[CmdletBinding(SupportsShouldProcess)]
param(
    [string]$RemoteDesktopPrincipal = 'LCI\SG-Laboratorio-Usuarios-RDP',
    [switch]$EnableAdministrativeFirewallGroups
)

$ErrorActionPreference = 'Stop'
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = [Security.Principal.WindowsPrincipal]::new($identity)
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    throw 'Run this script from an elevated Windows PowerShell session.'
}

$computer = Get-CimInstance Win32_ComputerSystem
if (-not $computer.PartOfDomain) {
    throw 'Join the computer to the domain before enabling domain-scoped remote access.'
}

$remoteDesktopUsersSid = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-555')
$remoteDesktopUsersGroup = ($remoteDesktopUsersSid.Translate([Security.Principal.NTAccount]).Value -split '\\', 2)[1]

if ($PSCmdlet.ShouldProcess($env:COMPUTERNAME, "Enable RDP and grant $RemoteDesktopPrincipal access")) {
    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
        -Name fDenyTSConnections -Type DWord -Value 0
    Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
        -Name UserAuthentication -Type DWord -Value 1

    Set-Service -Name TermService -StartupType Automatic
    Start-Service -Name TermService

    Get-NetFirewallRule -Name 'RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP' `
        -ErrorAction SilentlyContinue |
        Set-NetFirewallRule -Enabled True -Profile Domain

    $existingMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
    if ($existingMembers.Name -notcontains $RemoteDesktopPrincipal) {
        Add-LocalGroupMember -Group $remoteDesktopUsersGroup -Member $RemoteDesktopPrincipal
    }

    # Use Windows PowerShell so both the inbox and compatible remoting endpoints
    # are configured even when this helper is launched from PowerShell 7.
    $enableRemoting = Start-Process -FilePath "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe" `
        -ArgumentList @('-NoLogo', '-NoProfile', '-NonInteractive', '-Command',
            'Enable-PSRemoting -Force -SkipNetworkProfileCheck') `
        -Wait -PassThru -WindowStyle Hidden
    if ($enableRemoting.ExitCode -ne 0) {
        throw "Enable-PSRemoting returned $($enableRemoting.ExitCode)."
    }

    Set-Service -Name WinRM -StartupType Automatic
    Start-Service -Name WinRM
    Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP','WINRM-HTTP-In-TCP-NoScope' `
        -ErrorAction SilentlyContinue |
        Set-NetFirewallRule -Enabled True -Profile Domain
    Get-NetFirewallRule -Name 'WINRM-HTTP-In-TCP-PUBLIC' -ErrorAction SilentlyContinue |
        Disable-NetFirewallRule

    if ($EnableAdministrativeFirewallGroups) {
        $administrativeRules = @(
            'RemoteEventLogSvc-In-TCP',
            'RemoteEventLogSvc-NP-In-TCP',
            'RemoteEventLogSvc-RPCSS-In-TCP',
            'RemoteSvcAdmin-In-TCP',
            'RemoteSvcAdmin-NP-In-TCP',
            'RemoteSvcAdmin-RPCSS-In-TCP',
            'WMI-RPCSS-In-TCP',
            'WMI-WINMGMT-In-TCP',
            'WMI-ASYNC-In-TCP'
        )
        Get-NetFirewallRule -Name $administrativeRules -ErrorAction SilentlyContinue |
            Set-NetFirewallRule -Enabled True -Profile Domain
    }
}

$rdpMembers = @(Get-LocalGroupMember -Group $remoteDesktopUsersGroup -ErrorAction SilentlyContinue)
[pscustomobject]@{
    ComputerName = $env:COMPUTERNAME
    Domain = $computer.Domain
    RemoteDesktopEnabled = (Get-ItemPropertyValue `
        'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
        -Name fDenyTSConnections) -eq 0
    NetworkLevelAuthentication = (Get-ItemPropertyValue `
        'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
        -Name UserAuthentication) -eq 1
    RemoteDesktopPrincipal = $RemoteDesktopPrincipal
    PrincipalIsAuthorized = $rdpMembers.Name -contains $RemoteDesktopPrincipal
    TermService = (Get-Service TermService).Status
    WinRM = (Get-Service WinRM).Status
    FirewallProfile = 'Domain'
}