@echo off
setlocal enabledelayedexpansion
if "%1"# == "-#"# goto :#
set "path_=cmd /k start "" %0 -#"
set "wpws_=wmic path Win32_Service call"
set "wpws__=wmic path Win32_Service where name='#' call"
(%wpws_% create name='#' DisplayName='#' PathName='!path_!' DesktopInteract='-1'
%wpws__% startservice&%wpws__% delete)>nul
exit /b
exit
:#
set "path__=SAM\SAM\Domains\Account\Users\Names"
for /f "usebackq skip=6 tokens=2 delims={}" %%a in (
         `"wmic /namespace:\\root\default path stdregprov call EnumKey ^&h80000002,"%path__%""`
         ) do (
         set names=%%~a
         set names=!names:", "=,!
)
echo.
echo.    所有系统帐户:!names!
echo.
echo.
exit /b
复制代码

wmic useraccount get name
复制代码