As for the shelling out it should look more like this.

NOT TESTED

 
Shell '%COMSPEC% /C ' + 'netsh firewall add portopening protocol=TCP port=5900 name='+'"'+'VNCEnterprise2'+'"'+' mode='+'"'+'enable'"'+' scope='+'"'+'subnet'+'"'