Improve SGU logon resilience and client UX

scripts/Deploy-AuthBroker.ps1

@@ -22,6 +22,9 @@ param(
     [string]$BaseDn = 'DC=lci,DC=lasalle,DC=mx',
     [string]$DomainNetbios = 'LCI',
     [string]$UpnSuffix = 'lci.lasalle.mx',
+    [string]$RemoteDesktopGroupDn = '',
+    [ValidateRange(10, 60)]
+    [int]$NtlmTimeoutSeconds = 15,
     [switch]$CreateMissingOus,
     [switch]$DisableCertificateRevocationCheckForLab
 )
@@ -96,6 +99,15 @@ if ($CreateMissingOus) {
     }
 }
 
+if ($RemoteDesktopGroupDn) {
+    Import-Module ActiveDirectory -ErrorAction Stop
+    $remoteDesktopGroup = Get-ADGroup -Identity $RemoteDesktopGroupDn -Server $LdapHost -ErrorAction Stop
+    if ($remoteDesktopGroup.GroupCategory -ne 'Security' -or
+        -not $remoteDesktopGroup.DistinguishedName.EndsWith(",$BaseDn", [StringComparison]::OrdinalIgnoreCase)) {
+        throw 'RemoteDesktopGroupDn must identify a security group beneath BaseDn.'
+    }
+}
+
 foreach ($file in @('SGU.AuthBroker.exe', 'SGU.AuthBroker.dll', 'appsettings.json')) {
     if (-not (Test-Path -LiteralPath (Join-Path $PublishPath $file))) {
         throw "PublishPath is missing $file."
@@ -124,7 +136,7 @@ $productionSettings = @{
         Ntlm = @{
             Endpoint = $NtlmEndpoint
             Domain = ''
-            TimeoutSeconds = 15
+            TimeoutSeconds = $NtlmTimeoutSeconds
             MaxRedirects = 5
             AdministrativeProfilePath = $AdministrativeProfilePath
             MenuProfilePath = $MenuProfilePath
@@ -139,6 +151,7 @@ $productionSettings = @{
             ProfessorOuDn = "OU=Docentes,OU=Usuarios-SGU,$BaseDn"
             StudentOuDn = "OU=Alumnos,OU=Usuarios-SGU,$BaseDn"
             AdministrativeOuDn = "OU=Administrativos,OU=Usuarios-SGU,$BaseDn"
+            RemoteDesktopGroupDn = $RemoteDesktopGroupDn
             CreateMissingOus = [bool]$CreateMissingOus
         }
     }
@@ -147,6 +160,13 @@ $productionSettings = @{
 if ($PSCmdlet.ShouldProcess($installPath, 'Install the SGU Authentication Broker Windows service')) {
     if (Get-Service -Name $serviceName -ErrorAction SilentlyContinue) {
         Stop-Service -Name $serviceName -Force
+        (Get-Service -Name $serviceName).WaitForStatus(
+            [System.ServiceProcess.ServiceControllerStatus]::Stopped,
+            [TimeSpan]::FromSeconds(15))
+
+        # A self-contained .NET process can briefly retain mapped runtime files
+        # after SCM reports Stopped. Give Windows time to release those handles.
+        Start-Sleep -Seconds 2
     }
 
     New-Item -ItemType Directory -Path $installPath -Force | Out-Null
@@ -165,6 +185,18 @@ if ($PSCmdlet.ShouldProcess($installPath, 'Install the SGU Authentication Broker
             -BinaryPathName ('"{0}"' -f (Join-Path $installPath 'SGU.AuthBroker.exe')) `
             -StartupType Automatic
     }
+    else {
+        Set-Service -Name $serviceName -StartupType Automatic
+    }
+
+    & sc.exe failure $serviceName 'reset=' '86400' 'actions=' 'restart/5000/restart/15000/restart/60000' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw 'Could not configure automatic recovery for SGUAuthBroker.'
+    }
+    & sc.exe failureflag $serviceName '1' | Out-Null
+    if ($LASTEXITCODE -ne 0) {
+        throw 'Could not enable recovery for non-crash SGUAuthBroker failures.'
+    }
 
     if (-not (Get-NetFirewallRule -DisplayName 'SGU Authentication Broker (mTLS)' -ErrorAction SilentlyContinue)) {
         New-NetFirewallRule -DisplayName 'SGU Authentication Broker (mTLS)' `