Improve SGU logon resilience and client UX

2026-09-01 10:37:40 -06:00
parent 3d0897316d
commit da01343985
27 changed files with 869 additions and 37 deletions
@@ -0,0 +1,90 @@
+[CmdletBinding(SupportsShouldProcess)]
+param(
+    [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
+    [switch]$EnableAdministrativeFirewallGroups
+)
+
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = [Security.Principal.WindowsPrincipal]::new($identity)
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    throw 'Run this script from an elevated Windows PowerShell session.'
+}
+
+$computer = Get-CimInstance Win32_ComputerSystem
+if (-not $computer.PartOfDomain) {
+    throw 'Join the computer to the domain before enabling domain-scoped remote access.'
+}
+
+$remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-555')
+$remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]
+
+if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
+    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
+        -Name fDenyTSConnections -Type DWord -Value 0
+    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
+        -Name UserAuthentication -Type DWord -Value 1
+
+    Set-Service -Name TermService -StartupType Automatic
+    Start-Service -Name TermService
+
+    Get-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP' `
+        -ErrorAction SilentlyContinue |
+        Set-NetFirewallRule -Enabled True -Profile Domain
+
+    $existingMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
+    if ($existingMembers.Name -notcontains $RemoteDesktopPrincipal) {
+        Add-LocalGroupMember -Group $remoteDesktopUsersGroup -Member $RemoteDesktopPrincipal
+    }
+
+    # Use Windows PowerShell so both the inbox and compatible remoting endpoints
+    # are configured even when this helper is launched from PowerShell 7.
+    $enableRemoting = Start-Process -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" `
+        -ArgumentList @('-NoLogo', '-NoProfile', '-NonInteractive', '-Command',
+            'Enable-PSRemoting -Force -SkipNetworkProfileCheck') `
+        -Wait -PassThru -WindowStyle Hidden
+    if ($enableRemoting.ExitCode -ne 0) {
+        throw "Enable-PSRemoting returned $($enableRemoting.ExitCode)."
+    }
+
+    Set-Service -Name WinRM -StartupType Automatic
+    Start-Service -Name WinRM
+    Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP','WINRM-HTTP-In-TCP-NoScope' `
+        -ErrorAction SilentlyContinue |
+        Set-NetFirewallRule -Enabled True -Profile Domain
+    Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP-PUBLIC' -ErrorAction SilentlyContinue |
+        Disable-NetFirewallRule
+
+    if ($EnableAdministrativeFirewallGroups) {
+        $administrativeRules = @(
+            'RemoteEventLogSvc-In-TCP',
+            'RemoteEventLogSvc-NP-In-TCP',
+            'RemoteEventLogSvc-RPCSS-In-TCP',
+            'RemoteSvcAdmin-In-TCP',
+            'RemoteSvcAdmin-NP-In-TCP',
+            'RemoteSvcAdmin-RPCSS-In-TCP',
+            'WMI-RPCSS-In-TCP',
+            'WMI-WINMGMT-In-TCP',
+            'WMI-ASYNC-In-TCP'
+        )
+        Get-NetFirewallRule -Name $administrativeRules -ErrorAction SilentlyContinue |
+            Set-NetFirewallRule -Enabled True -Profile Domain
+    }
+}
+
+$rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
+[pscustomobject]@{
+    ComputerName = $env:COMPUTERNAME
+    Domain = $computer.Domain
+    RemoteDesktopEnabled = (Get-ItemPropertyValue `
+        'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
+        -Name fDenyTSConnections) -eq 0
+    NetworkLevelAuthentication = (Get-ItemPropertyValue `
+        'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
+        -Name UserAuthentication) -eq 1
+    RemoteDesktopPrincipal = $RemoteDesktopPrincipal
+    PrincipalIsAuthorized = $rdpMembers.Name -contains $RemoteDesktopPrincipal
+    TermService = (Get-Service TermService).Status
+    WinRM = (Get-Service WinRM).Status
+    FirewallProfile = 'Domain'
+}