Improve SGU logon resilience and client UX

docs/lab-runbook.md

@@ -80,6 +80,7 @@ certificate thumbprint:
   -PublishPath C:\Deploy\broker `
   -ServerCertificateSubject sgu-auth.lci.lasalle.mx `
   -AllowedClientThumbprints CLIENT_CERT_THUMBPRINT `
+  -RemoteDesktopGroupDn 'CN=SG-Laboratorio-Usuarios-RDP,OU=Laboratorio,DC=lci,DC=lasalle,DC=mx' `
   -CreateMissingOus `
   -DisableCertificateRevocationCheckForLab
 ```
@@ -88,6 +89,8 @@ Verify the service and managed OUs:
 
 ```powershell
 Get-Service SGUAuthBroker
+Get-NetTCPConnection -LocalPort 8443 -State Listen
+sc.exe qfailure SGUAuthBroker
 Get-ADOrganizationalUnit -Filter * -SearchBase 'OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx'
 ```
 
@@ -116,6 +119,7 @@ On Windows 10:
   -BrokerEndpoint https://sgu-auth.lci.lasalle.mx:8443/v1/authenticate `
   -ClientCertificateThumbprint CLIENT_CERT_THUMBPRINT `
   -ServerCertificateThumbprint SERVER_CERT_THUMBPRINT `
+  -TimeoutSeconds 20 `
   -InstallDotNetRuntime `
   -DotNetRuntimeInstallerPath C:\SGUDeploy\prerequisites\dotnet-runtime-10.0.11-win-x64.exe
 ```
@@ -124,6 +128,18 @@ Use Lithnet's `Invoke-CredUI` test utility when available, or lock the VM and
 select **Acceso institucional SGU** under sign-in options. Keep the built-in
 Windows password tile visible.
 
+Before testing through Hyper-V Enhanced Session/RDP, enable the dedicated lab
+group and Windows PowerShell Remoting:
+
+```powershell
+.\Enable-LabRemoteAccess.ps1 `
+  -RemoteDesktopPrincipal 'LCI\SG-Laboratorio-Usuarios-RDP' `
+  -EnableAdministrativeFirewallGroups
+```
+
+See [`windows-client-onboarding.md`](windows-client-onboarding.md) for domain
+join, RDP, WinRM, firewall, and error `0xC000015B` diagnostics.
+
 ## 6. Required end-to-end cases
 
 1. Online valid `DO`, `AL`, and `AD` logons; verify each OU.