT_USER": 0x80000001,
            "HKEY_LOCAL_MACHINE": 0x80000002,
            "HKEY_USERS": 0x80000003,
        }
        hive_id = hive_map.get(hive, 0x80000002)

        # 先獲取值的類型
        result, value_type = registry.GetStringValue(
            hDefKey=hive_id,
            sSubKeyName=key_path,
            sValueName=value_name
        )

        if result == 0:
            return {"computer": computer, "value": value, "status": "ok"}
        else:
            return {"computer": computer, "value": None, "status": "not_found"}

    except wmi.x_wmi as e:
        return {"computer": computer, "value": None, "status": f"WMI錯(cuò)誤: {e}"}
    except Exception as e:
        return {"computer": computer, "value": None, "status": f"錯(cuò)誤: {e}"}


def batch_read_registry(computers, key_path, value_name, max_workers=20):
    """并發(fā)批量讀取多臺電腦的注冊表"""
    results = []

    with ThreadPoolExecutor(max_workers=max_workers) as executor:
        futures = {
            executor.submit(
                remote_read_registry, pc, key_path, value_name
            ): pc
            for pc in computers
        }

        for future in as_completed(futures):
            result = future.result()
            results.append(result)
            status_icon = "?" if result["status"] == "ok" else "?"
            print(f"  {status_icon} {result['computer']}: {result['status']}")

    return results


# 示例：檢查 100 臺電腦的代理設(shè)置
computers = [f"PC-{i:03d}" for i in range(1, 101)]
results = batch_read_registry(
    computers,
    key_path=r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
    value_name="ProxyServer"
)

# 統(tǒng)計(jì)
success = sum(1 for r in results if r["status"] == "ok")
print(f"\n成功: {success}/{len(results)}")

import subprocess
import tempfile
from pathlib import Path

def remote_registry_via_psexec(
    computer, script_content,
    psexec_path=r"C:\Tools\PSTools\PsExec.exe",
    username=None, password=None
):
    """
    通過 PsExec 在遠(yuǎn)程電腦上執(zhí)行注冊表操作腳本
    """
    # 生成臨時(shí) Python 腳本
    with tempfile.NamedTemporaryFile(
        mode="w", suffix=".py", delete=False, encoding="utf-8"
    ) as f:
        f.write(script_content)
        temp_script = f.name

    try:
        cmd = [
            psexec_path,
            f"\\\\{computer}",
            "-s",  # 以 SYSTEM 賬戶運(yùn)行
            "-nobanner",
        ]

        if username and password:
            cmd.extend(["-u", username, "-p", password])

        cmd.extend([
            "python",
            temp_script
        ])

        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=120
        )

        return {
            "computer": computer,
            "stdout": result.stdout,
            "stderr": result.stderr,
            "returncode": result.returncode,
        }
    finally:
        Path(temp_script).unlink(missing_ok=True)

def disable_usb_storage(enable=True):
    """
    禁用或啟用 USB 大容量存儲設(shè)備
    enable=False 禁用, enable=True 啟用
    """
    value = 4 if not enable else 3  # 4=禁用, 3=啟用

    # 方法1：通過注冊表
    write_registry(
        r"SYSTEM\CurrentControlSet\Services\USBSTOR",
        "Start",
        value
    )

    # 方法2：額外阻止安裝新 USB 設(shè)備
    write_registry(
        r"SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices",
        "Deny_All",
        1 if not enable else 0
    )

    print(f"USB 存儲 {'已啟用' if enable else '已禁用'}")

def change_rdp_port(new_port=33890):
    """修改遠(yuǎn)程桌面端口（默認(rèn) 3389）"""
    if not (1024 <= new_port <= 65535):
        print("端口范圍必須在 1024-65535 之間")
        return False

    # 1. 修改注冊表中的端口
    success = write_registry(
        r"SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp",
        "PortNumber",
        new_port
    )

    if success:
        # 2. 添加防火墻規(guī)則
        firewall_cmd = (
            f'netsh advfirewall firewall add rule '
            f'name="RDP {new_port}" dir=in action=allow '
            f'protocol=TCP localport={new_port}'
        )
        subprocess.run(firewall_cmd, shell=True, capture_output=True)

        print(f"RDP 端口已修改為 {new_port}")
        print("請重啟電腦使更改生效")
    return success

def cleanup_uninstall_entries():
    """
    掃描并報(bào)告注冊表中的無效卸載條目
    （程序已刪除但注冊表殘留的情況）
    """
    uninstall_key = r"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"
    key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, uninstall_key)

    orphaned = []
    idx = 0

    while True:
        try:
            subkey_name = winreg.EnumKey(key, idx)

            subkey = winreg.OpenKey(key, subkey_name)
            try:
                display_name, _ = winreg.QueryValueEx(subkey, "DisplayName")
                install_location, _ = winreg.QueryValueEx(
                    subkey, "InstallLocation"
                )

                # 檢查安裝路徑是否存在
                if install_location and not Path(install_location).exists():
                    orphaned.append({
                        "name": display_name,
                        "subkey": subkey_name,
                        "path": install_location,
                    })
            except FileNotFoundError:
                # 沒有 DisplayName 或 InstallLocation，跳過
                pass
            finally:
                winreg.CloseKey(subkey)

            idx += 1
        except OSError:
            break

    winreg.CloseKey(key)

    if orphaned:
        print(f"發(fā)現(xiàn) {len(orphaned)} 個(gè)無效卸載條目：")
        for item in orphaned:
            print(f"  - {item['name']}")
            print(f"    路徑: {item['path']} (不存在)")
            print(f"    鍵: {item['subkey']}")
    else:
        print("未發(fā)現(xiàn)無效卸載條目")

    return orphaned

def get_installed_software(hive=winreg.HKEY_LOCAL_MACHINE):
    """獲取已安裝軟件列表"""
    uninstall_paths = [
        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
        r"SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
    ]

    software = []

    for uninstall_path in uninstall_paths:
        try:
            key = winreg.OpenKey(hive, uninstall_path)
        except FileNotFoundError:
            continue

        idx = 0
        while True:
            try:
                subkey_name = winreg.EnumKey(key, idx)
                subkey = winreg.OpenKey(key, subkey_name)

                info = {}
                for field in ["DisplayName", "DisplayVersion",
                              "Publisher", "InstallDate", "UninstallString"]:
                    try:
                        val, _ = winreg.QueryValueEx(subkey, field)
                        info[field] = val
                    except FileNotFoundError:
                        pass

                if info.get("DisplayName"):
                    software.append(info)

                winreg.CloseKey(subkey)
                idx += 1
            except OSError:
                break

        winreg.CloseKey(key)

    # 去重 + 排序
    seen = set()
    unique = []
    for s in sorted(software, key=lambda x: x.get("DisplayName", "")):
        name = s.get("DisplayName", "")
        if name not in seen:
            seen.add(name)
            unique.append(s)

    return unique

# 使用
software = get_installed_software()
print(f"已安裝 {len(software)} 個(gè)軟件")
for s in software[:10]:
    print(f"  {s.get('DisplayName')} {s.get('DisplayVersion', '')}")

import ctypes
import sys

def require_admin():
    """檢查是否以管理員身份運(yùn)行"""
    if not ctypes.windll.shell32.IsUserAnAdmin():
        print("此操作需要管理員權(quán)限！")
        print("請右鍵選擇「以管理員身份運(yùn)行」")
        sys.exit(1)

require_admin()

# 訪問 32 位注冊表視圖
KEY_WOW64_64KEY = 0x0100
KEY_WOW64_32KEY = 0x0200

key = winreg.OpenKey(
    winreg.HKEY_LOCAL_MACHINE,
    r"SOFTWARE\MyApp",
    0,
    winreg.KEY_READ | KEY_WOW64_32KEY  # 強(qiáng)制 32 位視圖
)

def setup_new_computer():
    """新電腦初始化配置"""
    require_admin()

    print("=== 新電腦初始化配置 ===\n")

    # 1. 備份當(dāng)前配置
    print("[1/6] 備份當(dāng)前配置...")
    export_registry(r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings")
    export_registry(r"SYSTEM\CurrentControlSet\Services\USBSTOR")

    # 2. 配置代理
    print("[2/6] 配置代理服務(wù)器...")
    write_registry(
        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
        "ProxyEnable", 1
    )
    write_registry(
        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
        "ProxyServer", "proxy.company.com:8080"
    )

    # 3. 修改 RDP 端口
    print("[3/6] 修改遠(yuǎn)程桌面端口...")
    change_rdp_port(33990)

    # 4. 禁用 USB 存儲
    print("[4/6] 禁用 USB 存儲...")
    disable_usb_storage(enable=False)

    # 5. 配置 PowerShell 執(zhí)行策略
    print("[5/6] 配置 PowerShell 執(zhí)行策略...")
    subprocess.run(
        ["powershell", "-Command", "Set-ExecutionPolicy RemoteSigned -Scope MachinePolicy"],
        capture_output=True
    )

    # 6. 啟用 Windows 遠(yuǎn)程管理
    print("[6/6] 啟用 WinRM...")
    subprocess.run(
        ["powershell", "-Command", "Enable-PSRemoting -Force"],
        capture_output=True
    )

    print("\n=== 配置完成！請重啟電腦使所有更改生效 ===")

setup_new_computer()