Fix fresh domain controller bootstrap

scripts/Enable-SguServerRemoteManagement.ps1

@@ -1,5 +1,8 @@
 [CmdletBinding(SupportsShouldProcess)]
-param()
+param(
+    [ValidateNotNullOrEmpty()]
+    [string[]]$AllowedRemoteAddress = @('LocalSubnet')
+)
 
 $ErrorActionPreference = 'Stop'
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
@@ -38,9 +41,12 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable secure administrative RDP
 
     Set-Service -Name TermService -StartupType Automatic
     Start-Service -Name TermService
-    Get-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP' `
-        -ErrorAction SilentlyContinue |
-        Set-NetFirewallRule -Enabled True -Profile Domain
+    $remoteDesktopRules = @(Get-NetFirewallRule `
+        -Name 'RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP' `
+        -ErrorAction SilentlyContinue)
+    $remoteDesktopRules | Set-NetFirewallRule -Enabled True -Profile Any
+    $remoteDesktopRules | Get-NetFirewallAddressFilter |
+        Set-NetFirewallAddressFilter -RemoteAddress $AllowedRemoteAddress | Out-Null
 
     $enableRemoting = Start-Process `
         -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" `
@@ -57,9 +63,12 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable secure administrative RDP
 
     Set-Service -Name WinRM -StartupType Automatic
     Start-Service -Name WinRM
-    Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP','WINRM-HTTP-In-TCP-NoScope' `
-        -ErrorAction SilentlyContinue |
-        Set-NetFirewallRule -Enabled True -Profile Domain
+    $winRmRules = @(Get-NetFirewallRule `
+        -Name 'WINRM-HTTP-In-TCP','WINRM-HTTP-In-TCP-NoScope' `
+        -ErrorAction SilentlyContinue)
+    $winRmRules | Set-NetFirewallRule -Enabled True -Profile Any
+    $winRmRules | Get-NetFirewallAddressFilter |
+        Set-NetFirewallAddressFilter -RemoteAddress $AllowedRemoteAddress | Out-Null
     Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP-PUBLIC' -ErrorAction SilentlyContinue |
         Disable-NetFirewallRule
 
@@ -74,8 +83,11 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable secure administrative RDP
         'WMI-WINMGMT-In-TCP',
         'WMI-ASYNC-In-TCP'
     )
-    Get-NetFirewallRule -Name $administrativeRules -ErrorAction SilentlyContinue |
-        Set-NetFirewallRule -Enabled True -Profile Domain
+    $enabledAdministrativeRules = @(Get-NetFirewallRule `
+        -Name $administrativeRules -ErrorAction SilentlyContinue)
+    $enabledAdministrativeRules | Set-NetFirewallRule -Enabled True -Profile Any
+    $enabledAdministrativeRules | Get-NetFirewallAddressFilter |
+        Set-NetFirewallAddressFilter -RemoteAddress $AllowedRemoteAddress | Out-Null
 }
 
 [pscustomobject]@{
@@ -88,7 +100,8 @@ if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, 'Enable secure administrative RDP
         -Name UserAuthentication) -eq 1
     TermService = (Get-Service TermService).Status
     WinRM = (Get-Service WinRM).Status
-    FirewallProfile = 'Domain'
+    FirewallProfile = 'Any'
+    AllowedRemoteAddress = $AllowedRemoteAddress
     AdministrativeAccessOnly = $true
     AlwaysOnPowerPolicyApplied = $true
 }