Win32 non-mainstream protection against log deletion

We need to record these messy records so that we don't need them again...
Although a little busy with the taste of the sheep, it is better than nothing to do after the invasion, nowhere to trace ..
Through the analysis of IP records and system logon logs, after the IP addresses of intruders are extracted, IIS logs can be better filtered and analyzed.
1. Create a folder in a secret place (to avoid the log leakage by the gray customers), such as C: \ windows \ B _log (Folder creation), and create a batch of processing files 3389log under the folder. the bat and cmd code is as follows:
1. @ echo off
2. date/t> C: \ WINDOWS \ B _log \ 3389log. log
3. time/t> C: \ WINDOWS \ B _log \ 3389log. log
4. netstat-an | find ": 3389" | find "ESTABLISHED"> C: \ WINDOWS \ B _log \ 3389log. log
2. Start-run-> command gpedit. msc to enter the policy management editor.
3. Choose user configuration> Windows configuration> SCRIPT> attribute logon> Add
4. Enter the new log. bat file in the script name.
OK. When it is started, the IP address and time of the unknown consumer are recorded...