@echo off
pushd "%__AppDir__%"
title <nul & title ..\%~nx0
setlocal EnableDelayedExpansion
set "_Reg_Key=HKCU\Control Panel\Desktop"
:loop
for /f skip^=2tokens^=2* %%i in (
';2^>^&1 reg.exe query "!_Reg_Key!" /v SCRNSAVE.EXE
')do if /i "%%~xj" == ".scr" (set "_scr_svr=%%~nxj") else (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Disable " - - - - -!"
rem./ With ScreenSaver is disabled no status is need && goto:next
)
for /f skip^=2tokens^=2* %%i in (
';2^>nul reg query "!_Reg_Key!" /v ScreenSaveActive')do if %%j equ 1 (
2>nul tasklist.exe/svc /fo list|find.exe/i "!_scr_svr!">nul && (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Running "!_scr_svr!"
) || (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Enabled "!_scr_svr!"
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Stopped "!_scr_svr!")
)
:next
2>nul tasklist.exe/svc /fo list|find.exe/i "LogonUI.exe" >nul && (
echo/[ !date! ^| !time:~0,8! ] Work Station: Locked "!ComputerName!"
) || echo/[ !date! ^| !time:~0,8! ] Work Station: Logged "!ComputerName!"
<con: set "_scr_svr=" & >nul timeout/t 10 /nobreak & goto :Loop
1.使用a查看当前是否启用Reg Query
了屏保
for /f skip^=2tokens^=2* %%i in (
';2^>nul reg query "!_Reg_Key!" /v ScreenSaveActive')do if %%j equ 1 (
2.如果当前启用了屏保,使用附加Reg Query
获取并保存The_Name + .Extension
3.避免在不区分大小写和匹配时| find ".scr"
使用部分字符串find /i "The_Full_File_Name.scr"
some_name.scr ≠≠ Some_Name.SCR
some_name.scr == Some_Name.SCR
Obs.1在使用名称中存在任何字符串且还包含字符串(仅小写)tasklist
的任务列表时,无论屏幕保护程序是否正在运行,这也将被列出。|find ".scr"
.str
Obs.2如果 screen_saver_long_name.scr 名称中的字符长度(包括扩展名)大于 25,使用tasklist | find ".src"
,您将永远不会过滤/找到该文件,因为tasklist
(没有任何/flag
)在输出中只有 26 个字符长度( , 结尾。)
Obs.:3对于Security Screensaver NG.scr
正在运行某些屏幕保护程序名称的列表进程,请使用tasklist /svc /fo list
4.使用循环,对循环过程中随时可能发生的任何变化保持监控可感知,不断查询注册表值。
可能的状态和输出:
[ Sun 12/27/2020 | 23:26:17 ] Screen Saver: Enabled "Fliqlo.scr"
[ Sun 12/27/2020 | 23:26:17 ] Screen Saver: Stopped "Fliqlo.scr"
[ Sun 12/27/2020 | 23:26:17 ] Work Station: Logged "LAME_SLUG"
[ Sun 12/27/2020 | 27:09:07 ] Screen Saver: Enabled "Fliqlo.scr"
[ Sun 12/27/2020 | 27:09:07 ] Screen Saver: Running "Fliqlo.scr"
[ Sun 12/27/2020 | 27:09:07 ] Work Station: Locked "LAME_SLUG"
[ Sun 12/27/2020 | 25:26:21 ] Screen Saver: Enabled "Fliqlo.scr"
[ Sun 12/27/2020 | 25:26:21 ] Screen Saver: Running "Fliqlo.scr"
[ Sun 12/27/2020 | 25:26:21 ] Work Station: Logged "LAME_SLUG"
[ Sun 12/27/2020 | 25:15:28 ] Screen Saver: Enabled "Fliqlo.scr"
[ Sun 12/27/2020 | 25:15:28 ] Screen Saver: Stopped "Fliqlo.scr"
[ Sun 12/27/2020 | 25:15:28 ] Work Station: locked "LAME_SLUG"
- 屏幕保护程序已禁用
not running
,但用户已登录:
[ Sun 12/27/2020 | 22:51:46 ] Screen Saver: Disable " - - - - -"
[ Sun 12/27/2020 | 22:51:46 ] Work Station: Logged "LAME_SLUG"
- 屏幕保护程序已禁用
not running
,但工作站已锁定:
[ Sun 12/27/2020 | 22:44:11 ] Screen Saver: Disable " - - - - -"
[ Sun 12/27/2020 | 22:44:11 ] Work Station: Locked "LAME_SLUG"
- 限制为 10 个循环,每个循环 10 个间隔/超时 10 秒
@echo off
set/a "_c+=0"
pushd "%__AppDir__%"
title <nul & title ..\%~nx0
setlocal EnableDelayedExpansion
set "_Reg_Key=HKCU\Control Panel\Desktop"
:loop
for /f ^skip^=2tokens^=2* %%i in (
';2^>^&1 reg.exe query "!_Reg_Key!" /v SCRNSAVE.EXE
')do if /i "%%~xj" == ".scr" (set "_scr_svr=%%~nxj") else (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Disable " - - - - -!"
rem./ With ScreenSaver is disabled no status is need && goto:next
)
for /f skip^=2tokens^=2* %%i in (
';2^>nul reg query "!_Reg_Key!" /v ScreenSaveActive')do if %%j equ 1 (
2>nul tasklist.exe/svc /fo list|find.exe/i "!_scr_svr!">nul && (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Running "!_scr_svr!"
) || (
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Enabled "!_scr_svr!"
echo/[ !date! ^| !time:~0,8! ] Screen Saver: Stopped "!_scr_svr!")
)
:next
2>nul tasklist.exe/svc /fo list|find.exe/i "LogonUI.exe" >nul && (
echo/[ !date! ^| !time:~0,8! ] Work Station: Locked "!ComputerName!"
) || echo/[ !date! ^| !time:~0,8! ] Work Station: Logged "!ComputerName!"
if !_c! leq 9 (
set /a "_c+=1" && set "_scr_svr=" && >nul timeout/t 10 & goto:Loop
) else popd && endlocal && goto:eof