117 lines
5.3 KiB
PowerShell
117 lines
5.3 KiB
PowerShell
[CmdletBinding(SupportsShouldProcess)]
|
|
param(
|
|
[string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
|
|
[switch]$EnableAdministrativeFirewallGroups
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
|
|
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
throw 'Run this script from an elevated Windows PowerShell session.'
|
|
}
|
|
|
|
$computer = Get-CimInstance Win32_ComputerSystem
|
|
if (-not $computer.PartOfDomain) {
|
|
throw 'Join the computer to the domain before enabling domain-scoped remote access.'
|
|
}
|
|
|
|
$remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-555')
|
|
$remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]
|
|
|
|
if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
|
|
function Invoke-PowerCfgBestEffort {
|
|
param([Parameter(Mandatory)][string[]]$Arguments)
|
|
|
|
# Start-Process keeps powercfg's policy-override diagnostic on its own
|
|
# stderr stream. In PowerShell 7, directly invoking that native command
|
|
# turns stderr into a terminating ErrorRecord under $ErrorActionPreference
|
|
# = 'Stop', which previously aborted this unrelated remediation work.
|
|
$process = Start-Process -FilePath "$env:SystemRoot\System32\powercfg.exe" `
|
|
-ArgumentList $Arguments -Wait -PassThru -WindowStyle Hidden
|
|
if ($process.ExitCode -ne 0) {
|
|
Write-Warning "powercfg $($Arguments -join ' ') returned exit code $($process.ExitCode); continuing enrollment repair."
|
|
}
|
|
}
|
|
|
|
foreach ($powerChange in @(
|
|
@('monitor-timeout-ac', '0'),
|
|
@('monitor-timeout-dc', '0'),
|
|
@('standby-timeout-ac', '0'),
|
|
@('standby-timeout-dc', '0'),
|
|
@('hibernate-timeout-ac', '0'),
|
|
@('hibernate-timeout-dc', '0'))) {
|
|
Invoke-PowerCfgBestEffort -Arguments @('/change', $powerChange[0], $powerChange[1])
|
|
}
|
|
Invoke-PowerCfgBestEffort -Arguments @('/hibernate', 'off')
|
|
|
|
Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
|
|
-Name fDenyTSConnections -Type DWord -Value 0
|
|
Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
|
|
-Name UserAuthentication -Type DWord -Value 1
|
|
|
|
Set-Service -Name TermService -StartupType Automatic
|
|
Start-Service -Name TermService
|
|
|
|
Get-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP' `
|
|
-ErrorAction SilentlyContinue |
|
|
Set-NetFirewallRule -Enabled True -Profile Domain
|
|
|
|
$existingMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
|
|
if ($existingMembers.Name -notcontains $RemoteDesktopPrincipal) {
|
|
Add-LocalGroupMember -Group $remoteDesktopUsersGroup -Member $RemoteDesktopPrincipal
|
|
}
|
|
|
|
# Use Windows PowerShell so both the inbox and compatible remoting endpoints
|
|
# are configured even when this helper is launched from PowerShell 7.
|
|
$enableRemoting = Start-Process -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" `
|
|
-ArgumentList @('-NoLogo', '-NoProfile', '-NonInteractive', '-Command',
|
|
'Enable-PSRemoting -Force -SkipNetworkProfileCheck') `
|
|
-Wait -PassThru -WindowStyle Hidden
|
|
if ($enableRemoting.ExitCode -ne 0) {
|
|
throw "Enable-PSRemoting returned $($enableRemoting.ExitCode)."
|
|
}
|
|
|
|
Set-Service -Name WinRM -StartupType Automatic
|
|
Start-Service -Name WinRM
|
|
Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP','WINRM-HTTP-In-TCP-NoScope' `
|
|
-ErrorAction SilentlyContinue |
|
|
Set-NetFirewallRule -Enabled True -Profile Domain
|
|
Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP-PUBLIC' -ErrorAction SilentlyContinue |
|
|
Disable-NetFirewallRule
|
|
|
|
if ($EnableAdministrativeFirewallGroups) {
|
|
$administrativeRules = @(
|
|
'RemoteEventLogSvc-In-TCP',
|
|
'RemoteEventLogSvc-NP-In-TCP',
|
|
'RemoteEventLogSvc-RPCSS-In-TCP',
|
|
'RemoteSvcAdmin-In-TCP',
|
|
'RemoteSvcAdmin-NP-In-TCP',
|
|
'RemoteSvcAdmin-RPCSS-In-TCP',
|
|
'WMI-RPCSS-In-TCP',
|
|
'WMI-WINMGMT-In-TCP',
|
|
'WMI-ASYNC-In-TCP'
|
|
)
|
|
Get-NetFirewallRule -Name $administrativeRules -ErrorAction SilentlyContinue |
|
|
Set-NetFirewallRule -Enabled True -Profile Domain
|
|
}
|
|
}
|
|
|
|
$rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
|
|
[pscustomobject]@{
|
|
ComputerName = $env:COMPUTERNAME
|
|
Domain = $computer.Domain
|
|
RemoteDesktopEnabled = (Get-ItemPropertyValue `
|
|
'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
|
|
-Name fDenyTSConnections) -eq 0
|
|
NetworkLevelAuthentication = (Get-ItemPropertyValue `
|
|
'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
|
|
-Name UserAuthentication) -eq 1
|
|
RemoteDesktopPrincipal = $RemoteDesktopPrincipal
|
|
PrincipalIsAuthorized = $rdpMembers.Name -contains $RemoteDesktopPrincipal
|
|
TermService = (Get-Service TermService).Status
|
|
WinRM = (Get-Service WinRM).Status
|
|
FirewallProfile = 'Domain'
|
|
AlwaysOnPowerPolicyApplied = $true
|
|
}
|